MALICIOUS — 076cd8f9c0a81780810f5708c8f5ce0e7d3dc38bf9ec339746a1eb400655d0f3.exe

MALICIOUS — 076cd8f9c0a81780810f5708c8f5ce0e7d3dc38bf9ec339746a1eb400655d0f3.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Python family. 3 of 52 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 076cd8f9c0a81780810f5708c8f5ce0e7d3dc38bf9ec339746a1eb400655d0f3
SHA-1: 0c11b28e0a7fa7718ea42423b1c6110ff8826e8f
MD5: d6488d6b9f8ad8038c0bb06a88c7f8d2
imphash: 42492c8bc2aad1800e134cedaf5754c9
ssdeep: 98304:tugtneKB+ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllKHQ0ft6nx:1F+ICteErownP0oTcMsABqluQnx
TLSH: T1D165335545067392EEF3E8A0EC809D4D8463B29CA873E59C6987CD4E70E8D33E5F0A46
Submitted as: 076cd8f9c0a81780810f5708c8f5ce0e7d3dc38bf9ec339746a1eb400655d0f3.exe
File type: pe · Size: 5606095 bytes
Verdict: malicious (99/100) · Family: Python

Source: MalwareBazaar · first seen 2026-07-31T00:00:00.000Z · SHA-256 verified

Detections (3 of 52 engines)

Microsoft Defender: Trojan:Python/BrowserStealer.P!MTB
Emsisoft (Emergency Kit): Gen:Variant.Yogi.11808
Kaspersky (KVRT): HEUR:Trojan-PSW.Python.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

Dropped a malicious payload (HUILoader): 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 976) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Python/BrowserStealer.P!MTB (rule Trojan:Python/BrowserStealer.P!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Yogi.11808 (rule Gen:Variant.Yogi.11808) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
2 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 53 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

25245 behavior events · 2 ATT&CK techniques · 28 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/7668/files/8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
/opt/CAPEv2/storage/analyses/7668/files/dc1e739bfe4fb7fc971a983bcd22913e24f7a127f6abe28d816c36a8e0f5cbf0 - dc1e739bfe4fb7fc971a983bcd22913e24f7a127f6abe28d816c36a8e0f5cbf0
/opt/CAPEv2/storage/analyses/7668/files/ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e - ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
/opt/CAPEv2/storage/analyses/7668/files/75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902 - 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
/opt/CAPEv2/storage/analyses/7668/files/c8e5017b318bcc84b0f02bdfe8b7c8ffdf2982e3b7eb6c54bee7de6c27d16c2f - c8e5017b318bcc84b0f02bdfe8b7c8ffdf2982e3b7eb6c54bee7de6c27d16c2f
/opt/CAPEv2/storage/analyses/7668/files/edde18788bce33cccf3fe018ba511df02ad2d1b40140d98991d3f844c07c8662 - edde18788bce33cccf3fe018ba511df02ad2d1b40140d98991d3f844c07c8662
/opt/CAPEv2/storage/analyses/7668/files/664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2 - 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
/opt/CAPEv2/storage/analyses/7668/files/cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f - cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
/opt/CAPEv2/storage/analyses/7668/files/64fee2f106b95e0a131379a7ad5c9385613eca1a4082ecb326ac1e081e52eba2 - 64fee2f106b95e0a131379a7ad5c9385613eca1a4082ecb326ac1e081e52eba2
/opt/CAPEv2/storage/analyses/7668/files/ccbe988ee5a6889c5dab782e843614fc2d04b31b771eb8235e711c6cc8b935ac - ccbe988ee5a6889c5dab782e843614fc2d04b31b771eb8235e711c6cc8b935ac
/opt/CAPEv2/storage/analyses/7668/files/b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf - b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
/opt/CAPEv2/storage/analyses/7668/files/e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d - e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
/opt/CAPEv2/storage/analyses/7668/files/acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142 - acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
/opt/CAPEv2/storage/analyses/7668/files/5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf - 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
/opt/CAPEv2/storage/analyses/7668/files/020e79a9fce6a99545b00ddb412defda3eacec73d02ec8dd284f1a0338ec09f9 - 020e79a9fce6a99545b00ddb412defda3eacec73d02ec8dd284f1a0338ec09f9

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786286921&P2=404&P3=2&P4=hVG8M7SYVdcGzVg32%2famScg05bF2LeMeX6z9xpfPxII6igtSfb2reMoKsZo5BMMVtDkyQKq4g7OmMPj905Gxjw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786286958&P2=404&P3=2&P4=edKAFAvrnFKhFPpPtWnUQwbA73lJWeR30ETfBfIs5bnLxxt98bbIQrzx7ng5lXQrKaSvd2HrNnvoi9pvbke5OA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
8.gq
t.me
go-ns.org.ua
www.tiktok.com

Embedded IP addresses

48.211.4.16
4.150.223.99
4.144.132.114
4.230.171.124
85.210.196.11
20.165.94.54
20.184.175.16
74.178.76.128
52.123.252.227
203.26.79.13
74.178.76.44
20.184.175.7
172.178.240.163
92.223.78.30
52.110.12.8
52.110.12.4
4.247.188.233
149.154.167.99
172.67.208.133
157.240.8.35
20.11.121.11
135.234.160.244
72.153.5.97
35.190.80.1
52.148.114.188

File paths

G:\($
Y:\bG
m:\0HCp

More Python samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report