MALICIOUS — virussign.com_dd070e286442328733085230d88ed870.vir

MALICIOUS — virussign.com_dd070e286442328733085230d88ed870.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Razy family. 7 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 191432182abc76b1c85c78dd3a03227bf92248a38e3a8b65ca64083b87957ca2
SHA-1: 63ffad00013fee6ccdc384ed5127e9515ebb08fd
MD5: dd070e286442328733085230d88ed870
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 3072:EahRfRfisz/9geuUB5DsTDLoXiHZKHUoEl4pLthEjQT6j:PhZEiVxgoSHZkvElkEj1
TLSH: T1A8427ECA466655A6CD7BCC606D972C0CC042A16653BC474BD7EFD3369CE342FA82052E
Submitted as: virussign.com_dd070e286442328733085230d88ed870.vir
File type: pe · Size: 212992 bytes
Verdict: malicious (100/100) · Family: Razy

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (7 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Babuk.70
Trellix Stinger (McAfee): Trojan-FKME!DD070E286442
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Aenjaris.AL!bit (rule Trojan:Win32/Aenjaris.AL!bit) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Babuk.70 (rule Gen:Variant.Ransom.Babuk.70) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FKME!DD070E286442 (rule Trojan-FKME!DD070E286442) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dropped 12 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

48543 behavior events · 2 ATT&CK techniques · 12 dropped files.

Dropped files

C:\Windows\System32\GZOXGXE.exe - eaae2cacebac1d17b7a75ef199b90c6f4306ea667976068bf2be6f5abda03c79
C:\Windows\System32\FSYY.exe - 5008dad032124854341894fcc7eaa7fe2086b269601c4dab94cd5ab26f340d7d
C:\Windows\System\GRPRPL.exe - 2b29dfe987d1e7471b8859beb2297efeead5e838322824bcbc12663d5874f3d2
C:\Windows\System32\SGPRGGC.exe - 41d62b8e4db78ade10f3c06a8a08fccb343c95cf04d8c28ad7dc05007ce45434
C:\Windows\MKTRV.exe - 162afdd4023c5b2f679b0fe301711c188e30514e681ac7a229df8b98f7ccd36b
C:\Windows\System32\UREPH.exe - 76c0c8835d4753fff6ca6f4e6f02ebc077a45a741cd2004a0162d706ced2f2c4
C:\Windows\VAY.exe - 888b2d678bdda98a15eeb840a549060ba5a3b4ab77d504bb743ab0aa2b412568
C:\Windows\System\PHYICW.exe - 24c197e8c57691d1abef48e62a9ba2a279e29b05c15c74564714145a50eefbd1
C:\Windows\TIUWS.exe - deb49090c3af80433ce7af8626f9f5d08d82816e7e13218d73052ce4f9ece082
C:\Windows\ATQY.exe - 4d7e3c1497498070268b9fccf3168119fd15382f16ce84b6d0cdf3b97eb096d7
C:\Windows\System\QLD.exe - 50b531c7784963de28c059f40e22a6964faf2a79fd144813d6a9bc57914411d8
C:\Windows\System\ICOIRDI.exe - ba3656198b1f90107773e072dfe60411e321efcef5ca2ea8060397b369d225d7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.207.44.76
4.144.132.114
4.230.171.124
135.232.92.97
135.233.95.144
85.210.196.11
51.116.246.104
172.64.154.167
135.234.160.246
172.178.240.162
135.233.45.223
172.178.240.161
135.233.45.222
92.223.78.30
72.145.35.105
52.148.114.188
52.110.12.26
52.110.12.56

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Razy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report