MALICIOUS — virussign.com_afaee6844c1aa021d27da26b5f4c9650.vir

MALICIOUS — virussign.com_afaee6844c1aa021d27da26b5f4c9650.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Aenjaris family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 282b3f05cb59888dc3ef43c73994994dc1d2b7dbb63b7b8988d8f2d5dda19ea2
SHA-1: 8203d8e792adbf334a0a5f5df13e8f4bae808e53
MD5: afaee6844c1aa021d27da26b5f4c9650
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 3072:L9mWooSsgseO6ZBjmoNsSKKhXQI36Ow6sujyhw7F9XboLYlV4NLthEjQT6j:AGuTZBb7KoEOfXoLYlVQEj1
TLSH: T132429DF8853C7C49CE39D9182E42A84ED04155BA26BC7F2897ABE63510E356F743432B
Submitted as: virussign.com_afaee6844c1aa021d27da26b5f4c9650.vir
File type: pe · Size: 212992 bytes
Verdict: malicious (99/100) · Family: Aenjaris

Source: VirusSign · first seen 2026-08-17T00:00:00.000Z · SHA-256 verified

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Trojan.Agent.DCBC
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Razy): DPQQOIW.exe - dynamic signal, weight 0.62, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 38 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

40351 behavior events · 2 ATT&CK techniques · 10 dropped files.

Dropped files

C:\Windows\DPQQOIW.exe - 17d1cef4f46bd7cef44647205e87dcd452f8461717c14b3a4a7c678ea2cb37ad
C:\Windows\IHLGCY.exe - c5ffd910259ad303147c418555c8f8713c251f1ffb094a31ef70948403174103
C:\Windows\FYDU.exe - b36e114e9d61275f834e19af45d6fb2a46ce9a4e5018d10ae5ae6614db600c47
C:\Windows\ARM.exe - bed9ab7b88f89ce6993cda9e3b8125be937c57d5fbca261569a6829066b16d3c
C:\Windows\System\WPLELI.exe - 9b20f1358878bea5dabd9f505600771a857dded266b0159c688cfa64a42e4a24
C:\Windows\ECA.exe - 9b45e452c8dfe2d8df12228a354ac27f8cf924a1d7357057d91892d8eca831f6
C:\Windows\System\NXIF.exe - 30606c285198ff4aa7e91f6f91fa5d3fd98c78235bf169195a5e8737da80b645
C:\Windows\CCFW.exe - ce018cc20ffa15606c4c96f2de0fe917e0b5093763cf7a15fbcaaaf995f8ec28
C:\Windows\HNHAYNC.exe - c202bd1cb4a21b6d89e3a965d063e2a82838b5d7c966c8050850fe041b2c8b5c
C:\Windows\System32\PUDQL.exe - 3672aa838002c07915385868f5aa0406f3c08db8b1e87691d492886933441247

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787641580&P2=404&P3=2&P4=L4%2bMoxovuozGDDspoSxM%2bCbkTJ7eV1MnXkmkyRYTqS4bsXe9b3AIUt5RYa8yTK88CKI00G3KgdZg3r6Kx%2fT7mw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded IP addresses

4.209.250.170
4.150.223.113
4.247.188.233
4.230.171.124
4.144.132.223
40.84.85.40
74.178.240.61
4.207.44.76
74.179.77.164
92.223.78.30
52.123.128.14
20.236.44.162
40.103.64.242
40.99.134.2
40.104.4.2
4.207.44.65
172.178.240.161
51.105.71.136
135.234.160.244
172.178.240.162
172.178.240.163
52.148.114.188
203.26.79.13
135.233.45.221
85.210.196.11

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Aenjaris samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report