MALICIOUS — virussign.com_7c75a013976344d01c7b591b57232170.vir

MALICIOUS — virussign.com_7c75a013976344d01c7b591b57232170.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Razy family. 7 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 1a0ce313c43c6f4b0f836a4ad87150a02a738394d0f121035093f65169dc1633
SHA-1: e1533f498c0a78481db61c6dce1364537fcaffd3
MD5: 7c75a013976344d01c7b591b57232170
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 3072:Aew+8P9CHj4NQKC3sapyy/km1rco0BbP8iJ03wRfwKR8R3KIc84pLthEjQT6j:Bc0Hvgy/kEXsPe3wRfwKR8hfkEj1
TLSH: T112428CC495A4164EFCBDC1141C98A8AEE46875962738600FE9C7A37F58C30AF7835C6B
Submitted as: virussign.com_7c75a013976344d01c7b591b57232170.vir
File type: pe · Size: 212992 bytes
Verdict: malicious (98/100) · Family: Razy

Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Trojan.Agent.CQST
Trellix Stinger (McAfee): Trojan-FKME!7C75A0139763
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 26 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dropped 11 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

43457 behavior events · 2 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Windows\QNHEMOA.exe - f0e461dc07dc5aa326d917673f051593f5e3dfa60171c414a2680470a69ffb63
C:\Windows\LMRI.exe - 8ac1785674dcd66998612b60b41e15b3eb0acc917a555636a366a0e39e7ed1cb
C:\Windows\XJFE.exe - 99d20b637e7aef655f7526d5884bae98d7096c8d2572605dd8f2e2ddbdb92ed8
C:\Windows\System\NAHKJA.exe - e3ba51afcbb6bc60831d5b3ca8f5e712f8537fdb8c478d29da0eb0fb8023167c
C:\Windows\System32\UUGQDV.exe - 67927dc4c26b06fc64bac6ac440d2c95bb4db781715617f0b9736228b5eabc13
C:\Windows\NTCZKU.exe - dac516f8e61a5e6bc72139a5c24cd4ae9d6e45d94fd3713b33cf8498578b7601
C:\Windows\OOEVSF.exe - 5aead25f0dd56755f0b5cdb67b5d0369c6ad153e3160eb74c73019ad3d2dc458
C:\Windows\HPK.exe - 75c0c113dcc35d4ff4f191d7418ee70afb4a0023530bd5f8cf357c65309a8475
C:\Windows\System\KOBQWA.exe - ec3620f686101077bc196d0c196dd02d0244dc48b16f4ebb2a16adb227d6ceb6
C:\Windows\System32\TPISERE.exe - d262e5d896081881c40360b1f090a0e5576e98e83823588ceb1d611e0d383600
C:\Windows\System32\QYJZS.exe - cc7c047faaa7480e38108bd4f35283fccd4d0cd1a92e687c5c4bfac0656fca8b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787729385&P2=404&P3=2&P4=MgQ1NW8PIro%2fgZJqbV1A9byL82EUBtnMmUGmlvpZL5xaBu4wUlJ1xcOFLm1t0AmNhRs1gu8Ab0rG6SQMYuQnng%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787729471&P2=404&P3=2&P4=l0wJ0cmis0HfgOd6wDN%2bVN%2f%2fTRKSgmN7u15Ohn%2bBuF8aRP8pFtAxzFYNgXbhrquwRfOaW%2fwbzguiQUaYxylpWg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

104.46.162.231
4.230.171.124
40.84.85.40
20.247.185.124
74.178.240.61
20.184.175.16
135.232.92.97
20.231.239.246
52.123.128.14
52.123.129.14
40.99.134.2
203.26.79.13
172.178.240.163
52.168.117.175
135.234.160.245
135.234.160.244
135.233.45.223
52.148.114.188
20.165.94.46
135.234.160.246
135.233.45.221
72.145.35.97
92.223.78.30
135.233.95.80
52.110.12.30

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Razy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report