MALICIOUS — virussign.com_fc5da94e002665e2962d923de71483c0.vir

MALICIOUS — virussign.com_fc5da94e002665e2962d923de71483c0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Azov family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 92bf490a9656277b727865cdfceb1a778b040d6abd5ac7be9961ee31ab52baa5
SHA-1: 97e5f3848a4d0322b7028004aa2b866c40ae41e2
MD5: fc5da94e002665e2962d923de71483c0
imphash: d058de892eb271cb836fb7509a04426e
ssdeep: 12288:M2SpSYnEv2GvBxds9zZd9f1fI0doABDZAV4V:MXpFnEvNudt1DoATg4V
TLSH: T1B74E5AC1D887E58BC2A9D608D4E198DC483DF0A4F4B1C1A81952E1999DFCD3371BBA4B
Submitted as: virussign.com_fc5da94e002665e2962d923de71483c0.vir
File type: pe · Size: 650149 bytes
Verdict: malicious (99/100) · Family: Azov

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (7 of 56 engines)

capa (capabilities): capability:credential-access
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
Trellix Stinger (McAfee): Trojan-FXIH!FC5DA94E0026
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 14 weighted signals:

YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged Ransom:Win64/Azov.psyA!MTB (rule Ransom:Win64/Azov.psyA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Ransom.Azov.1 (rule Trojan.Ransom.Azov.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FXIH!FC5DA94E0026 (rule Trojan-FXIH!FC5DA94E0026) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 4836) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

40 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

bd64a3d78c619b72ca63ea79dc0c0b71a2cb25394a878fa8f311b6cd772dcbda - bd64a3d78c619b72ca63ea79dc0c0b71a2cb25394a878fa8f311b6cd772dcbda

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

52.230.59.222
20.50.201.205
52.123.252.235
4.230.171.124
104.18.33.89
57.155.101.212
74.178.76.54
20.184.175.4
135.232.92.137
135.233.45.222
52.110.12.16

More Azov samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report