MALICIOUS — virussign.com_1edcab58b52ea9d03368704ac7a36a30.vir

MALICIOUS — virussign.com_1edcab58b52ea9d03368704ac7a36a30.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Aenjaris family. 7 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

• SHA-256: 0ea717e87ae03ae51270a2f515d539ebd7c02796f50b3dfc4b6a832d4f663a84
• SHA-1: 5618b4928cbcc41511edaf8e039c04d8dfd3cf22
• MD5: 1edcab58b52ea9d03368704ac7a36a30
• imphash: 8c235e3a9d7f61224225c532f7c9583a
• ssdeep: 6144:xy2nNqo1O0Z3Kv6vqMcKvh51FN4GqkEj1:4GT1Oqa6vqMhN4GqkC
• TLSH: T1A4428C8C553B2900EDF9E855AE0438ADE49BB84021BF640E6367019706FB09FFC7956B
• Submitted as: virussign.com_1edcab58b52ea9d03368704ac7a36a30.vir
• File type: pe · Size: 212992 bytes
• Verdict: malicious (100/100) · Family: Aenjaris

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (7 of 56 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Malware.Razy-9759519-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
• Emsisoft (Emergency Kit): Trojan.Agent.CQST
• Trellix Stinger (McAfee): Trojan-FKME!1EDCAB58B52E
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

• T1547.001
• T1056.001
• T1543.003
• T1112
• T1105

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

• ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Aenjaris.AL!bit (rule Trojan:Win32/Aenjaris.AL!bit) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Agent.CQST (rule Trojan.Agent.CQST) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Trojan-FKME!1EDCAB58B52E (rule Trojan-FKME!1EDCAB58B52E) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
• capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

43010 behavior events · 2 ATT&CK techniques · 10 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• assets.msn.com
• www.bing.com

Dropped files

• C:\Windows\System32\JBIWZF.exe - c4ba03f18526817ea15518e0a947da6c81f0d9282e74f08513ae851fbb4ee093
• C:\Windows\DRIDZH.exe - 565c46c8fb95ffb176443dbd2c2eee329e82e56ca4d65f3d88f88cd03a8dffa0
• C:\Windows\KEIQPSR.exe - a60dbde0cd96820d5674dc41125547e1b7fd89e3e0a7baf30789f2b6b976eab9
• C:\Windows\System32\KJMP.exe - ff9a6dc55e86faea2079ce3c11c5dec3f135bf9830cd65d95df350f35b153a1f
• C:\Windows\System32\WEKETH.exe - e5302f88c6a08999a2c48af02e857cd1b4e18c7ff1bb29bf9c0c314a144323e7
• C:\Windows\PQCW.exe - 364982075c03da140e9d897d4fa970edc59b4fb1b866d2fbdb44ff2108688f34
• C:\Windows\System32\UBBV.exe - 8b962936c7829db8842528a2d7f627aea59e8a78960b414de667f45fcb927899
• C:\Windows\System32\SJF.exe - 2172096a91a45c8a38ff27463fedbb021dac3146428bf269a5b1de50d2c04668
• C:\Windows\System32\ENMU.exe - 39c85ef400f2b27553caa6d9450a0d16609cedba903e1fee8564e8cad3073b70
• C:\Windows\KTJ.exe - 662f49a918239af02a96ab517e1f9e8f8588c9103ed2dcfc1ee3d9a09801dd21

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/

Embedded domains

• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 20.184.175.7
• 20.247.184.197
• 52.123.252.225
• 4.230.171.124
• 172.64.154.167
• 135.232.92.97
• 104.46.162.229
• 57.155.104.224
• 135.233.95.144
• 20.184.175.3
• 135.234.160.246
• 172.178.240.162
• 48.211.4.16
• 172.178.240.163
• 135.233.45.223
• 52.110.12.25
• 52.110.12.2
• 72.154.7.108
• 92.223.78.30
• 52.148.114.188
• 172.178.240.161
• 52.110.12.20

File paths

• f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
• C:\windows\%s
• C:\windows\system32\%s
• C:\windows\system\%s
• c:\stop-adw.txt

More Aenjaris samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report