MALICIOUS — virussign.com_1e8faa0ee2cdd8e7c1ffc04a13b46760.vir

MALICIOUS — virussign.com_1e8faa0ee2cdd8e7c1ffc04a13b46760.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: c36bd20dd46d934f49e015066a9d328dd2d1a419a0ba51e9502a26fef787402b
• SHA-1: 54af22f0a9c91d4616788cf36b141e80239d7e79
• MD5: 1e8faa0ee2cdd8e7c1ffc04a13b46760
• imphash: d0c59b9a9b9f2208ab9452466b7f74a6
• ssdeep: 6144:m5rp8uZ/vTI4+6Rs9IaC5DbCbfWxGAtScns:m5rp/Rs9LGG9
• TLSH: T15142E7DD862F7312D6F6D838252189ED400AB09861BD7BCD5E03D67640E2E37ECB50A9
• Submitted as: virussign.com_1e8faa0ee2cdd8e7c1ffc04a13b46760.vir
• File type: pe · Size: 207357 bytes
• Verdict: malicious (98/100)

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (5 of 56 engines)

• capa (capabilities): capability:credential-access
• Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
• Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
• Trellix Stinger (McAfee): Trojan-FXIH!1E8FAA0EE2CD
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

• T1555
• T1003

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

• Microsoft Defender flagged Ransom:Win64/Azov.psyA!MTB (rule Ransom:Win64/Azov.psyA!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Ransom.Azov.1 (rule Trojan.Ransom.Azov.1) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Trojan-FXIH!1E8FAA0EE2CD (rule Trojan-FXIH!1E8FAA0EE2CD) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
• access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
• Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis (windows)

33 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• licensing.mp.microsoft.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• www.bing.com
• assets.msn.com
• th.bing.com
• fe3cr.delivery.mp.microsoft.com
• settings-win.data.microsoft.com
• v10.events.data.microsoft.com

Dropped files

• a4a76e384f7811716a0ab882c02e935b63243bc2dd33177b244541b39d0c7370 - a4a76e384f7811716a0ab882c02e935b63243bc2dd33177b244541b39d0c7370

Embedded URLs

• http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
• http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• crl.microsoft.com
• www.microsoft.com

Embedded IP addresses

• 20.247.185.124
• 20.50.73.14
• 4.230.171.124
• 104.18.33.89
• 40.79.167.10
• 135.232.92.97
• 4.247.188.233
• 74.179.77.204
• 20.42.65.93
• 172.178.240.161
• 52.110.12.49
• 52.110.12.30

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report