MALICIOUS — 055fb724333f4651eb7507c6d8c9df57c85f4ad498768c0f701e130a0c3b8cae.exe

MALICIOUS — 055fb724333f4651eb7507c6d8c9df57c85f4ad498768c0f701e130a0c3b8cae.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Dpdy family. 4 of 25 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 055fb724333f4651eb7507c6d8c9df57c85f4ad498768c0f701e130a0c3b8cae
• SHA-1: 677339f0aebfda28b01d1f6a1cc36bd7a8d0a912
• MD5: 13070504424343816bbfc589ccfc4882
• imphash: 42492c8bc2aad1800e134cedaf5754c9
• ssdeep: 98304:gfgtt7ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWH2Mxwh61FL:Tt7ICteErownP0oTcMsABqloOc1x
• TLSH: T11A65331642027792EEF3E8A0DC809D4D8463B2996873E19C6947CD5E70F9D33E8F0A56
• Submitted as: 055fb724333f4651eb7507c6d8c9df57c85f4ad498768c0f701e130a0c3b8cae.exe
• File type: pe · Size: 5631844 bytes
• Verdict: malicious (99/100) · Family: Dpdy

Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (4 of 25 engines)

• MalwareAnalyser heuristics (entropy/packer): PyInstaller
• Detect It Easy (packer/type): DIE:PyInstaller
• Emsisoft (Emergency Kit): Gen:Variant.Adware.Yogi.1551
• Kaspersky (KVRT): Trojan-Dropper.Win32.Sysn.dpdy

MITRE ATT&CK

• T1543.003
• T1112
• T1071.004
• T1105

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

• Dropped a malicious payload (HUILoader): 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - dynamic signal, weight 0.80, confidence 0.90
• Memory forensics: 3 finding(s), e.g. RWX/private injected region in powershell.exe (pid 1772) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.Yogi.1551 (rule Gen:Variant.Adware.Yogi.1551) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan-Dropper.Win32.Sysn.dpdy (rule Trojan-Dropper.Win32.Sysn.dpdy) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 2 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 62 external host(s) at runtime (49 HTTP) - network signal, weight 0.40, confidence 0.80
• Detect It Easy (packer/type) flagged DIE:PyInstaller (rule DIE:PyInstaller) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: PyInstaller - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

32653 behavior events · 2 ATT&CK techniques · 15 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• t.me
• telegram.org
• cdn4.telesco.pe
• edge-consumer-static.azureedge.net
• wpad
• 251.0.0.224.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• ifconfig.me
• go-ns.org.ua
• ocsp.digicert.com
• tas02.sls.update.microsoft.com
• v10.events.data.microsoft.com
• config.edge.skype.com
• 231.252.123.52.in-addr.arpa.
• time.windows.com

Dropped files

• /opt/CAPEv2/storage/analyses/9017/files/8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
• /opt/CAPEv2/storage/analyses/9017/files/ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e - ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
• /opt/CAPEv2/storage/analyses/9017/files/75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902 - 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
• /opt/CAPEv2/storage/analyses/9017/files/e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae - e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
• /opt/CAPEv2/storage/analyses/9017/files/664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2 - 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
• /opt/CAPEv2/storage/analyses/9017/files/cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f - cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
• /opt/CAPEv2/storage/analyses/9017/files/5bb163499a74294fc14fe93d7b3bd648e3a42b7832a453ffdffcec2a064f5fb9 - 5bb163499a74294fc14fe93d7b3bd648e3a42b7832a453ffdffcec2a064f5fb9
• /opt/CAPEv2/storage/analyses/9017/files/b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf - b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
• /opt/CAPEv2/storage/analyses/9017/files/e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d - e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
• /opt/CAPEv2/storage/analyses/9017/files/acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142 - acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
• /opt/CAPEv2/storage/analyses/9017/files/5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf - 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
• /opt/CAPEv2/storage/analyses/9017/files/2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3 - 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
• /opt/CAPEv2/storage/analyses/9017/files/3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204 - 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
• /opt/CAPEv2/storage/analyses/9017/files/9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce - 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
• b04d6f11c45257b48267263111c09638d9dabe5bff39153ac8f0adf569514672 - b04d6f11c45257b48267263111c09638d9dabe5bff39153ac8f0adf569514672

Embedded URLs

• http://schemas.microsoft.com/SMI/2016/WindowsSettings
• http://www.msftconnecttest.com/connecttest.txt
• http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786379032&P2=404&P3=2&P4=NZC7mXMArv4DcxGnyVWWkFlU0IyYps1ibfsOeFK60LNzknSmncIoab8EhKMisM0xDjbtB1ITG3wTtcRj%2fPysDg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786379102&P2=404&P3=2&P4=LjWIcixIJFbjWXEsBevyLgLhKx7s3ATPwLyLzQF8TXPaGrx8KmpoHNWVa4%2fa4m17LvgIPtwPwk4oDeXy%2fTUiyQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

• schemas.microsoft.com
• 8.gq
• ifconfig.me
• go-ns.org.ua
• t.me
• core.telegram.org
• www.tiktok.com
• x2979.go-ns.org.ua
• x5362.go-ns.org.ua
• x6586.go-ns.org.ua
• x8407.go-ns.org.ua
• x2793.go-ns.org.ua
• x8562.go-ns.org.ua
• x5869.go-ns.org.ua
• x5252.go-ns.org.ua
• x9553.go-ns.org.ua
• x1391.go-ns.org.ua
• x2536.go-ns.org.ua
• x6132.go-ns.org.ua
• x9103.go-ns.org.ua
• x3952.go-ns.org.ua
• x4369.go-ns.org.ua
• x9493.go-ns.org.ua
• x9139.go-ns.org.ua
• x5238.go-ns.org.ua

Embedded IP addresses

• 149.154.167.99
• 172.67.208.133
• 34.160.111.145
• 104.21.85.170
• 20.165.94.63
• 4.150.223.97
• 85.210.193.152
• 172.66.2.5
• 20.184.175.9
• 162.159.142.9
• 51.11.192.51
• 157.240.8.35
• 48.211.4.16
• 57.155.101.212
• 13.69.116.105
• 138.201.132.148
• 20.42.65.93
• 85.210.196.11
• 74.178.76.44
• 52.110.12.14
• 4.230.171.124
• 203.26.79.13
• 74.178.240.61
• 4.150.223.99
• 135.233.45.223

File paths

• G:\($
• Y:\bG
• m:\0HCp

More Dpdy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report