SUSPICIOUS — virussign.com_20574256963641af37ebb7cca22d3160.vir
SUSPICIOUS — virussign.com_20574256963641af37ebb7cca22d3160.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (63/100), attributed to the AntiDebug family. 3 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
32e2637b808f658f74e765fa3373e97405f77c1c228651e8753fe320cdafd73d - SHA-1:
548a88d316db98bf86166ae38553af155d980e41 - MD5:
20574256963641af37ebb7cca22d3160 - imphash:
275ba497262c04542f59b9081353d98a - ssdeep:
98304:q0IvRAB8PWVUJ3osJPNuPNtLPNBPNhPNBPN:8CBiHJ42+zX3X - TLSH:
T11B627C420123A546D4B2E989AF219DAC9002E5E4F37459FDC78BD11ED2FA6F383B50B4 - Submitted as: virussign.com_20574256963641af37ebb7cca22d3160.vir
- File type: pe · Size: 4555776 bytes
- Verdict: suspicious (63/100) · Family: AntiDebug
Source: VirusSign · first seen 2026-08-08T00:00:00.000Z · SHA-256 verified
Detections (3 of 52 engines)
- capa (capabilities): capability:collection/keylog
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Emsisoft (Emergency Kit): Gen:Variant.Lazy.732239
MITRE ATT&CK
Why this verdict
The suspicious score of 63/100 is the fusion of 4 weighted signals:
- capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://t.me/cluster_cheats_support_bot, https://clustercheats.com, https://api.clustercheats.com/v1 - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://t.me/cluster_cheats_support_bot
- https://clustercheats.com
- https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage
- https://github.com/ocornut/imgui/blob/master/docs/BACKENDS.md
- https://github.com/ocornut/imgui/issues/8465
- https://api.clustercheats.com/v1
- https://www.dearimgui.com/faq/
- http://www.apple.com/http://www.apple.com/Copyright
Embedded domains
- t.me
- dearimgui.com
- clustercheats.com
- github.com
- api.clustercheats.com
- www.dearimgui.com
- www.apple.com
File paths
- R:\2
- C:\Cluster
- C:\Windows\Temp\mapper.dll
- F:\:p:
More AntiDebug samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report