MALICIOUS — virussign.com_c6bf3b6b6bfa28f5b03644597b4cbde0.vir

MALICIOUS — virussign.com_c6bf3b6b6bfa28f5b03644597b4cbde0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Razy family. 7 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 69941a91760850b3b477a41804d77dd79ba071497c99ce2561d21b212e0852d7
SHA-1: 067daa27ac82a8e6313ed014f6e55628bc7491f8
MD5: c6bf3b6b6bfa28f5b03644597b4cbde0
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 3072:L9mWooSsgseO6ZBjmhNsSKKhXQI36Ow6sujyhw7F9XboLYli4pLthEjQT6j:AGuTZBa7KoEOfXoLYlikEj1
TLSH: T1D5429DF8853C7C49CE39D9182E42A84ED04155BA26BC7F2897ABE63510E356F743432B
Submitted as: virussign.com_c6bf3b6b6bfa28f5b03644597b4cbde0.vir
File type: pe · Size: 212992 bytes
Verdict: malicious (100/100) · Family: Razy

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (7 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Trojan.Agent.CQST
Trellix Stinger (McAfee): Trojan-FKME!C6BF3B6B6BFA
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Aenjaris.AL!bit (rule Trojan:Win32/Aenjaris.AL!bit) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.CQST (rule Trojan.Agent.CQST) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FKME!C6BF3B6B6BFA (rule Trojan-FKME!C6BF3B6B6BFA) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dropped 12 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

48288 behavior events · 2 ATT&CK techniques · 12 dropped files.

Dropped files

C:\Windows\System\XHVFI.exe - df994d3fe370baae981028c3532e75b5bc8a1cf3a8a6e348a4a66d669bc6fe0d
C:\Windows\System32\NOVEFET.exe - db430e4bd82595057d4f95e2f9a502df1f8cf496797079e620e8d69a22358d46
C:\Windows\System\JABP.exe - 92a67c8af005a8415899c31866d631e3bfa5b814ac88a39ff74ff8d4d959cf1f
C:\Windows\System\PTUT.exe - 29e9277bec30f6cff7daa1dbbc06b091e3dde391543190c1be0dc134c3fbbb9e
C:\Windows\IWUKQP.exe - ebae1cd7e16a407c59e352694a28c960120f9cd61cc25e491c181bb1ad38eb7e
C:\Windows\System\LXDLQBW.exe - 24f2ac78be203c8754fb6705f6df16d27f8725732464168345a3de1045070c8c
C:\Windows\FWBGT.exe - a57c762983b52357e9d4715dedb60dedb053e6484e630ffdc6595174df06977c
C:\Windows\BKPHGY.exe - 05d4004688bf94247fccf36a5594f7244c4490c80251136daa2178c937774721
C:\Windows\System32\AUEXCU.exe - dc47af491f46b3e06d56df4bab7f95a55dce9d9e5a417fc9160df8dc3a59f9e3
C:\Windows\UAVTP.exe - ef0ee0392be2233a632644702291fba42a381ec513780f698c38a6da3915b555
C:\Windows\QEZHNC.exe - a58b14220e3033ff6114134a4a07673f236bffc6f73b2938e69857fcf27c701c
C:\Windows\System\WHDR.exe - 9d97c34084e8895cf5d67c381e47a8bec86a566566657464621a0146358ad9bb

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

51.116.253.170
4.230.171.124
20.247.184.197
135.232.92.97
40.84.85.40
20.42.179.204
4.150.223.99
74.178.240.61
104.18.33.89
52.230.60.54
172.178.240.163
172.178.240.162
135.233.45.223
52.110.12.25
52.110.12.22
135.234.160.246
135.234.160.245
172.178.240.161
72.154.7.114
52.148.114.188
52.110.12.11
52.110.12.16

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Razy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report