SUSPICIOUS — virussign.com_c25922a202882e4ee8c1743e1066c1b0.vir

SUSPICIOUS — virussign.com_c25922a202882e4ee8c1743e1066c1b0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (62/100), attributed to the AntiDebug family. 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 473f0c4184c42f73ca8bc95173e673f1644376aeb0b0842255423ee5e10fc715
SHA-1: 9a144dda0aca9e957f0af4a0159ba2b12aecf174
MD5: c25922a202882e4ee8c1743e1066c1b0
imphash: 46c86421d03855f22048c22182f40032
ssdeep: 3072:iYf6brnonp1BQ3U39Bl6VSkHteWpooCYgqpRloFmsFMfrh46Uto7jG18WS1V:qH2pIs9uDD7CNcajyTDUW7WhSf
TLSH: T1D8426BA1812B7302F2F3D8A4B47246DC8826B51CA0B1AECE5303C56E45F5F7B85768E5
Submitted as: virussign.com_c25922a202882e4ee8c1743e1066c1b0.vir
File type: pe · Size: 205725 bytes
Verdict: suspicious (62/100) · Family: AntiDebug

Source: VirusSign · first seen 2026-08-17T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
Trellix Stinger (McAfee): Trojan-FXIH!C25922A20288
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The suspicious score of 62/100 is the fusion of 5 weighted signals:

Contacted 22 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

26 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

f66e7fbf719b9ed5c07c7e347696f4b4ca7bd0aedb95869bc4f7d05be296deb4 - f66e7fbf719b9ed5c07c7e347696f4b4ca7bd0aedb95869bc4f7d05be296deb4

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

192.34.57.4
52.110.12.22
52.110.12.37
20.42.65.88
3.106.37.188
48.211.4.16
4.144.132.223
92.223.78.30
74.179.77.204
162.159.142.9
20.42.73.24
4.230.171.124
172.178.240.161
74.178.240.51
20.112.250.133
135.233.45.223
20.42.65.94
52.123.129.14
52.110.12.19
52.148.114.188
52.110.12.18
172.66.2.5

More AntiDebug samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report