MALICIOUS — 09edfcfd964c4d696bf31fd73a2a25cf202ada11e3c2d6e1c7972e8ecbe4bd48.exe

MALICIOUS — 09edfcfd964c4d696bf31fd73a2a25cf202ada11e3c2d6e1c7972e8ecbe4bd48.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Dlof family. 4 of 25 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 09edfcfd964c4d696bf31fd73a2a25cf202ada11e3c2d6e1c7972e8ecbe4bd48
SHA-1: b41e988559e760df584f4e34f8df426c8a4bb525
MD5: 0f492a1669a891250190d122e4e8dfb6
imphash: 42492c8bc2aad1800e134cedaf5754c9
ssdeep: 98304:K8gtc4QICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllgHXMZt6w62:QPQICteErownP0oTcMsABqlFywz
TLSH: T15165331646163391EEF3E860DC409D4D8463B29868B2E59C6987CE5D34E9D33E8F0B93
Submitted as: 09edfcfd964c4d696bf31fd73a2a25cf202ada11e3c2d6e1c7972e8ecbe4bd48.exe
File type: pe · Size: 5629226 bytes
Verdict: malicious (99/100) · Family: Dlof

Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (4 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): PyInstaller
Detect It Easy (packer/type): DIE:PyInstaller
Emsisoft (Emergency Kit): Gen:Variant.Adware.Yogi.1551
Kaspersky (KVRT): Trojan-Dropper.Win32.Sysn.dlof

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

Dropped a malicious payload (HUILoader): 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - dynamic signal, weight 0.80, confidence 0.90
Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.Yogi.1551 (rule Gen:Variant.Adware.Yogi.1551) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Dropper.Win32.Sysn.dlof (rule Trojan-Dropper.Win32.Sysn.dlof) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
2 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 70 external host(s) at runtime (46 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:PyInstaller (rule DIE:PyInstaller) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: PyInstaller - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

30583 behavior events · 2 ATT&CK techniques · 15 dropped files.

Runtime network

www.msftconnecttest.com
inference.location.live.net
t.me
telegram.org
cdn4.telesco.pe
edge-consumer-static.azureedge.net
251.0.0.224.in-addr.arpa.
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
252.0.0.224.in-addr.arpa.
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
ifconfig.me
go-ns.org.ua
ocsp.digicert.com
tas02.sls.update.microsoft.com
v10.events.data.microsoft.com
settings-win.data.microsoft.com
www.tiktok.com
49.88.214.23.in-addr.arpa.
17.88.214.23.in-addr.arpa.

Dropped files

/opt/CAPEv2/storage/analyses/9084/files/8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
/opt/CAPEv2/storage/analyses/9084/files/ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e - ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
/opt/CAPEv2/storage/analyses/9084/files/75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902 - 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
/opt/CAPEv2/storage/analyses/9084/files/e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae - e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
/opt/CAPEv2/storage/analyses/9084/files/664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2 - 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
/opt/CAPEv2/storage/analyses/9084/files/cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f - cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
/opt/CAPEv2/storage/analyses/9084/files/b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf - b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
/opt/CAPEv2/storage/analyses/9084/files/e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d - e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
/opt/CAPEv2/storage/analyses/9084/files/acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142 - acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
/opt/CAPEv2/storage/analyses/9084/files/5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf - 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
/opt/CAPEv2/storage/analyses/9084/files/437b8fd38c851baf7aec7e65313f96abbdbede23d01585aa5264291b28816642 - 437b8fd38c851baf7aec7e65313f96abbdbede23d01585aa5264291b28816642
/opt/CAPEv2/storage/analyses/9084/files/2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3 - 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
/opt/CAPEv2/storage/analyses/9084/files/3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204 - 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
/opt/CAPEv2/storage/analyses/9084/files/9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce - 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
8ce7f660167c6a411215fb2c822ffaa20805aaca2e0fe9a0287ecff5f95d081a - 8ce7f660167c6a411215fb2c822ffaa20805aaca2e0fe9a0287ecff5f95d081a

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786388362&P2=404&P3=2&P4=mp0W4Hagm3JapSwuAESq%2bt2r38nzwhwXUFwkBYHdIMSFVIB%2bnIFw35F%2bbQRaAxLWT2KYIX4ES2Wnmn7AVAoj0A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786388403&P2=404&P3=2&P4=ZDbLukF%2fwJr85alSeYW%2fbZBGNeWRuy9D%2bZ%2fyC7udC9eHEUyufSJuvnCKZ2EaGPu3zG5TWvtAuBfNkyA6WLr%2bgA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
8.gq
ifconfig.me
go-ns.org.ua
t.me
www.tiktok.com
telegram.org
cdn4.telesco.pe

Embedded IP addresses

157.240.8.35
149.154.167.99
125.56.205.160
34.160.111.145
172.67.208.133
74.179.77.204
4.150.223.104
104.21.85.170
40.79.163.154
13.89.179.12
40.84.85.40
138.201.132.148
20.42.179.204
85.210.196.11
157.240.13.35
52.123.252.225
48.211.4.16
20.184.175.6
20.184.175.1
203.26.79.13
125.56.205.177
92.223.78.30
125.56.205.187
4.150.223.97
125.56.205.17

File paths

G:\($
Y:\bG
m:\0HCp

More Dlof samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report