MALICIOUS — 13e5d588804b938f0c3807dc194ee5274c475a5ae794815dcc910d0df5411c9d.exe

MALICIOUS — 13e5d588804b938f0c3807dc194ee5274c475a5ae794815dcc910d0df5411c9d.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100), attributed to the execute family. 5 of 26 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 13e5d588804b938f0c3807dc194ee5274c475a5ae794815dcc910d0df5411c9d
• SHA-1: 551148128c95bb551e745afff245f46636268d57
• MD5: 56de7e74a687ad9a4c37bc55181879f7
• imphash: f35cfcc6a3cb25841aefe38eee53876c
• ssdeep: 49152:+bsYes2pUopgkNoksAMTPZBDFDxFtS7n0yL7cgESOJJzS1gHUBD:jEb1gLKzhM
• TLSH: T11575BE68C12B2170E1FAD8846D6C9ADC847FB0999173DB9C5407DE3C807E937A9E43A4
• Submitted as: 13e5d588804b938f0c3807dc194ee5274c475a5ae794815dcc910d0df5411c9d.exe
• File type: pe · Size: 26927616 bytes
• Verdict: malicious (88/100) · Family: execute

Source: MalwareBazaar · first seen 2026-07-27T00:00:00.000Z · SHA-256 verified

Detections (5 of 26 engines)

• capa (capabilities): execute via PowerShell
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Trojan:Win64/Masslogger.YYD!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Yogi.27294
• Kaspersky (KVRT): Trojan-PSW.MSIL.PureLogs.ade

MITRE ATT&CK

• T1059.001

Why this verdict

The malicious score of 88/100 is the fusion of 5 weighted signals:

• Microsoft Defender flagged Trojan:Win64/Masslogger.YYD!MTB (rule Trojan:Win64/Masslogger.YYD!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Yogi.27294 (rule Gen:Variant.Yogi.27294) - engine signal, weight 0.55, confidence 0.85
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: 4.2.1.0, 1.81.233.84 - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

1 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded IP addresses

• 4.2.1.0
• 1.81.233.84

More execute samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report