MALICIOUS — 10e6b15e8676b6e1511ca83d84d62f7d498b03737e43c22947a9dbc9552bf14d.exe

MALICIOUS — 10e6b15e8676b6e1511ca83d84d62f7d498b03737e43c22947a9dbc9552bf14d.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Wacatac family. 5 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 10e6b15e8676b6e1511ca83d84d62f7d498b03737e43c22947a9dbc9552bf14d
SHA-1: 17f744b38ad957b06c194167aea0b65f71ed6887
MD5: dd78786164adbc1a1979db4f5e7532bf
imphash: 42492c8bc2aad1800e134cedaf5754c9
ssdeep: 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrL:k7ICteErownP0oTcMsABqlkgczn
TLSH: T1AB65331642123791EEF3E960DC809D4D8463B79DA872D25C6987CD5E30F9D33A8F0A86
Submitted as: 10e6b15e8676b6e1511ca83d84d62f7d498b03737e43c22947a9dbc9552bf14d.exe
File type: pe · Size: 5634603 bytes
Verdict: malicious (100/100) · Family: Wacatac

Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (5 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): PyInstaller
Detect It Easy (packer/type): DIE:PyInstaller
Microsoft Defender: Trojan:Win32/Wacatac.B!ml
Emsisoft (Emergency Kit): Gen:Variant.Adware.Yogi.1551
Kaspersky (KVRT): Trojan-Dropper.Win32.Sysn.dqdm

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

Dropped a malicious payload (HUILoader): 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Wacatac.B!ml (rule Trojan:Win32/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.Yogi.1551 (rule Gen:Variant.Adware.Yogi.1551) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Dropper.Win32.Sysn.dqdm (rule Trojan-Dropper.Win32.Sysn.dqdm) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 45 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1622, T1082 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:PyInstaller (rule DIE:PyInstaller) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: PyInstaller - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

14005 behavior events · 2 ATT&CK techniques · 15 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/12437/files/8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
/opt/CAPEv2/storage/analyses/12437/files/ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e - ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
/opt/CAPEv2/storage/analyses/12437/files/75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902 - 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
/opt/CAPEv2/storage/analyses/12437/files/e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae - e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
/opt/CAPEv2/storage/analyses/12437/files/664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2 - 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
/opt/CAPEv2/storage/analyses/12437/files/cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f - cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
/opt/CAPEv2/storage/analyses/12437/files/b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf - b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
/opt/CAPEv2/storage/analyses/12437/files/e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d - e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
/opt/CAPEv2/storage/analyses/12437/files/acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142 - acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
/opt/CAPEv2/storage/analyses/12437/files/5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf - 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
/opt/CAPEv2/storage/analyses/12437/files/2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3 - 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
/opt/CAPEv2/storage/analyses/12437/files/3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204 - 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
/opt/CAPEv2/storage/analyses/12437/files/57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977 - 57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977
/opt/CAPEv2/storage/analyses/12437/files/9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce - 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
53fbdbe74da138cf0dbc7848fa07f19ce462e8083a7bca32c6a16bd6f9661fb9 - 53fbdbe74da138cf0dbc7848fa07f19ce462e8083a7bca32c6a16bd6f9661fb9

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786522075&P2=404&P3=2&P4=B496CcQ%2buEnOIKsljOxW%2fUjFpbJQII6E7pOEyJUXy3XPbrbIBTRdU2zxNCtya%2fNmTlx%2bowiUeD6ajc%2bwCD521A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786522192&P2=404&P3=2&P4=brzsVr1QbN2Jj8H%2fv4ZA7x5teZ777nK%2btfw4Uh3751eTbhvnpyjMsFfMPdxiiYUW1M4WdjxxMdmvE3Er0P4i1g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
8.gq
t.me
telegram.org
cdn4.telesco.pe

Embedded IP addresses

20.184.175.16
52.123.252.204
20.42.179.204
4.230.171.124
20.247.184.142
135.232.92.137
74.179.77.164
20.50.201.201
20.184.175.11
203.26.79.13
135.233.45.222
20.190.122.23
40.115.75.193
149.154.167.99
149.154.165.137
52.123.252.224
135.233.95.80
4.150.223.114
52.168.112.67
172.66.2.5
52.110.12.26
52.110.12.31
72.153.5.60
52.148.114.188
172.217.25.206

File paths

G:\($
Y:\bG
m:\0HCp

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report