MALICIOUS — virussign.com_bf134cfece4105f995d32e00baaceb00.vir

MALICIOUS — virussign.com_bf134cfece4105f995d32e00baaceb00.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Azov family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 4a557c02b5c33e8469ef4f6fb22e38cdafaa055f88778dcfc72e77e9808f92cd
SHA-1: a1b7d3153bacdb169ef8be3090eff30fe8c92ac6
MD5: bf134cfece4105f995d32e00baaceb00
imphash: 46c86421d03855f22048c22182f40032
ssdeep: 3072:iYf6brnonpxBktU39sl6VSkHteWpooCYicMVZAMtGFstEUve+j+MLb6AC:qH2pus9zDD7CLcMXbLuAC
TLSH: T18E427CA4806B7312E2FAD864743145DC882AB95CA0B1AFCD9303C17A45F5F7BC47A8E5
Submitted as: virussign.com_bf134cfece4105f995d32e00baaceb00.vir
File type: pe · Size: 205725 bytes
Verdict: malicious (97/100) · Family: Azov

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (5 of 56 engines)

YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
Trellix Stinger (McAfee): Trojan-FXIH!BF134CFECE41
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 10 weighted signals:

Microsoft Defender flagged Ransom:Win64/Azov.psyA!MTB (rule Ransom:Win64/Azov.psyA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Ransom.Azov.1 (rule Trojan.Ransom.Azov.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FXIH!BF134CFECE41 (rule Trojan-FXIH!BF134CFECE41) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5852) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

25 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

41236beced948b77b553dafcfb73dee8fa1e1bd7dddfdc65960011e2aa16474a - 41236beced948b77b553dafcfb73dee8fa1e1bd7dddfdc65960011e2aa16474a

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

20.184.175.21
20.247.184.197
52.123.252.225
4.230.171.124
172.64.154.167
74.178.76.54
85.210.193.152
52.168.117.169
74.178.240.61
135.234.160.244
52.110.12.30
52.110.12.16

More Azov samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report