MALICIOUS — 11146be83553180c93601c7fb120869a85e9fd4e8040550f57e7f677bb8f2710.exe

MALICIOUS — 11146be83553180c93601c7fb120869a85e9fd4e8040550f57e7f677bb8f2710.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Wacatac family. 5 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 11146be83553180c93601c7fb120869a85e9fd4e8040550f57e7f677bb8f2710
SHA-1: adb2177d1a60b8c5ff1fd7a33212b6d104917d1d
MD5: 44dea8e7c57eccf96b9aaeed8a6913a4
imphash: 42492c8bc2aad1800e134cedaf5754c9
ssdeep: 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6uA:AsTICteErownP0oTcMsABqljkF
TLSH: T15B65331542023792EEF3E960EC809C4D8473B699A873D19C5987CD5E70E9D33A8F0B96
Submitted as: 11146be83553180c93601c7fb120869a85e9fd4e8040550f57e7f677bb8f2710.exe
File type: pe · Size: 5632979 bytes
Verdict: malicious (100/100) · Family: Wacatac

Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (5 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): PyInstaller
Detect It Easy (packer/type): DIE:PyInstaller
Microsoft Defender: Trojan:Win32/Wacatac.B!ml
Emsisoft (Emergency Kit): Gen:Variant.Adware.Yogi.1551
Kaspersky (KVRT): Trojan-Dropper.Win32.Sysn.dnfk

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

Dropped a malicious payload (HUILoader): 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Wacatac.B!ml (rule Trojan:Win32/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.Yogi.1551 (rule Gen:Variant.Adware.Yogi.1551) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Dropper.Win32.Sysn.dnfk (rule Trojan-Dropper.Win32.Sysn.dnfk) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 44 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1622, T1082 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:PyInstaller (rule DIE:PyInstaller) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: PyInstaller - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

14735 behavior events · 2 ATT&CK techniques · 15 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/12509/files/4da90e640bb4ea0c7700666f6e47b9ebcd33dece54e974def46e6b573e9862cd - 4da90e640bb4ea0c7700666f6e47b9ebcd33dece54e974def46e6b573e9862cd
/opt/CAPEv2/storage/analyses/12509/files/8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
/opt/CAPEv2/storage/analyses/12509/files/ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e - ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
/opt/CAPEv2/storage/analyses/12509/files/75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902 - 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
/opt/CAPEv2/storage/analyses/12509/files/e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae - e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
/opt/CAPEv2/storage/analyses/12509/files/664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2 - 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
/opt/CAPEv2/storage/analyses/12509/files/cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f - cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
/opt/CAPEv2/storage/analyses/12509/files/b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf - b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
/opt/CAPEv2/storage/analyses/12509/files/e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d - e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
/opt/CAPEv2/storage/analyses/12509/files/acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142 - acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
/opt/CAPEv2/storage/analyses/12509/files/5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf - 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
/opt/CAPEv2/storage/analyses/12509/files/2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3 - 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
/opt/CAPEv2/storage/analyses/12509/files/3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204 - 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
/opt/CAPEv2/storage/analyses/12509/files/9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce - 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
f8b1046a48ab8e8bde3cf05d83736428e9a1b066a3a2458ab5efec1919124f10 - f8b1046a48ab8e8bde3cf05d83736428e9a1b066a3a2458ab5efec1919124f10

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786524306&P2=404&P3=2&P4=jL8us5ULG4Rax8Y%2bydsJhxVYEqfUksb6kkD%2bJov7sgFdnsSisOgdmtn6kn9rGxjJ9gZZMrrdKKpf5cPNOeZe9g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786524379&P2=404&P3=2&P4=GNaOy0hG2UmXlV30Y0iwMQT1E4DRlELQjOjL43GFrlZ1tb1wTw%2byGL18z83dujWqnoZj72S0%2fww147%2bq610zqA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
8.gq
t.me
telegram.org
cdn4.telesco.pe

Embedded IP addresses

135.232.92.34
4.150.223.107
4.144.132.223
57.155.101.212
4.230.171.124
74.178.240.61
74.178.240.51
20.50.73.5
51.105.71.136
172.178.240.163
104.46.162.231
135.234.160.246
92.223.78.30
149.154.167.99
40.115.75.193
52.123.252.204
4.195.116.8
203.26.79.13
74.178.232.29
142.250.195.163
72.153.5.137
52.148.114.188
142.250.183.46
149.154.164.25
52.110.12.31

File paths

G:\($
Y:\bG
m:\0HCp

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report