MALICIOUS — virussign.com_eccdae2512c92cb13f755ef9aaed7e30.vir

MALICIOUS — virussign.com_eccdae2512c92cb13f755ef9aaed7e30.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Barys family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: ba44e5f37ddb74129367fa6cd5bd3a3702d7610b80067779a633108e1dcaa49e
• SHA-1: 010caf7076dc0e5482059eb792c3a736509c779c
• MD5: eccdae2512c92cb13f755ef9aaed7e30
• imphash: 77f5f8e4901eada229f813d12f056cde
• ssdeep: 3072:sR29juSL4jJ6VkgrVQ71u5AOYe+wcTHKKE8ZIv8Z7Rf/vbpS2egfEeb7s:AC6SLAJ6VkgrVQ71u5AdwcTHKkG+7Rf
• TLSH: T151415D9E4205A345F962D74118027E5F1A23F4963AFF597C4BC3D17FA362EA3E880249
• Submitted as: virussign.com_eccdae2512c92cb13f755ef9aaed7e30.vir
• File type: pe · Size: 194599 bytes
• Verdict: malicious (94/100) · Family: Barys

Source: VirusSign · first seen 2026-08-10T00:00:00.000Z · SHA-256 verified

Detections (6 of 52 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Malware.Barys-10037479-0
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: Trojan:Win32/Staser.ARA!MTB
• Emsisoft (Emergency Kit): Dump:Generic.Dacic.21639.9460A6A1
• Kaspersky (KVRT): HEUR:Trojan-Spy.Win32.Zbot.gen

MITRE ATT&CK

• T1071.001
• T1057
• T1056.001

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Malware.Barys-10037479-0 (rule Win.Malware.Barys-10037479-0) - engine signal, weight 0.90, confidence 0.95
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

• example.com

File paths

• X:\:`:d:h:l:
• J:\:n:

More Barys samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report