MALICIOUS — 113f9b3017f0cac7a64800a8b986c35da6db02b45ab0b573411777b12054c955.exe

MALICIOUS — 113f9b3017f0cac7a64800a8b986c35da6db02b45ab0b573411777b12054c955.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Ravartar family. 5 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 113f9b3017f0cac7a64800a8b986c35da6db02b45ab0b573411777b12054c955
SHA-1: ddc521c340a0e74359e85ce9cdb0b3f28f603ffd
MD5: a25ff62cecce60ff26219384adf7f6ce
imphash: 42492c8bc2aad1800e134cedaf5754c9
ssdeep: 98304:jHgtHICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllSHmMOQ6tN1:GHICteErownP0oTcMsABql4Utn
TLSH: T1F265331542067392EEF3E860EC409D4D84A3B29968B3E59C6A87CD5D30E5D33E8F0A57
Submitted as: 113f9b3017f0cac7a64800a8b986c35da6db02b45ab0b573411777b12054c955.exe
File type: pe · Size: 5631170 bytes
Verdict: malicious (99/100) · Family: Ravartar

Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (5 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): PyInstaller
Detect It Easy (packer/type): DIE:PyInstaller
Microsoft Defender: Trojan:Win32/Ravartar!rfn
Emsisoft (Emergency Kit): Gen:Variant.Adware.Yogi.1551
Kaspersky (KVRT): Trojan-Dropper.Win32.Sysn.dmub

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

Dropped a malicious payload (HUILoader): 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Ravartar!rfn (rule Trojan:Win32/Ravartar!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.Yogi.1551 (rule Gen:Variant.Adware.Yogi.1551) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 45 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1622, T1082 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:PyInstaller (rule DIE:PyInstaller) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: PyInstaller - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

11294 behavior events · 2 ATT&CK techniques · 15 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/12502/files/8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
/opt/CAPEv2/storage/analyses/12502/files/ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e - ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
/opt/CAPEv2/storage/analyses/12502/files/75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902 - 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
/opt/CAPEv2/storage/analyses/12502/files/e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae - e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
/opt/CAPEv2/storage/analyses/12502/files/664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2 - 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
/opt/CAPEv2/storage/analyses/12502/files/cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f - cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
/opt/CAPEv2/storage/analyses/12502/files/b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf - b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
/opt/CAPEv2/storage/analyses/12502/files/e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d - e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
/opt/CAPEv2/storage/analyses/12502/files/acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142 - acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
/opt/CAPEv2/storage/analyses/12502/files/798c3605fe24d94228acd75622d03e23f022b3b918e266be852c20fa27bba0a6 - 798c3605fe24d94228acd75622d03e23f022b3b918e266be852c20fa27bba0a6
/opt/CAPEv2/storage/analyses/12502/files/5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf - 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
/opt/CAPEv2/storage/analyses/12502/files/2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3 - 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
/opt/CAPEv2/storage/analyses/12502/files/3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204 - 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
/opt/CAPEv2/storage/analyses/12502/files/9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce - 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
dd6a02578e8832137c169d1a21b8818efcf25954250e2d6cb8dd4559f1d5ebac - dd6a02578e8832137c169d1a21b8818efcf25954250e2d6cb8dd4559f1d5ebac

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786524095&P2=404&P3=2&P4=MuTnLzbfKJuQySx1vpOI%2b0O4oxQyrJZP2BABH8FVLqBV6THai9NuQW%2bWjtaFlnjMt86zzBtvOS0F9Y9d0OR74w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786524125&P2=404&P3=2&P4=IGxQAvF4tLBbQqrG9Wz76svRr7wFMnWQcaatttp1ANxClmvz%2b6E3zOXLXMuuxLm93HGah8UcoiZcIn6CPbI5hw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
l.sg
8.gq
t.me
telegram.org
cdn4.telesco.pe

Embedded IP addresses

203.26.79.13
4.150.223.100
20.247.185.124
4.230.171.124
172.215.188.225
4.247.188.233
74.178.240.61
135.232.92.34
74.178.240.51
20.42.65.85
172.178.240.162
149.154.167.99
52.123.252.247
4.195.116.8
135.233.45.221
72.145.35.105
135.234.160.244
92.223.78.30
52.148.114.188
142.250.183.46
149.154.164.25
52.110.12.51
52.110.12.22

File paths

G:\($
Y:\bG
m:\0HCp

More Ravartar samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report