MALICIOUS — virussign.com_33c960fc68777ea5a33bff4a2670a180.vir

MALICIOUS — virussign.com_33c960fc68777ea5a33bff4a2670a180.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Aenjaris family. 7 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: fc6d88a3f7ca47e2a30b95048f82e551a4a08a52376e467b0fd1e387aaeb584f
SHA-1: 715768cfea7e4e6d8ec42fbe01f00f0030184cf3
MD5: 33c960fc68777ea5a33bff4a2670a180
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 3072:gKFPvlKucPYNXLLH1U84DrtPFa2k0GttRHdTF++L23ZzYJQh5lKAT4pLthEjQT6j:zPcwlV6VPo0GttHFj235YJQhbPTkEj1
TLSH: T1AB427BD8CD662942CE7D86015D22DD6D9422E0A9023CA81ACB5FD27E1CF312FE478977
Submitted as: virussign.com_33c960fc68777ea5a33bff4a2670a180.vir
File type: pe · Size: 212992 bytes
Verdict: malicious (99/100) · Family: Aenjaris

Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Trojan.Agent.CQST
Trellix Stinger (McAfee): Trojan-FKME!33C960FC6877
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 29 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dropped 11 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

42238 behavior events · 2 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Windows\IZBGURJ.exe - 0e950a6ad8f484407529094fb965993858b58f26a5b6eed54306568a313ebdd0
C:\Windows\System\XPT.exe - fa5c12b425f2ad16bfbdec86170a85ccf7a2effa5609d871a5c8cba465625e81
C:\Windows\System32\PVOA.exe - df9e690c5b082887f4acedf0247623c48563e708fb49e8a88bd11c095a380e8a
C:\Windows\System32\PJD.exe - 275da9037317c645514ae06d1022a072ebb2a2af0339fbd8f203e43867c788c1
C:\Windows\OIWH.exe - f604868b5fb9553ce164849e78d38327150944b366c3807d13d58acf3d05e976
C:\Windows\QAH.exe - 6ded36abe0f9397d6b41e9ad8009acdb976f7d65f09170ad2200cf4c394be2e4
C:\Windows\NNVOHR.exe - 6957a5055f10a95f5ee56fb2a344135a67a5fc98ec10b5314a4c7236755ad87b
C:\Windows\System32\TOI.exe - ebdfbb5eabd3b0e0c8dc5f06fff26a13e0f132fcfcf12e23587185af85bf4838
C:\Windows\System32\SJE.exe - d8e0c5b60133c471d8cbdb03ff154a7c93c5f56e53bacae7002fa9ef33aee210
C:\Windows\System\GLNMU.exe - c0d76a411634b0dd4d8d3e4adfc7d274dc6af5023a1677782b9fedfc489ffeff
C:\Windows\HJYQLK.exe - f704c1f87293d717ed2b4b58dfd1346833c9e21dc9003ad224634a2c00b2264b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787744956&P2=404&P3=2&P4=BhWD%2fYkXA12LjxvecKwOxaUZD6QnTT5EQ%2b3%2bfr97G%2btvd4Ie0VJMEkH3oB3W35ofUUZ7B7jWLv6EiH41VYVjXw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787745080&P2=404&P3=2&P4=dcVn06xfG9NoJBju%2fTElit17U9u1ksT9vmFsVKYGAfO0UcksWUfLt0%2f2RAnrgyWsNxjBEjX9f167hWn55W2VIA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

135.233.95.80
20.52.64.200
52.123.252.198
172.215.188.232
4.230.171.124
4.144.132.223
74.178.76.128
74.178.240.51
51.132.193.104
135.232.92.137
40.104.4.2
20.76.201.171
52.123.129.14
40.99.133.210
52.123.128.14
52.123.252.204
203.26.79.13
172.178.240.163
135.233.45.223
52.148.114.188
172.178.240.162
135.233.45.221
135.234.160.245
72.153.5.97
172.178.240.161

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Aenjaris samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report