MALICIOUS — virussign.com_eb8208a284f2b7dbbd1fc66568e8f6d0.vir

MALICIOUS — virussign.com_eb8208a284f2b7dbbd1fc66568e8f6d0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Expiro family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 88dca6d004a337f843f22097cb729600907ca8a098743677882ce9f8ec2c65a3
SHA-1: 9edaee6caa0102c3017159cca2d113254e00453d
MD5: eb8208a284f2b7dbbd1fc66568e8f6d0
imphash: 0f4f0c3e62a9e9cfa3fe2208af74764a
ssdeep: 6144:iJb5DLSj7zPgauBhYCoD82X94GnI2+e3zv07l3VoDd9WhXmw1SYaDYXpEX1UnEvA:tJLspSYnEv2GvluYVlqx0gfv/
TLSH: T1C74BF6C1D887A487C399D918D4A198DC883DF065F4B1C0A84652D2AA9EFDD3371FB24B
Submitted as: virussign.com_eb8208a284f2b7dbbd1fc66568e8f6d0.vir
File type: pe · Size: 514368 bytes
Verdict: malicious (100/100) · Family: Expiro

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (7 of 56 engines)

capa (capabilities): capability:credential-access
ClamAV (daily): Win.Ransomware.Expiro-9975896-0
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win64/Expiro.DE!MTB
Emsisoft (Emergency Kit): Win64.Ransom.A
Kaspersky (KVRT): HEUR:Trojan.Win64.AsowWiper.c

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Expiro-9975896-0 (rule Win.Ransomware.Expiro-9975896-0) - engine signal, weight 0.90, confidence 0.95
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged Virus:Win64/Expiro.DE!MTB (rule Virus:Win64/Expiro.DE!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win64.Ransom.A (rule Win64.Ransom.A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win64.AsowWiper.c (rule HEUR:Trojan.Win64.AsowWiper.c) - engine signal, weight 0.55, confidence 0.85
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

40 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

f83f4763aac30201fcd1af006f0b509ee7824bd367046bf0fa1e7bd666686e51 - f83f4763aac30201fcd1af006f0b509ee7824bd367046bf0fa1e7bd666686e51

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

20.50.201.205
52.230.59.222
52.123.252.231
4.230.171.124
172.64.154.167
57.155.101.212
74.178.76.54
20.184.175.7
135.232.92.137
20.184.175.4
135.233.45.222
57.154.63.210
52.110.12.15
52.110.12.4

More Expiro samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report