SUSPICIOUS — 0f6196ae372d5e6c27ece669890a9458a1e6e0405618b76fe79693758f86266a

SUSPICIOUS — 0f6196ae372d5e6c27ece669890a9458a1e6e0405618b76fe79693758f86266a is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 4 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 0f6196ae372d5e6c27ece669890a9458a1e6e0405618b76fe79693758f86266a
SHA-1: 37c5f6dda155cb6327dad5bf978eb8a2bd15551f
MD5: 067ec4e38c4ddb0f6da00e46d4ffce89
imphash: c5723a7c7f3ee77135900804381861ec
ssdeep: 3072:n8C+8S6wtkZiYpxjy2VqpWlGKn+ugWMTT1GieOx+:E8S6w581tfYWrn
TLSH: T1C44927C4C9721C20C53A963718888C9D9E56DDB64C294F0CE762A4FDACEF473415D6E8
Submitted as: 0f6196ae372d5e6c27ece669890a9458a1e6e0405618b76fe79693758f86266a
File type: pe · Size: 393216 bytes
Verdict: suspicious (54/100)

Detections (4 of 55 engines)

YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Dostre!atmnm
Trellix Stinger (McAfee): Trojan-FPZA!067EC4E38C4D
Kaspersky (KVRT): Trojan.Win32.Agent.qwidcl

MITRE ATT&CK

Why this verdict

The suspicious score of 54/100 is the fusion of 7 weighted signals:

Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

20127 behavior events · 2 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\~BB43\20260820085248_7.a - be6d7dd5adf15c1acd34c12cbbeb58f7f316bc4976f7acc3f39fcd633c113b4c
C:\Users\analyst\AppData\Local\Temp\~BB43\20260820155200_6.a - 9484dea080648cb500518a61ac58a37501c5f5639c3ef256e6a61c3d77975807
C:\Users\analyst\AppData\Local\Temp\~31C6\20260820155131_3.a - b51ab3198d9cb84baa391805cb9a594d825e8f1891551505508b9ccafb421c78
C:\Users\analyst\AppData\Local\Temp\1787241169.jpg - 749fc18f12ceadfe4a06f8cc72911f452549d6a4b5166d8fd2bfe30e03897791
C:\Users\analyst\AppData\Local\Temp\~31C6\20260820155135_4.a - 97581e23716e262667cf40ce7493785c062ddb5f21eca1c0dba416a262938d01
C:\Users\analyst\AppData\Local\Temp\~BB16\C - 4b1f4834df1b7847af9833ff6c4936fd18bd1e8d6d6e32885dbb64a9bbd836ac
C:\Users\analyst\AppData\Local\Temp\~31C6\20260820155131_2.a - 0b74659dafa11c0644d5b1bf286af7f7a39a2e7ccc98bb180ef2850cac6caf00
C:\Users\analyst\AppData\Local\Temp\~BB43\20260820085301_10.a - 7119bb1d36296dfa103ca6cf083d8d8cdce3189a90222ff081d8e4ff923609ea
C:\Users\analyst\AppData\Local\Temp\~BB43\20260820155156_5.a - b09d524b324933e37b069a460e09ef4b9118d6d4865939f61bba350596bcc0bf
C:\Users\analyst\AppData\Local\Temp\~BB43\20260820085252_8.a - 95f87ff51c9b4b8a5c8aae49b47159feae30178f1c9117bfea31b45781b806b5
C:\Users\analyst\AppData\Local\Temp\1787266295.jpg - fab504678ce9d06b84257dc7f9b7996433f9f9b3d1207c70133a12a8686b9114
C:\Users\analyst\AppData\Local\Temp\~31C6\20260820155130_1.a - 4feedcb16c165f98192dcf457daae13976a81310505dddb990f699a22ca01167
C:\Users\analyst\AppData\Local\Temp\tsk_643ad3e973744ad0.exe - 8907d2779a82ec0bf8b400619f4938594147d17086ad93640a7e3467be367475
C:\ProgramData\Destro - c2cb291f6bf259e9ec649d7c256ca4890cf672a8e6568bdf2fb422517334535e
c:\users\analyst\appdata\local\temp\~b4d8\20260820155142_00000029.s - 1654489d1725e1d2233888618652e8e2938b7fb2ae81036c0918ccf5fd0b4234

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787845852&P2=404&P3=2&P4=XRbD5aEFjN9lo1u4DdGY2%2bgmhb4PKc7oMm4d7Lc7KHQHf0P%2b56z6W%2fPMVIjzGWHOBH%2fWroWf82dAQAYgzBp3jQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787845926&P2=404&P3=2&P4=dvM%2brxA6dW8VS9%2bAg6yjwIT6NuHIcICdld5MkMop8M2I9XuOT2dPMbwQ8w2m2yuDI78MSu%2bvORaZ%2bsTDDj2B%2fw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://www.360.cn/status/getsign.asp
http://icanhazip.com/

Embedded domains

www.360.cn
icanhazip.com

Embedded IP addresses

52.110.12.31
40.79.163.155
40.84.85.40
4.230.171.124
52.253.84.76
74.179.77.204
4.150.223.114
74.178.240.51
135.233.95.144
52.123.128.14
20.76.201.171
40.99.134.18
203.26.79.13
172.178.240.162
135.232.92.34
52.148.114.188
4.150.223.101
20.42.65.85
92.223.78.30
47.89.195.194
72.145.35.96
210.45.61.14
207.13.172.78
104.16.184.241
52.110.12.37

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report