MALICIOUS — virussign.com_92fa7ab666c84b9e8e8a79ac7d7c5fd0.vir

MALICIOUS — virussign.com_92fa7ab666c84b9e8e8a79ac7d7c5fd0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Aenjaris family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 00dd5759ea22e6bf77a284c48fe9ec4a28a9b768d6ff59ae38ae90bd6f6f1c06
SHA-1: fb39958bd3cff6d33290b74c08ca396528032a94
MD5: 92fa7ab666c84b9e8e8a79ac7d7c5fd0
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 3072:iI6IZNqx9vUMdSp7AmY2xYHkek8XTHGjaAIK/cN/cDZKdAUk4NLthEjQT6j:iI6YNqxjEAmdYHkeknaAIgOceKQEj1
TLSH: T1BB42AEC4AA1A3610DD7BC2316842452E216F7CA45ABD281BA74741750ED33EFBF7248B
Submitted as: virussign.com_92fa7ab666c84b9e8e8a79ac7d7c5fd0.vir
File type: pe · Size: 212992 bytes
Verdict: malicious (100/100) · Family: Aenjaris

Source: VirusSign · first seen 2026-08-17T00:00:00.000Z · SHA-256 verified

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Trojan.Agent.DCBC
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Razy): NBR.exe - dynamic signal, weight 0.62, confidence 0.90
Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 948) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 30 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

40795 behavior events · 2 ATT&CK techniques · 10 dropped files.

Dropped files

C:\Windows\System32\NBR.exe - 7af29929a87bb315a0c3724a7f1683b550a3f2e59d65dcfb2d1b1a2332779acb
C:\Windows\PVEZTDX.exe - 8fc4d218793c4eee9f38a8e4606166d7345bb1eb8f3d9187b8db9a4a51596d47
C:\Windows\System32\CPWBRN.exe - 6fa1b1bb8d48230324f7508681129913720b78b992f875dc8206e7e82b60f17d
C:\Windows\System32\TEWQE.exe - 790741519f0a5def97abdb230a804468de07647e86d7c27084c4485e421e2e3f
C:\Windows\FITK.exe - d04fc383fe9b2af81043dccaa54601a10526bcc9e38efa53bfae53b4878eb6ce
C:\Windows\KCRONFD.exe - 3239585437d4fd9195fb33c4377ffb0779fd630d387f394b60515b2d71e0ed00
C:\Windows\System\TOW.exe - 6bdecaf2fe3fba739cec198e216a50e81b3d2615fb887a072bf7b0d480988924
C:\Windows\System32\HYKCV.exe - 201dd11fa151b68aba6f028bdb9ce063de7544e62769cdf7fd7519457edb4c95
C:\Windows\System32\LTMMTV.exe - 3df759114301410b1d79abaac4fdb00487d1c22ebe1bf6e256ab2d26c05f54c1
C:\Windows\System\IWBHUQW.exe - 8b26edb8028261ea8cad2d32fb8e0511e0af3c8e02b8e97160d94f3499cfd2d1

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787642256&P2=404&P3=2&P4=NchIiCsYVX3WXBx8w5%2bWhSDYRMzhsNVqCdP6hlyI%2b1ytoOB8cNiq58efCKr%2fPCJrF5oAXATc6qylWByKXVhuSg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.247.188.233
20.184.175.14
52.230.60.54
4.230.171.124
4.247.188.224
135.232.92.137
4.150.223.106
20.112.250.133
52.123.129.14
52.123.128.14
74.178.76.54
40.79.163.154
135.233.45.222
172.178.240.161
135.234.160.244
135.233.45.223
203.26.79.13
52.148.114.188
48.200.63.27
57.154.63.210
13.89.179.15
51.105.71.136
172.178.240.162
52.110.12.49
20.165.94.46

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Aenjaris samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report