MALICIOUS — 0a0b01867e41bbd7e9863cbf839efb3a2f0963c2ccedd06c22c22beda6aafa19.exe
MALICIOUS — 0a0b01867e41bbd7e9863cbf839efb3a2f0963c2ccedd06c22c22beda6aafa19.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PowerShell family. 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
0a0b01867e41bbd7e9863cbf839efb3a2f0963c2ccedd06c22c22beda6aafa19 - SHA-1:
d95e0e95aaa5bd035ad7cd1b24b5de03cb9d735d - MD5:
ce67f463c3459693c3934737bdcce0f7 - imphash:
51a80ea29674dca0d37bdf9bcafa7a0d - ssdeep:
768:CHHrET4k408zFbUn/8byR9X+pXFHxHUgRqVqnZB5CQmZKZCoqHy6+HOr:CHHrlpbWAyR9EFHx0gsVqZGZeGy - TLSH:
T1DB333AE11103116FE2F2ED54D82DAD9D4023B4D671312BAE820AD64E82FA3F7D4F5992 - Submitted as: 0a0b01867e41bbd7e9863cbf839efb3a2f0963c2ccedd06c22c22beda6aafa19.exe
- File type: pe · Size: 51712 bytes
- Verdict: malicious (100/100) · Family: PowerShell
Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified
Detections (5 of 53 engines)
- YARA: delivr.to detections: DLV_LNK_PowerShell_Launcher
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Hash: abuse.ch ThreatFox: known-malicious-hash
- Emsisoft (Emergency Kit): Trojan.GenericKD.80637907
- Kaspersky (KVRT): Trojan-PSW.Win32.Stealer.dlih
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 16 weighted signals:
- Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule
known-malicious-hash) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7240) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80637907 (rule
Trojan.GenericKD.80637907) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - YARA: delivr.to detections flagged DLV_LNK_PowerShell_Launcher (rule
DLV_LNK_PowerShell_Launcher) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://api.ipify.org, https://discord.com/api/v9/users/@me, 31.59.20.176 - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
6340 behavior events · 2 ATT&CK techniques · 3 dropped files.
Runtime network
- atm.office.mira.tm.svc.cloud.microsoft
- onedscolprdcus60.centralus.cloudapp.azure.com
- staging.to-do.officeppe.com
- s-0005.dual-s-msedge.net
- teams.cloud.microsoft
- outlook.office.com
- SYD-efz.ms-acdc.office.com
- outlook.office365.com
- atm.outlook.mira.tm.svc.cloud.microsoft
- outlook.cloud.microsoft
- bg.microsoft.map.fastly.net
- settings-prod-wus3-1-tagged.westus3.cloudapp.azure.com
- searchapp.bundleassets.example
- www.msftconnecttest.com
- settings-prod-sea-1-tagged.southeastasia.cloudapp.azure.com
- onedscolprdwus56.westus.cloudapp.azure.com
- ln-0007.ln-msedge.net
- onedsblobvmssprdcus02.centralus.cloudapp.azure.com
- onedscolprduks00.uksouth.cloudapp.azure.com
- mr-b02.tm-azurefd.net
Dropped files
- /opt/CAPEv2/storage/analyses/3239/files/6122ac0f6a79de9cfc57dc019a4a9cacffdf5cfb70586cb28d2f6014075f7eb7 -
6122ac0f6a79de9cfc57dc019a4a9cacffdf5cfb70586cb28d2f6014075f7eb7 - /opt/CAPEv2/storage/analyses/3239/files/69e85a2f848fe237df9b97fe88a72d129fbed41b1e15d5e2c382279ca018631e -
69e85a2f848fe237df9b97fe88a72d129fbed41b1e15d5e2c382279ca018631e - /opt/CAPEv2/storage/analyses/3239/files/96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 -
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
Embedded URLs
- https://github.com/wubejack-cmd/jirom/releases/download/jirom/file.zip
- https://api.ipify.org
- https://discord.com/api/v9/users/@me
Embedded domains
- github.com
- api.ipify.org
- api.telegram.org
- p.name
- discord.com
- atm.office.mira.tm.svc.cloud.microsoft
- staging.to-do.officeppe.com
- s-0005.dual-s-msedge.net
- glb.sls.prod.dcat.dsp.trafficmanager.net
- teams.cloud.microsoft
- atm.outlook.mira.tm.svc.cloud.microsoft
- outlook.cloud.microsoft
- ln-0007.ln-msedge.net
- glb.api.prod.dcat.dsp.trafficmanager.net
- mr-b02.tm-azurefd.net
- mr-b01.tm-azurefd.net
- onedscolprdcus60.centralus.cloudapp.azure.com
- outlook.office.com
- syd-efz.ms-acdc.office.com
- outlook.office365.com
- bg.microsoft.map.fastly.net
- settings-prod-wus3-1-tagged.westus3.cloudapp.azure.com
- searchapp.bundleassets.example
- www.msftconnecttest.com
- settings-prod-sea-1-tagged.southeastasia.cloudapp.azure.com
Embedded IP addresses
- 31.59.20.176
- 31.56.127.193
- 45.38.107.97
- 38.154.203.95
- 198.105.121.200
- 64.137.96.74
- 198.23.243.226
- 38.154.185.97
- 142.111.67.146
- 191.96.254.138
- 23.33.238.114
More PowerShell samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report