MALICIOUS — virussign.com_f41f9f236c2ae413f1d2068bf1a0d510.vir

MALICIOUS — virussign.com_f41f9f236c2ae413f1d2068bf1a0d510.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Razy family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: f39148d3d3f0bf94f39a0d791bb6088229e857a4f32033feb7ffc76331932d12
SHA-1: db0a66a47f4d4c3c5b55f954d91eda6e400fedef
MD5: f41f9f236c2ae413f1d2068bf1a0d510
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 3072:ZibQIHkmEDTOVrB/j5QUANxuOjP7yxakvJhQCekh+/sAoT9x4NLthEjQT6j:yHiWVrB7Y0YDycKQCeX/sAoT9xQEj1
TLSH: T105427BB8C4293A6AD5B1F20AAE00762EA653721C2CBCC51D43C3DD2D5CD70EF7A22556
Submitted as: virussign.com_f41f9f236c2ae413f1d2068bf1a0d510.vir
File type: pe · Size: 212992 bytes
Verdict: malicious (100/100) · Family: Razy

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Trojan.Agent.DCBC
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Aenjaris.AL!bit (rule Trojan:Win32/Aenjaris.AL!bit) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.DCBC (rule Trojan.Agent.DCBC) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

43547 behavior events · 2 ATT&CK techniques · 10 dropped files.

Dropped files

C:\Windows\JHEOFU.exe - 4bc96371782e6a774b3ad1c194ef7e1f6473a2c4552d906cad6440945879484e
C:\Windows\System\SIOK.exe - 18577d919248e533c5a822d5fe599893176cd319a123368815f1798d70669270
C:\Windows\System\VUUCWL.exe - b4bdd58d448f3ea688bef0a4f4c186d97e08a314493798fa432dd20dd0f41ae9
C:\Windows\VRTC.exe - 59093d7bacb4e57517a355e61b5acc8da452840b57940497716ca1a5a3876a3c
C:\Windows\System\DQHV.exe - f9243e889e754570485bc0840a4f0cc01c31d395cff12b969eba8ecba6b7bf53
C:\Windows\System\LLS.exe - 5dc0393ddb26a14f8fac035ac15e8ccfcdeccdaab6ee45ce7526d779099f79fa
C:\Windows\WRWADQ.exe - bfb1dabb8f8060957618c6125a5e25d6edf8132bc1f21b70997f27816a2fc68c
C:\Windows\RFMS.exe - 0356f9f0ca6ee59731171625a59fbe1494314636d93709b57639f9c14c437c96
C:\Windows\System\PYIG.exe - 10c73f29dab333d96222f269fba4f8d8aedc5f6c4ae3e3027c010d71cb2a0eab
C:\Windows\WDANJYM.exe - bf8acef445004a46b67fe7b407f054e6887720f6b6ecd048e506afa081fedad4

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788285958&P2=404&P3=2&P4=Y531n8XFDPmVjbXZZRjt57OKPsn0FsQb%2fgECZUciTYYv7dJAXnL17rcudkxT1%2fGJxmQ9KGfQ7BfYyFqIOhXUpw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.103
52.230.60.54
52.123.252.224
4.230.171.124
135.233.95.135
20.42.179.204
20.165.94.63
20.42.65.84
104.18.33.89
203.26.79.13
74.179.71.159
172.178.240.162
172.178.240.161
135.233.45.222
135.233.45.221
72.145.35.97
135.234.160.246
135.233.45.223
52.148.114.188
52.110.12.45
52.110.12.56

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Razy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report