MALICIOUS — virussign.com_459021a958c1dd23309f2e2e81371a90.vir

MALICIOUS — virussign.com_459021a958c1dd23309f2e2e81371a90.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Aenjaris family. 7 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 3dce78499fd53376522e9f4128ea02220b08ddf4c08d731296fdda6b718e25be
SHA-1: 9b6d54261ee35d947118b332c458908ad1cd1f8c
MD5: 459021a958c1dd23309f2e2e81371a90
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 3072:9dmPTaq+W/cR9/AAIZ8jBOZqldJPdMIw6z8OtmqWFMvjJ0gw4pLthEjQT6j:g+W/09/AAIZ8iqoIpz8OtcMwkEj1
TLSH: T11A428C4DD42902A4E4F4E400AF51595D9423F8C6843D7D4EA6EB3226EDF302FA6EA44F
Submitted as: virussign.com_459021a958c1dd23309f2e2e81371a90.vir
File type: pe · Size: 212992 bytes
Verdict: malicious (99/100) · Family: Aenjaris

Source: VirusSign · first seen 2026-08-19T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Trojan.Agent.CQST
Trellix Stinger (McAfee): Trojan-FKME!459021A958C1
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 28 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dropped 12 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

46791 behavior events · 2 ATT&CK techniques · 12 dropped files.

Dropped files

C:\Windows\System\ASIO.exe - b6feb23ed04bc6efff781ea21780ef6d2334d6cb83a1a3e1f702d75f7ab2cb70
C:\Windows\System\SMFM.exe - ff83cb5155b34fca00031c7e6dd92b6b099110a3733deb6f023bc6aa5035b575
C:\Windows\System32\IDXSUWM.exe - 07bfedab034355c31ba78c131213ed58724c60567f623147ba92eb3d1012afc8
C:\Windows\System32\EVA.exe - 1cc0acc7ab20daaafe56635cb4f1e00c09d2d92f72e2d9319f66bb8ab102e6df
C:\Windows\System32\JARRA.exe - 4ccda974b0ed9139070aea3bf9f1c7f49c7663e25253498a3c315e60ba19b7f4
C:\Windows\System32\RIJLJKM.exe - 86daac7913b884ec13e9d48845ca2ef3f7c5151eff7a109f14dc12c57aee1004
C:\Windows\System\XERR.exe - 0292ea0b882963b5eb7b6a1ac0114da4007c4b14795b223dcf1eaeb2d1a2e071
C:\Windows\System\SZZ.exe - 93bf347b0daf15d87c2f7091a7171c6f27dcbc1f2154fd5aeb9d444da9d99fce
C:\Windows\AHZZSG.exe - 949772802d7050c1718afbe8104c184e704143abd1c0f191005d59699d02e3b7
C:\Windows\System32\ZGX.exe - e8537005eae837a0b49ac7f7a607c73a9978e51f41c313a733b491b00bfef412
C:\Windows\DGNXEEC.exe - 3c349c1daee7e0c9486e8bb4046c3645dbd9a5d06cae067da8aa393d3ecc8272
C:\Windows\System\DRRK.exe - 6f195861a76d4852b7ff6d1562aca980e85583174927dc28c2eea282cc32e25f

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787782148&P2=404&P3=2&P4=gCUylmt3Zy2DMsD3pN7SfJYZEwyd29FVbfKkZDSu7RFkpghjFBYcicsyStS%2fanNoVtbnhYKqJArsRQktUfxiIw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787782280&P2=404&P3=2&P4=egEKBmkMSWqcfwdg6ERKsRt2WpucaxmEcGSltRjGFGrAuYzEZxK572yECwlbjuLdgl8GRi7IJHIglc4PMoC9HA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.65.94
4.144.132.223
4.230.171.124
40.84.85.40
135.233.95.144
74.178.240.51
51.11.192.50
20.231.239.246
52.123.128.14
52.123.129.14
4.150.223.104
135.234.160.245
48.211.4.16
162.159.142.9
203.26.79.13
135.233.45.222
52.110.12.30
52.110.12.47
52.148.114.188
172.178.240.162
135.233.45.223
20.184.175.17
4.150.223.109
74.178.232.29
135.234.160.246

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Aenjaris samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report