SUSPICIOUS — virussign.com_86dcafaeb925d2b938799aaace01b650.vir

SUSPICIOUS — virussign.com_86dcafaeb925d2b938799aaace01b650.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (64/100), attributed to the AntiDebug family. 3 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: fbf39ae14237d9acd863904bba3b38375b44947a3460c5ee08985649462e2870
SHA-1: f6a4e409a3b5fa2c5d5c574d0facec7672e9cfe0
MD5: 86dcafaeb925d2b938799aaace01b650
imphash: 542863a264e826bf130b0880664f67e4
ssdeep: 24576:S7OV+9p9CZdQdtg6lNGA9x0flcaRQ1aCOc2m1GFI:SBG6XGA/6xM1II
TLSH: T1496A4A2182097B2AD9D1E4B9D00D9F6C2167A84873FA4FDCA657560CA3C60F7943A4F3
Submitted as: virussign.com_86dcafaeb925d2b938799aaace01b650.vir
File type: pe · Size: 9807961 bytes
Verdict: suspicious (64/100) · Family: AntiDebug

Source: VirusSign · first seen 2026-08-21T00:00:00.000Z · SHA-256 verified

Detections (3 of 55 engines)

YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Zusy.KK!MTB
Kaspersky (KVRT): HEUR:Trojan.Win32.Agent.pef

MITRE ATT&CK

T1105

Why this verdict

The suspicious score of 64/100 is the fusion of 4 weighted signals:

Contacted 23 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://gcc.gnu.org/bugs/ - static signal, weight 0.35, confidence 0.60
Dropped 5 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

228 behavior events · 0 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\mutated_31104.exe - 7d3954736ee9898784b04a44ece8eaaa277bd6c4d42e05165b8b63871bffa877
C:\Users\analyst\AppData\Local\Temp\mutated_22121.exe - a777e7ec32b3bd47abcd6d786b05eef9b4cdeebcb9209cd8358f95774c2cf735
C:\Users\analyst\AppData\Local\Temp\mutated_30467.exe - 4d720ad869bdd1ed6b51904e17013cf0c130cd974d9aaa3aa6e821fbd3e434d2
C:\Users\analyst\AppData\Local\Temp\mutated_10178.exe - 9877741628e32ab320f4957a2703b5005da4860fcdffd7bda2386d7c69b76cd7
C:\Users\analyst\AppData\Local\Temp\mutated_19161.exe - e8f7d708d35631e526135c8d4dbf43501155e69f480be28178345595dec6e4b7

Embedded URLs

https://gcc.gnu.org/bugs/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787937699&P2=404&P3=2&P4=az6U1OLnAXR9lI7Z1cwYZGK%2b7htWxbay2%2bbGqVo1Ha04FXwjxitUICGW9HbdYldOTWyEHeSderpdl5%2bkEZ086w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787937736&P2=404&P3=2&P4=Uw7RN9PukzMZ9hZr0%2fSc32z84Dbu8vsZmXjmqio6ALksNa0%2bFuaY7xCsSFLqxiLYkuFu0Z7BQzUyCzArXZvbVg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

gcc.gnu.org

Embedded IP addresses

20.42.65.89
52.123.252.223
48.211.4.16
20.247.185.124
4.230.171.124
20.165.94.63
20.165.94.54
20.184.175.12
52.123.128.14
20.236.44.162
40.99.133.242
40.104.4.2
52.123.129.14
40.103.64.226
4.150.223.108
20.165.94.46
172.178.240.161
203.26.79.13
135.233.45.221
52.148.114.188
72.154.7.104
52.110.12.46
52.110.12.1

File paths

X:\:`:d:h:l:p:t:x:
X:\:h:l:p:

More AntiDebug samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report