MALICIOUS — virussign.com_5933fbd0b6ab381dd1bfab0dfbe4df00.vir

MALICIOUS — virussign.com_5933fbd0b6ab381dd1bfab0dfbe4df00.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Expiro family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 6b74ddcae49eaace136d4cde759674da5e8f0b1c0515ccbadfb63e6798a60130
SHA-1: ba50861d35197bcb089595cf625eaac79060d864
MD5: 5933fbd0b6ab381dd1bfab0dfbe4df00
imphash: d058de892eb271cb836fb7509a04426e
ssdeep: 12288:j2SpSYnEv2GvIx0lqcZWX+XUFYbK8A8xyWzP:jXpFnEv8KlquS+EFcK8A8xLzP
TLSH: T1774E5BC1D887A58BC2A9D608D4E198DC483DF0A5F0B1C1A81692E1999DFCD3371FB64B
Submitted as: virussign.com_5933fbd0b6ab381dd1bfab0dfbe4df00.vir
File type: pe · Size: 649646 bytes
Verdict: malicious (100/100) · Family: Expiro

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (7 of 56 engines)

capa (capabilities): capability:credential-access
ClamAV (daily): Win.Ransomware.Expiro-9975896-0
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win64/Expiro.DE!MTB
Emsisoft (Emergency Kit): Win64.Ransom.A
Kaspersky (KVRT): HEUR:Trojan.Win64.AsowWiper.c

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Expiro-9975896-0 (rule Win.Ransomware.Expiro-9975896-0) - engine signal, weight 0.90, confidence 0.95
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged Virus:Win64/Expiro.DE!MTB (rule Virus:Win64/Expiro.DE!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win64.Ransom.A (rule Win64.Ransom.A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win64.AsowWiper.c (rule HEUR:Trojan.Win64.AsowWiper.c) - engine signal, weight 0.55, confidence 0.85
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

40 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

c54a629e7d4fd458851b59e75c6e34fe835b3b884eef6bc2124aaf3bb780a570 - c54a629e7d4fd458851b59e75c6e34fe835b3b884eef6bc2124aaf3bb780a570

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

51.116.253.170
4.144.132.223
4.230.171.124
135.232.92.97
20.42.179.204
4.150.223.99
74.178.240.61
172.178.240.163
52.110.12.32
52.110.12.16

More Expiro samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report