MALICIOUS — 04ef9757c950005f926458dee36517a6c879d39e5798a378bdd6aa7a45d0d23a.exe

MALICIOUS — 04ef9757c950005f926458dee36517a6c879d39e5798a378bdd6aa7a45d0d23a.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Malgent family. 6 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 04ef9757c950005f926458dee36517a6c879d39e5798a378bdd6aa7a45d0d23a
SHA-1: 22edef81c1fe81db499b3084b3c128b96a70c5a1
MD5: ba1a44c6bfd17c461d2ebf0f033bae12
imphash: 4ba3f97ab4d7908411ad46e497198ac7
ssdeep: 393216:B+cI5DSiUihxiXB9tXMCHWUjX+cuI3/PGTAI:BNI5glX/tXMb8XzH/O7
TLSH: T18D6E3323269B1191D8F3D738AC644DDCC033A1A52937B19E0D43EC6EA4C1D7798F19AA
Submitted as: 04ef9757c950005f926458dee36517a6c879d39e5798a378bdd6aa7a45d0d23a.exe
File type: pe · Size: 14278005 bytes
Verdict: malicious (100/100) · Family: Malgent

Source: MalwareBazaar · first seen 2026-07-28T00:00:00.000Z · SHA-256 verified

Detections (6 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
Hash: abuse.ch ThreatFox: known-malicious-hash
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Malgent
Emsisoft (Emergency Kit): Gen:Variant.Yogi.14068
Kaspersky (KVRT): HEUR:Trojan.Python.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in svchost.exe (pid 920) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Malgent (rule Trojan:Win32/Malgent) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Yogi.14068 (rule Gen:Variant.Yogi.14068) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

18060 behavior events · 2 ATT&CK techniques · 28 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/5294/files/36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 - 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
/opt/CAPEv2/storage/analyses/5294/files/a7244443bb3367d80de47c9f1500f594d940b32347b4182404855de5582de35b - a7244443bb3367d80de47c9f1500f594d940b32347b4182404855de5582de35b
/opt/CAPEv2/storage/analyses/5294/files/3a825fd8006da358ff6cd234395e8abd90581c46f4e063c8dc8edcc420b7d4da - 3a825fd8006da358ff6cd234395e8abd90581c46f4e063c8dc8edcc420b7d4da
/opt/CAPEv2/storage/analyses/5294/files/69cc93ccb157160809ca745726a8f31e6187c54c07f6d4254007c71756154edd - 69cc93ccb157160809ca745726a8f31e6187c54c07f6d4254007c71756154edd
/opt/CAPEv2/storage/analyses/5294/files/8333e0ac5134885e6ac8bb7d33bc027f6ccdeddb911836e67bc3f0fa7564b963 - 8333e0ac5134885e6ac8bb7d33bc027f6ccdeddb911836e67bc3f0fa7564b963
/opt/CAPEv2/storage/analyses/5294/files/6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7 - 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
/opt/CAPEv2/storage/analyses/5294/files/fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640 - fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
/opt/CAPEv2/storage/analyses/5294/files/7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824 - 7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824
/opt/CAPEv2/storage/analyses/5294/files/1106747cc8f0c8e5cd47783fba06b78921c77069ef75c6ba9bbab2cb609a7ab0 - 1106747cc8f0c8e5cd47783fba06b78921c77069ef75c6ba9bbab2cb609a7ab0
/opt/CAPEv2/storage/analyses/5294/files/2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20 - 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
/opt/CAPEv2/storage/analyses/5294/files/78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb - 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
/opt/CAPEv2/storage/analyses/5294/files/386111c74ac331df0b2e13dc5148934c355358540c919c236c61865a9889fe98 - 386111c74ac331df0b2e13dc5148934c355358540c919c236c61865a9889fe98
/opt/CAPEv2/storage/analyses/5294/files/f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8 - f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
/opt/CAPEv2/storage/analyses/5294/files/a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4 - a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
/opt/CAPEv2/storage/analyses/5294/files/eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a - eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings

Embedded domains

schemas.microsoft.com
6n.it
p.za
5a.sg
s.ua
6.me
i.us
8.ru
aefd.nelreports.net

File paths

Z:\3H
w:\1
c:\H^P5
r:\)o

More Malgent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report