MALICIOUS — 03f6840b488880b25f68ef287fa4f690297d940307c23c33d50571b9a4c33913.exe

MALICIOUS — 03f6840b488880b25f68ef287fa4f690297d940307c23c33d50571b9a4c33913.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Dnqz family. 4 of 25 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 03f6840b488880b25f68ef287fa4f690297d940307c23c33d50571b9a4c33913
• SHA-1: 72ef3fa0b68aee5f0c2dc2401d8b81da15537212
• MD5: f7fc53e9409a8110b1e254ada5a6458c
• imphash: 42492c8bc2aad1800e134cedaf5754c9
• ssdeep: 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6un:AsTICteErownP0oTcMsABqljkK
• TLSH: T1F065331542123792EEF3E860EC809C4D8473B699A873D19C5987CD5E70E9D33A8F0B96
• Submitted as: 03f6840b488880b25f68ef287fa4f690297d940307c23c33d50571b9a4c33913.exe
• File type: pe · Size: 5633061 bytes
• Verdict: malicious (99/100) · Family: Dnqz

Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (4 of 25 engines)

• MalwareAnalyser heuristics (entropy/packer): PyInstaller
• Detect It Easy (packer/type): DIE:PyInstaller
• Kaspersky (KVRT): Trojan-Dropper.Win32.Sysn.dnqz
• Emsisoft (Emergency Kit): Gen:Variant.Adware.Yogi.1551

MITRE ATT&CK

• T1543.003
• T1112
• T1071.004
• T1105

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

• Dropped a malicious payload (HUILoader): 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - dynamic signal, weight 0.80, confidence 0.90
• Kaspersky (KVRT) flagged Trojan-Dropper.Win32.Sysn.dnqz (rule Trojan-Dropper.Win32.Sysn.dnqz) - engine signal, weight 0.55, confidence 0.85
• Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 2 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 59 external host(s) at runtime (40 HTTP) - network signal, weight 0.40, confidence 0.80
• Detect It Easy (packer/type) flagged DIE:PyInstaller (rule DIE:PyInstaller) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: PyInstaller - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

29108 behavior events · 2 ATT&CK techniques · 15 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• t.me
• telegram.org
• cdn4.telesco.pe
• edge-consumer-static.azureedge.net
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• wpad
• ifconfig.me
• go-ns.org.ua
• tas02.sls.update.microsoft.com
• v10.events.data.microsoft.com
• 172.138.232.199.in-addr.arpa.
• ocsp.digicert.com
• config.edge.skype.com
• 32.88.214.23.in-addr.arpa.
• login.live.com
• time.windows.com

Dropped files

• /opt/CAPEv2/storage/analyses/8997/files/4da90e640bb4ea0c7700666f6e47b9ebcd33dece54e974def46e6b573e9862cd - 4da90e640bb4ea0c7700666f6e47b9ebcd33dece54e974def46e6b573e9862cd
• /opt/CAPEv2/storage/analyses/8997/files/8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
• /opt/CAPEv2/storage/analyses/8997/files/ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e - ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
• /opt/CAPEv2/storage/analyses/8997/files/75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902 - 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
• /opt/CAPEv2/storage/analyses/8997/files/e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae - e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
• /opt/CAPEv2/storage/analyses/8997/files/664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2 - 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
• /opt/CAPEv2/storage/analyses/8997/files/cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f - cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
• /opt/CAPEv2/storage/analyses/8997/files/b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf - b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
• /opt/CAPEv2/storage/analyses/8997/files/e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d - e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
• /opt/CAPEv2/storage/analyses/8997/files/acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142 - acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
• /opt/CAPEv2/storage/analyses/8997/files/5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf - 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
• /opt/CAPEv2/storage/analyses/8997/files/2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3 - 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
• /opt/CAPEv2/storage/analyses/8997/files/3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204 - 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
• /opt/CAPEv2/storage/analyses/8997/files/9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce - 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
• 5da82843f0f7db2fabcaa98d24c89ec945b0fd5e3c2ec5690824c0c4df6f5687 - 5da82843f0f7db2fabcaa98d24c89ec945b0fd5e3c2ec5690824c0c4df6f5687

Embedded URLs

• http://schemas.microsoft.com/SMI/2016/WindowsSettings
• http://www.msftconnecttest.com/connecttest.txt
• http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786376029&P2=404&P3=2&P4=eLbTuqmN5pdGF%2fMbf0Txs6wmouoS3L0Hbixkz1%2bf38hpRufMNaWOX3eIZb6ArTWEyGAu6x8AhBdsHjJDilWKtw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786376136&P2=404&P3=2&P4=WtEhmP9wIdoDn0jx0gsv2V%2frS3FQAXgS9m9j7QIEH6lrr%2bz08zXTPtHJQ8COtrTnNNNGDNn%2bBabEtQDrFE%2fZHg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

• schemas.microsoft.com
• 8.gq
• ifconfig.me
• go-ns.org.ua
• t.me
• www.tiktok.com
• core.telegram.org
• x5296.go-ns.org.ua
• x3176.go-ns.org.ua
• x7291.go-ns.org.ua
• x4338.go-ns.org.ua
• x2413.go-ns.org.ua
• x7251.go-ns.org.ua
• x6290.go-ns.org.ua
• x1543.go-ns.org.ua
• x5106.go-ns.org.ua
• x1048.go-ns.org.ua
• x5728.go-ns.org.ua
• x7490.go-ns.org.ua
• x9204.go-ns.org.ua
• x2957.go-ns.org.ua
• x7711.go-ns.org.ua
• x4781.go-ns.org.ua
• x7414.go-ns.org.ua
• x9288.go-ns.org.ua

Embedded IP addresses

• 74.179.77.204
• 34.160.111.145
• 104.21.85.170
• 20.42.73.25
• 172.67.208.133
• 162.159.142.9
• 74.178.240.61
• 20.42.65.90
• 149.154.167.99
• 172.66.2.5
• 104.46.162.229
• 4.247.188.224
• 157.240.8.35
• 138.201.132.148
• 4.150.223.109
• 20.184.175.17
• 74.178.232.29
• 40.79.167.9
• 52.123.252.224
• 52.110.12.51
• 4.230.171.124
• 52.230.60.54
• 135.233.95.144
• 74.178.240.51
• 51.11.192.48

File paths

• G:\($
• Y:\bG
• m:\0HCp

More Dnqz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report