MALICIOUS — virussign.com_0f5f78fe548052e77383826fac5c78f0.vir

MALICIOUS — virussign.com_0f5f78fe548052e77383826fac5c78f0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Aenjaris family. 7 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 412a7099b859a2108c6305ac5bb9e5114636ca6637ef226e256737434d4710e0
SHA-1: 56225bff80a9238818219a2d2daf835a29aab7cb
MD5: 0f5f78fe548052e77383826fac5c78f0
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 3072:j+8nnDoZ37GbXkUxBVcf0RmtAKS/GmjgYjmYl4PpIejCFNkrGrV4pLthEjQT6j:C8nnDmoDxXRmtmOwDmYlu8IcVkEj1
TLSH: T110427DB9AA7E1B40CA39D341ED44670F9522E674207E364B461391391DEF02FB9306BB
Submitted as: virussign.com_0f5f78fe548052e77383826fac5c78f0.vir
File type: pe · Size: 212992 bytes
Verdict: malicious (99/100) · Family: Aenjaris

Source: VirusSign · first seen 2026-08-19T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Trojan.Agent.CQST
Trellix Stinger (McAfee): Trojan-FKME!0F5F78FE5480
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 28 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dropped 12 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

47269 behavior events · 2 ATT&CK techniques · 12 dropped files.

Dropped files

C:\Windows\CBM.exe - 917a2c1ff320cde3f1448475512d13f27e1fce82b60b5770ba18a6553d283a8b
C:\Windows\BUO.exe - 0d3e1054e82ed5a7d1faf890f81da1b6a69f6908d3ea79fc82d515494231bc85
C:\Windows\MJUGNQ.exe - 09624310c9ed3d6584fcd055e811c4588dae34601d8b27a2843e0eafcc4fc9fb
C:\Windows\System32\OTFYV.exe - dd40c15702801880ecf3830372e183727559916e5367b09a2960b0256e67cb41
C:\Windows\System\XNJGO.exe - 85a847d0625c7b4b508475bbb8eead9e278b7d52fbe96e466089592fec9a754e
C:\Windows\System\ZFJZU.exe - 06760496b4f22822ee4d90879cd61abc947bc8cd2ce815fec42001120e58ba13
C:\Windows\System32\HXXP.exe - d51ad60c0a551b82900122b81cf6707208ec7d8191f38e092a40d1e3df5d46f7
C:\Windows\FHBW.exe - e6caf8a5be6c6d18423be19ff35a9c377da81beea34244a83d771f4da52fad9f
C:\Windows\System32\GMUUH.exe - 4619b9d0580cb7bf20691c8327f9a730ca0d044fbb6052058145e248d82377be
C:\Windows\System32\QTI.exe - 4cb8c6916454cb47de8d15d5b1ab7852b02a1ed4d58106d4f0b8d2368f09577b
C:\Windows\BBJXGOH.exe - c14b911596ff00cf72c73c0b645a39d28fe558b10c9693a5b32ad910000506d4
C:\Windows\PDJKYC.exe - 70f6e17cf56bfea1d1e3d7e780466f97923de808a89263848536689eb6b6d308

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787782152&P2=404&P3=2&P4=P8A2hHQ99p2iZzMmrS48H%2bRZ9ElVzMtW1153jcQqjT8eSoULgKq%2bb5NJSkSebveqUoLlgaB5XXGf8o7zH%2bcW1w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787782237&P2=404&P3=2&P4=IBhobBnt6mzWhOxLWFk%2fd2S6YqPUKEng2v9xbEkpqSoCpZGGaatxrCiT3TykghVaxXp4PQeYUiwYBZi90HrzWg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

74.178.76.44
48.211.4.16
20.42.65.94
52.123.252.215
4.230.171.124
57.154.63.210
4.144.132.223
135.233.95.144
51.11.192.50
74.178.240.51
52.123.129.14
20.76.201.171
52.123.128.14
4.150.223.104
52.123.252.202
172.66.2.5
135.233.45.222
203.26.79.13
57.155.101.212
52.148.114.188
172.178.240.162
52.110.12.48
52.110.12.26
74.178.232.29
135.233.45.223

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Aenjaris samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report