MALICIOUS — 0a50174b6ef5b50a5d26fd07855446697d6d8145d5162a8df3de50c6e54aaad9.bin

MALICIOUS — 0a50174b6ef5b50a5d26fd07855446697d6d8145d5162a8df3de50c6e54aaad9.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the execute family. 6 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 0a50174b6ef5b50a5d26fd07855446697d6d8145d5162a8df3de50c6e54aaad9
• SHA-1: 702ce7777c83b63a0d20ffbf80b439394b712e64
• MD5: 1f7c4122131ba1c798fe09827fe1ee9b
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 24576:oQc/vMZdusi9UWIIJBoGkF9yl2wpZEbeZ:YkDWh7kpwEbe
• TLSH: T19D5012CFA94C0305C1C5C660718051DCAD9CAAABE92CB3D8DB251D270ADFC375C59AA7
• Submitted as: 0a50174b6ef5b50a5d26fd07855446697d6d8145d5162a8df3de50c6e54aaad9.bin
• File type: pe · Size: 807936 bytes
• Verdict: malicious (100/100) · Family: execute

Source: MalShare · first seen 2026-07-28T22:14:33.735Z · SHA-256 verified

Detections (6 of 53 engines)

• capa (capabilities): execute via PowerShell
• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
• ClamAV (daily): Win.Trojan.Spynoon-9939401-0
• Microsoft Defender: Trojan:MSIL/PureLogStealer.ABCC!MTB
• Emsisoft (Emergency Kit): Gen:Variant.AgentTesla.577
• Kaspersky (KVRT): HEUR:Trojan-Spy.MSIL.Noon.gen

MITRE ATT&CK

• T1059.001
• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Spynoon-9939401-0 (rule Win.Trojan.Spynoon-9939401-0) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 9 finding(s), e.g. process hollowing in RegSvcs.exe (pid 8680) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
• Microsoft Defender flagged Trojan:MSIL/PureLogStealer.ABCC!MTB (rule Trojan:MSIL/PureLogStealer.ABCC!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.AgentTesla.577 (rule Gen:Variant.AgentTesla.577) - engine signal, weight 0.55, confidence 0.85
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• Extracted XWorm config (0 C2) - engine signal, weight 0.45, confidence 0.60
• Extracted XWorm config (0 C2) - engine signal, weight 0.45, confidence 0.60
• Embedded network infrastructure: http://tempuri.org/HighScores.xsd, 3.0.9.2 - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

5381 behavior events · 1 ATT&CK techniques · 20 dropped files.

Runtime network

• searchapp.bundleassets.example
• www.msftconnecttest.com
• carrenzaalwarex.ddns.net
• dns.msftncsi.com
• desktop-hsgcbep
• www.bing.com
• config.edge.skype.com
• watson.events.data.microsoft.com
• settings-win.data.microsoft.com
• edge.microsoft.com
• msedge.api.cdp.microsoft.com
• aps.prod.windows.com
• ecs.office.com
• g.live.com
• self.events.data.microsoft.com
• www.msftncsi.com
• fs.microsoft.com
• 192.168.122.108
• 192.168.122.1
• 192.168.122.255

Dropped files

• /opt/CAPEv2/storage/analyses/3810/files/bc7ad48479a4be9d95d49ee697ec3637304bb29d2ed4618e5fb12502fe9f4e7d - bc7ad48479a4be9d95d49ee697ec3637304bb29d2ed4618e5fb12502fe9f4e7d
• d2fd847c6591d66b594490d5667ae6443e4ad81ba9ec5de17724a07a7f9e87b7 - d2fd847c6591d66b594490d5667ae6443e4ad81ba9ec5de17724a07a7f9e87b7
• dd0603a4b1498fc6c609dd773b41d88c14a7f8eb8e0439e6f6425ffe901f5492 - dd0603a4b1498fc6c609dd773b41d88c14a7f8eb8e0439e6f6425ffe901f5492
• b90c96e47d8f64d4079ab8b52333b7c6ee1aab9bfaf683df134675bbb8ac8bdb - b90c96e47d8f64d4079ab8b52333b7c6ee1aab9bfaf683df134675bbb8ac8bdb
• 7ee897137196e7cc5330f63a4e80633d0df5eee627fc439e723626186b0098d0 - 7ee897137196e7cc5330f63a4e80633d0df5eee627fc439e723626186b0098d0
• c5a503833f0c94395e87d6118ae74e1806e89625c205c798bc59393930434bea - c5a503833f0c94395e87d6118ae74e1806e89625c205c798bc59393930434bea
• c6ea2b2bcc8bcd077386e6e655bcb856b2fb2d881b7532b8a8a34f88f77b3ff1 - c6ea2b2bcc8bcd077386e6e655bcb856b2fb2d881b7532b8a8a34f88f77b3ff1
• 47a856ff7d9bf14949f9a1deed4ba4ec9495a9ef95ee41ba6d78f630561d166c - 47a856ff7d9bf14949f9a1deed4ba4ec9495a9ef95ee41ba6d78f630561d166c
• 8c8cb61d5cb4072f7c5f6d171cede0dacd0bf0c004c15478b0cde8bd66fbf06f - 8c8cb61d5cb4072f7c5f6d171cede0dacd0bf0c004c15478b0cde8bd66fbf06f
• 56f34169adf3ee14a244f24a13e0a6d91c950ef43e581301cbacb0992d8700ce - 56f34169adf3ee14a244f24a13e0a6d91c950ef43e581301cbacb0992d8700ce
• 166c43c485860abcbddc8d17100f864bbd3a4d1b0c9bf902033863f89dee6237 - 166c43c485860abcbddc8d17100f864bbd3a4d1b0c9bf902033863f89dee6237
• b73bea0f7eb03f3c7d2c25b4f29da1283b4fc0a07dcbbd91d01b0761392c3a86 - b73bea0f7eb03f3c7d2c25b4f29da1283b4fc0a07dcbbd91d01b0761392c3a86
• 4089f1991adaa2a992c389b44019b6fa26118f41f5034974dcba176e1fedb161 - 4089f1991adaa2a992c389b44019b6fa26118f41f5034974dcba176e1fedb161
• bbc693ea170ea5591aa422dcbbd8c37fde0d0a75a15871e5f064dbd8bf881985 - bbc693ea170ea5591aa422dcbbd8c37fde0d0a75a15871e5f064dbd8bf881985
• aeaebb732e213e80a1ecb5552b7be3653e5aadfd22f3c50dfba84b37fe3dd0c2 - aeaebb732e213e80a1ecb5552b7be3653e5aadfd22f3c50dfba84b37fe3dd0c2

Embedded URLs

• http://tempuri.org/HighScores.xsd

Embedded domains

• tempuri.org
• carrenzaalwarex.ddns.net

Embedded IP addresses

• 3.0.9.2

More execute samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report