MALICIOUS — 181df1e408b4ab730be34936f8ab455ebefef2e56d969953227d16c123557d8d.msi

MALICIOUS — 181df1e408b4ab730be34936f8ab455ebefef2e56d969953227d16c123557d8d.msi is a office-ole sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Egairtigado family. 3 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 181df1e408b4ab730be34936f8ab455ebefef2e56d969953227d16c123557d8d
SHA-1: 665942fd64084b5bbaa21ae87f585bae3054b593
MD5: 87ab2725320934c368e85927116dcd23
ssdeep: 196608:Gfr5aBckL3Q52UiI/abgiWeS2+ZbpmguUeTsJlhtwUPdj5J1agAYXcyYoA8z:Kr5Y3L3e2UcbgixSZZ9wJArsUPdjx1XP
TLSH: T1286A336972416D96EE76F8017CA5C6BC0817F57715AA318EB280348F968986B43F30F3
Submitted as: 181df1e408b4ab730be34936f8ab455ebefef2e56d969953227d16c123557d8d.msi
File type: office-ole · Size: 9248768 bytes
Verdict: malicious (98/100) · Family: Egairtigado

Source: MalwareBazaar · first seen 2026-07-30T00:00:00.000Z · SHA-256 verified

Detections (3 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Microsoft Defender: Trojan:Win32/Egairtigado!rfn
Kaspersky (KVRT): Trojan-Banker.Win32.Emotet.gqex

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 11 weighted signals:

Microsoft Defender flagged Trojan:Win32/Egairtigado!rfn (rule Trojan:Win32/Egairtigado!rfn) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Banker.Win32.Emotet.gqex (rule Trojan-Banker.Win32.Emotet.gqex) - engine signal, weight 0.55, confidence 0.85
Dropped a suspicious payload: 63f844783b5c28862ebbafd04e251e1fb54b4e74643401d9c5345df0a0d12323 - dynamic signal, weight 0.50, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) at runtime (5 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded executable payload carved at offset 20480 - static signal, weight 0.40, confidence 0.70
Embedded network infrastructure: 4.0.5.0 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

55996 behavior events · 2 ATT&CK techniques · 30 dropped files.

Runtime network

www.msftconnecttest.com
inference.location.live.net
bnqyz8.oss-cn-beijing.aliyuncs.com
2026mn.oss-cn-hongkong.aliyuncs.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
ntp.ubuntu.com
desktop-hsgcbep
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786226013&P2=404&P3=2&P4=IqK%2bOFdtpk2Cj0hHA6Fj%2bN%2fUohpS7yoO%2f5cP%2fs9Y4hut7khRibgOGBNNByoPIozg4PjEXjiKbajUQpGTT7RUjw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786226033&P2=404&P3=2&P4=G3pSY8ql%2bNq2WlnDvcUCOO2gAJl1T8Yxw%2b5UMK5rRi1JyHT%2bSoUHWNJkCoWXoCP2fu6%2fu4B3tH31mA9XvJ7kBw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
23.40.52.85
20.190.167.148
23.33.238.178
52.230.59.222 SG · Singapore · AS8075 Microsoft Corporation
52.110.12.1 US · AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US

Dropped files

/opt/CAPEv2/storage/analyses/6835/files/4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a - 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
/opt/CAPEv2/storage/analyses/6835/files/63f844783b5c28862ebbafd04e251e1fb54b4e74643401d9c5345df0a0d12323 - 63f844783b5c28862ebbafd04e251e1fb54b4e74643401d9c5345df0a0d12323
/opt/CAPEv2/storage/analyses/6835/files/250d69a5eb80db0cc444d2c906b107615655971a82c041dd5545ed784612a34e - 250d69a5eb80db0cc444d2c906b107615655971a82c041dd5545ed784612a34e
/opt/CAPEv2/storage/analyses/6835/files/df6d897b5aebb0ba9449860146db53ed52aad5fb4fd31da9fde36ab0211875ac - df6d897b5aebb0ba9449860146db53ed52aad5fb4fd31da9fde36ab0211875ac
/opt/CAPEv2/storage/analyses/6835/files/0e98813f23176064bd38be9f3609b2bf44570ecc8dd5b5cc1465db8dc24427b9 - 0e98813f23176064bd38be9f3609b2bf44570ecc8dd5b5cc1465db8dc24427b9
/opt/CAPEv2/storage/analyses/6835/files/96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
/opt/CAPEv2/storage/analyses/6835/files/acbd82c4d32340fc5b1b7e6615baa516a185f0df852c70f485aa87a4d412a0a3 - acbd82c4d32340fc5b1b7e6615baa516a185f0df852c70f485aa87a4d412a0a3
/opt/CAPEv2/storage/analyses/6835/files/6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8 - 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
/opt/CAPEv2/storage/analyses/6835/files/c9ce9d0301299ccaac746ce2451a0c1e7b85d22080939c3e84e8bf3fb999f867 - c9ce9d0301299ccaac746ce2451a0c1e7b85d22080939c3e84e8bf3fb999f867
/opt/CAPEv2/storage/analyses/6835/files/11fba7180dfd8b57b9d43646a8f8edfc6ac72698244bf69b6a3b6e8a17e904b9 - 11fba7180dfd8b57b9d43646a8f8edfc6ac72698244bf69b6a3b6e8a17e904b9
/opt/CAPEv2/storage/analyses/6835/files/39cabe5cd2a8ee50f06d9db252b30f2c99f29b6c481bc7e8ef24e02c2f492f9c - 39cabe5cd2a8ee50f06d9db252b30f2c99f29b6c481bc7e8ef24e02c2f492f9c
/opt/CAPEv2/storage/analyses/6835/files/3ba1f5eb11d4dcdb8fc3801b033bf7208f88bc8b8fcb84441f4502d707895f56 - 3ba1f5eb11d4dcdb8fc3801b033bf7208f88bc8b8fcb84441f4502d707895f56
/opt/CAPEv2/storage/analyses/6835/files/4614a1c99ae00c1725438e7dee4ea814fd6a0a2151490180a1fb1e924c84ffd2 - 4614a1c99ae00c1725438e7dee4ea814fd6a0a2151490180a1fb1e924c84ffd2
7cc6fd2cbb457924b61a2dd1e8788e785387e55652d6da8086da30a3aa96bc91 - 7cc6fd2cbb457924b61a2dd1e8788e785387e55652d6da8086da30a3aa96bc91
72278853777256e20a4e4b5ff270e0f59799b5c2a5282d2675dd5ed71d5d122d - 72278853777256e20a4e4b5ff270e0f59799b5c2a5282d2675dd5ed71d5d122d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786226013&P2=404&P3=2&P4=IqK%2bOFdtpk2Cj0hHA6Fj%2bN%2fUohpS7yoO%2f5cP%2fs9Y4hut7khRibgOGBNNByoPIozg4PjEXjiKbajUQpGTT7RUjw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786226033&P2=404&P3=2&P4=G3pSY8ql%2bNq2WlnDvcUCOO2gAJl1T8Yxw%2b5UMK5rRi1JyHT%2bSoUHWNJkCoWXoCP2fu6%2fu4B3tH31mA9XvJ7kBw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

table.name
hash.name
bnqyz8.oss-cn-beijing.aliyuncs.com
2026mn.oss-cn-hongkong.aliyuncs.com

Embedded IP addresses

4.0.5.0
57.155.104.224
85.210.193.152
20.42.65.85
52.230.59.222
52.110.12.1
4.230.171.124
20.165.94.46
203.26.79.13
135.233.95.135
52.123.252.197
20.184.175.13
172.178.240.162
39.103.20.137
40.84.97.4
20.184.175.5
47.79.64.254
104.18.21.226

File paths

q:\F
s:\2j#
c:\+G

More Egairtigado samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report