MALICIOUS — virussign.com_8430ae7fbe76af7e2caf2e717c440200.vir

MALICIOUS — virussign.com_8430ae7fbe76af7e2caf2e717c440200.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Azov family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 4d9f1d26ab6593b672560df79b84380d0b392e1aafbb57fef8e6e27de75d77fb
SHA-1: d587186b19fe5adc5fb4e973c26480e5d9f10b62
MD5: 8430ae7fbe76af7e2caf2e717c440200
imphash: 46c86421d03855f22048c22182f40032
ssdeep: 3072:iYf6brnonpfB59U39Ml6VSkHteWpooCYOKf+g6sUR47COPts3w6Bfz/:qH2pBs9TDD7CLNas3Lfz/
TLSH: T1E3425BA4815B2312E2F7D864B83086DD882AB51CA0F1AECE4303C17A45F5F7BD4768E5
Submitted as: virussign.com_8430ae7fbe76af7e2caf2e717c440200.vir
File type: pe · Size: 205725 bytes
Verdict: malicious (97/100) · Family: Azov

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (5 of 56 engines)

YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
Trellix Stinger (McAfee): Trojan-FXIH!8430AE7FBE76
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 10 weighted signals:

Microsoft Defender flagged Ransom:Win64/Azov.psyA!MTB (rule Ransom:Win64/Azov.psyA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Ransom.Azov.1 (rule Trojan.Ransom.Azov.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FXIH!8430AE7FBE76 (rule Trojan-FXIH!8430AE7FBE76) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Contacted 1 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5744) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

26 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

f368f64b2f38ca55daa4f59e5d7331e612e41ebe05c9f58b4d9c992104deb503 - f368f64b2f38ca55daa4f59e5d7331e612e41ebe05c9f58b4d9c992104deb503

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

104.208.16.94
20.247.184.142
4.230.171.124
104.18.33.89
135.233.95.135
57.155.104.224
74.179.77.204
20.184.175.1
20.184.175.10
52.110.12.50
52.110.12.8
52.110.12.45
172.178.240.161

More Azov samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report