MALICIOUS — virussign.com_b580e4d4f214c1daaf2c821dd5c84f50.vir

MALICIOUS — virussign.com_b580e4d4f214c1daaf2c821dd5c84f50.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Aenjaris family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: ff59298621b6bc9d92e705966c97cd80d6e389cd7e969bcc36f5937a427e6573
SHA-1: 6a7a4e5bc18c192de8a9d3405a43c352c642cad0
MD5: b580e4d4f214c1daaf2c821dd5c84f50
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 6144:2FSNxEKJAeD2cznKMrwWfuRgVdQFffQEj1:2IxEcCcrKMcfQC
TLSH: T1D5429E8D79ED1004DAF781707E01AA1E9673F876193CDAAB9707822925C705FB47980F
Submitted as: virussign.com_b580e4d4f214c1daaf2c821dd5c84f50.vir
File type: pe · Size: 212992 bytes
Verdict: malicious (100/100) · Family: Aenjaris

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Trojan.Agent.DCBC
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Aenjaris.AL!bit (rule Trojan:Win32/Aenjaris.AL!bit) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.DCBC (rule Trojan.Agent.DCBC) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dropped 11 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

47204 behavior events · 2 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Windows\System32\TTARMYF.exe - 9b64ed03e6a7ed39169c32809572c6830e2ac67a087f64dc3f9ee12e3d8b6639
C:\Windows\MMTD.exe - 0c186476ea46186dbbdb09c8a5194c94ca521f6cfd36ea2cf64aaf07d016ceb7
C:\Windows\System32\HSI.exe - 1ab4aebd3db241172dddb7fe7c32c84879353e2305c6cd03036f49ca8d827b11
C:\Windows\QOWQS.exe - 61963701e58822ee21d1e2bb16418bb7e3384cab20fdbc0c2b94ea0b4febe6e6
C:\Windows\TJVMW.exe - fd876aab05ff94a3eb89874734f89d666c321034e242fcb98ff58434d240d8e1
C:\Windows\System32\UZRH.exe - 8b9bae17c356506a26e30406fde5b4f9c642037ad73364d8c8947103db767653
C:\Windows\System\MXN.exe - ffa1836b3a5af3f8b110634a80bf7eee77bd992e041f3522bc0b9417abd10ba3
C:\Windows\System\VXG.exe - b48385f75c463043b2da67cb0706ec322ddf573c1d0bcffa9fd1790d8c532bdf
C:\Windows\System32\YCSPYF.exe - 89799204782b4dd9da11627aae7b9e3ff1529baacb7601338dd7f95d46d5aaee
C:\Windows\System32\HNN.exe - 60d1807bd4c7e124f6b8d35388358c486be889b8b7c5bdc9c9cfb7420be9fcea
C:\Windows\System\YWLE.exe - deee4833f3acdcd13f3c11cd72d0213b223a8be1fbc8a69f033667561d094a10

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.150.223.99
52.230.59.222
4.230.171.124
172.64.154.167
135.232.92.97
135.233.95.144
20.42.73.24
20.42.179.192
135.234.160.246
135.233.45.223
135.234.160.245
135.234.160.244
172.178.240.162
4.150.223.100
172.178.240.163
72.145.35.98
52.148.114.188
52.110.12.47
52.110.12.37

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Aenjaris samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report