MALICIOUS — virussign.com_9b15d722da8ae16e534c28d32d640df0.vir

MALICIOUS — virussign.com_9b15d722da8ae16e534c28d32d640df0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Razy family. 7 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: f0079e16c439bb34ae373101d187422f8cdf2e8f049f4a3525cc411f22d63777
SHA-1: 2a6f3bd1083d7bc38d101c9f348b12c2b81dac08
MD5: 9b15d722da8ae16e534c28d32d640df0
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 3072:7R8RM/tgWp+DroTss/sMewbYKr4eIuk54pLthEjQT6j:7Ntgz/oTzsTw80g7kEj1
TLSH: T1AE428DCE563814A2CBB6D804BFE8705F50757495523D1A0AAE07DE7E0EE312FA932316
Submitted as: virussign.com_9b15d722da8ae16e534c28d32d640df0.vir
File type: pe · Size: 212992 bytes
Verdict: malicious (100/100) · Family: Razy

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (7 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Babuk.70
Trellix Stinger (McAfee): Trojan-FKME!9B15D722DA8A
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Aenjaris.AL!bit (rule Trojan:Win32/Aenjaris.AL!bit) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Babuk.70 (rule Gen:Variant.Ransom.Babuk.70) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FKME!9B15D722DA8A (rule Trojan-FKME!9B15D722DA8A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dropped 11 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

47264 behavior events · 2 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Windows\System32\INB.exe - 74fc501551da703acb7a0ea3c271611f7eb2a8a4a1168d133bb198c7b22c3ee2
C:\Windows\LTOZ.exe - bec6cd93586664b1141d0ccbcb0d965f3471336294b41aee557ff990023e44d1
C:\Windows\System\CPDYVPS.exe - f5f9349db66cf3b67c4d84106a79e819e47da360c614fe56b403aa59c26562f3
C:\Windows\System32\FPWFME.exe - 4a3d872b95184fa2c842c11a5524446fa1f5958b478b13e3ae50efcbfff3dc2b
C:\Windows\MHZ.exe - 42260aa8e52edeb1626c571b3c62aa24a0a44d1c470887fdbf588e66a3d240d5
C:\Windows\System\THD.exe - b117cf7f97ed59228890296d478990236e4789dccd488519da9badcd023db751
C:\Windows\FOP.exe - 5512721ce1a5c7092b0b8e5de61a0c8657fa9b29050d160aca3a118e6c4782b2
C:\Windows\PGX.exe - 3fe4e388e75597a4a3abe5beafcb62f373f2b6458af58c72ff03fc97f476483b
C:\Windows\System32\VLC.exe - 0c5b8647c0465766fa68f576f3598df3312613a14663f5c55fd9fcc9ed8d50a5
C:\Windows\System32\WAFGBM.exe - bead780f2df159796e65016519e5664b614a120b20adefe7abc0d9f5135efbe8
C:\Windows\System32\XMYXEB.exe - 6c69bb4ca4f648a2608c65a7bb58a8ededbba19d3cbc491699920787f9f762ab

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

13.69.239.69
20.247.184.142
172.215.188.232
4.230.171.124
104.18.33.89
74.178.240.51
20.42.179.192
74.179.77.204
4.207.44.75
135.234.160.245
104.46.162.229
4.150.223.100
172.178.240.162
135.233.45.221
135.233.45.222
172.178.240.161
135.234.160.244
135.234.160.247
72.153.5.128
52.148.114.188
52.110.12.56
52.110.12.8

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Razy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report