MALICIOUS — virussign.com_23ebcfcf19ec64161cb3c5c6b6322da0.vir

MALICIOUS — virussign.com_23ebcfcf19ec64161cb3c5c6b6322da0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Azov family. 6 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 986fc334479420c39feb431824f364228ee678428037d9a64b2be1c4f2a762f0
• SHA-1: 1370f2a9948db87ecfef8868f7507c86cfdc4447
• MD5: 23ebcfcf19ec64161cb3c5c6b6322da0
• imphash: f7d9aa1586a9bf8d3a6f315b71206fa9
• ssdeep: 12288:yuRIAiD1SCy6u1ihUQ/Hs9MuVe+7cCUuI:yUCy6Cirae+FI
• TLSH: T12A4F39440517B3A7EBF7B6111930578CE64772BA667C2B9C5B06E02E404FA27CBD248E
• Submitted as: virussign.com_23ebcfcf19ec64161cb3c5c6b6322da0.vir
• File type: pe · Size: 688661 bytes
• Verdict: malicious (92/100) · Family: Azov

Source: VirusSign · first seen 2026-08-15T00:00:00.000Z · SHA-256 verified

Detections (6 of 55 engines)

• capa (capabilities): capability:collection/keylog
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
• Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
• Trellix Stinger (McAfee): Trojan-FXIH!23EBCFCF19EC
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

• T1056.001

Why this verdict

The malicious score of 92/100 is the fusion of 5 weighted signals:

• Microsoft Defender flagged Ransom:Win64/Azov.psyA!MTB (rule Ransom:Win64/Azov.psyA!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Ransom.Azov.1 (rule Trojan.Ransom.Azov.1) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Trojan-FXIH!23EBCFCF19EC (rule Trojan-FXIH!23EBCFCF19EC) - engine signal, weight 0.55, confidence 0.85
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings

Embedded domains

• ug.mi.oc.co
• schemas.microsoft.com

More Azov samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report