MALICIOUS — virussign.com_cd300499f7c766277b4361c72bb6d660.vir

MALICIOUS — virussign.com_cd300499f7c766277b4361c72bb6d660.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Razy family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

• SHA-256: e580513670cf641508f2047a842c1299de958fa7c92ed351a831524ff74df1b0
• SHA-1: b210a94dccca9727c339567cd8270b27a7c33291
• MD5: cd300499f7c766277b4361c72bb6d660
• imphash: 8c235e3a9d7f61224225c532f7c9583a
• ssdeep: 3072:APXjEixvQGtSt4oKNFBVGs7GL3MQUpv1buc5xY33IEa5f551/8hyjzL4NLthEjQS:Ab1kdKNTosy2pv1Pe3325f551rQEj1
• TLSH: T1D6429DDEC5681A21DA7AD4180F1638DE6243F72A403E943E8BD74E1F59F344F6AB100A
• Submitted as: virussign.com_cd300499f7c766277b4361c72bb6d660.vir
• File type: pe · Size: 212992 bytes
• Verdict: malicious (100/100) · Family: Razy

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (6 of 56 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Malware.Razy-9759519-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
• Emsisoft (Emergency Kit): Trojan.Agent.DCBC
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

• T1547.001
• T1056.001
• T1543.003
• T1112
• T1105

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

• ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Aenjaris.AL!bit (rule Trojan:Win32/Aenjaris.AL!bit) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Agent.DCBC (rule Trojan.Agent.DCBC) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
• capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Dropped 12 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

50338 behavior events · 2 ATT&CK techniques · 12 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• windows.msn.com
• officeclient.microsoft.com
• www.msn.com
• odc.officeapps.live.com
• assets.msn.com
• www.bing.com

Dropped files

• C:\Windows\SAS.exe - a82b57eac39eb7b429f0c642a053390ca456e1e2c09b34538f764dd604ef2d82
• C:\Windows\VAY.exe - 8fe8be34a00a668a7b050eb3e39df691f6d79cbf20d7a868a38e74240959e2dd
• C:\Windows\System32\RWVHFVS.exe - 1e3da5b7b38230a59ea075a8e41a9db2b2ce2bda0c016a4d539e0216118c1c10
• C:\Windows\System\OLYLM.exe - b6428f2eac454ddd82321c6d133308a03213d5d5b0a0be49cc0da8dbdfbe0a18
• C:\Windows\FITK.exe - c6f684e01f63fe493c5e207e2180228e1f9c7e7097427601730d1915de8a56f1
• C:\Windows\System32\DSMWW.exe - d027291106ce4aefec5ee96abe887b19a8bfd5ddab7fb7223875786b56cb9e36
• C:\Windows\System32\KJMP.exe - 68230181b91b6212b141bf6990833aca0c7637866edb0d0bb45393e9a934db15
• C:\Windows\System32\LBPMEK.exe - f15fb3cd958b315da4c9ecf55ecf8899c1ce674ac3678f5efd21ab81d9e16fe1
• C:\Windows\System\QVZYVC.exe - 16a394400ce739cb1a46e66561208ff02cb474199fd9b237e3e0fac3306a6b46
• C:\Windows\System\YVPCG.exe - a2c365f974518fc0d499b4f8176325582d269f57318f1fd4cc212e823ae45639
• C:\Windows\System\DRM.exe - c6d43368063469ba6c78a8f79bf158d9abd64e7ddefa0f297f55bb23d1e060b5
• C:\Windows\System32\JJWIZ.exe - 1694c1a847d89395782fb8c3d7c79de94ddc95e06d8462464b6d4827f186d0a2

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/

Embedded domains

• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 52.168.117.174
• 20.247.184.142
• 4.230.171.124
• 172.64.154.167
• 74.178.240.51
• 20.42.179.192
• 74.179.77.204
• 4.207.44.75
• 4.150.223.105
• 135.234.160.245
• 172.178.240.162
• 172.178.240.161
• 135.233.45.221
• 135.233.45.222
• 85.210.193.152
• 135.234.160.244
• 52.110.12.53
• 52.110.12.8
• 52.148.114.188
• 72.153.5.128

File paths

• f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
• C:\windows\%s
• C:\windows\system32\%s
• C:\windows\system\%s
• c:\stop-adw.txt

More Razy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report