MALICIOUS — 1ac0570ceb2f538a1f124e2d80b9bb279a13a71a134ff4759355762a4abe5e26.exe

MALICIOUS — 1ac0570ceb2f538a1f124e2d80b9bb279a13a71a134ff4759355762a4abe5e26.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Malgent family. 4 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 1ac0570ceb2f538a1f124e2d80b9bb279a13a71a134ff4759355762a4abe5e26
• SHA-1: cb2a2557af090e6bcd0a423b443122dd4b45adf2
• MD5: 9df61f1a2019a33e3b47ce2e258913f6
• imphash: 42492c8bc2aad1800e134cedaf5754c9
• ssdeep: 98304:e1gt1TICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllzHbMrwh6az:R1TICteErownP0oTcMsABqlGUcE
• TLSH: T1C365331642027392EEF3E960EC809D4D8463B6986872D59C6987CD5E30E9D33E8F0A57
• Submitted as: 1ac0570ceb2f538a1f124e2d80b9bb279a13a71a134ff4759355762a4abe5e26.exe
• File type: pe · Size: 5628241 bytes
• Verdict: malicious (99/100) · Family: Malgent

Source: MalwareBazaar · first seen 2026-07-31T00:00:00.000Z · SHA-256 verified

Detections (4 of 52 engines)

• Hash: abuse.ch ThreatFox: known-malicious-hash
• Microsoft Defender: Trojan:Win32/Malgent
• Emsisoft (Emergency Kit): Gen:Variant.Adware.Yogi.1551
• Kaspersky (KVRT): Trojan-Dropper.Win32.Sysn.dfsi

MITRE ATT&CK

• T1112
• T1105

Why this verdict

The malicious score of 99/100 is the fusion of 6 weighted signals:

• Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
• Dropped a malicious payload (HUILoader): 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - dynamic signal, weight 0.80, confidence 0.90
• Microsoft Defender flagged Trojan:Win32/Malgent (rule Trojan:Win32/Malgent) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.Yogi.1551 (rule Gen:Variant.Adware.Yogi.1551) - engine signal, weight 0.55, confidence 0.85
• Anti-analysis: T1622 - dynamic signal, weight 0.40, confidence 0.75
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

16382 behavior events · 1 ATT&CK techniques · 15 dropped files.

Runtime network

• www.msftconnecttest.com
• searchapp.bundleassets.example
• t.me
• www.tiktok.com
• www.facebook.com
• go-ns.org.ua
• ifconfig.me
• desktop-hsgcbep
• ctldl.windowsupdate.com
• config.edge.skype.com
• www.bing.com
• dns.msftncsi.com
• watson.events.data.microsoft.com
• edge.microsoft.com
• msedge.api.cdp.microsoft.com
• aefd.nelreports.net
• www.msftncsi.com
• time.windows.com
• geo.prod.do.dsp.mp.microsoft.com
• geover.prod.do.dsp.mp.microsoft.com

Dropped files

• /opt/CAPEv2/storage/analyses/7888/files/8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 - 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
• /opt/CAPEv2/storage/analyses/7888/files/ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e - ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
• /opt/CAPEv2/storage/analyses/7888/files/75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902 - 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
• /opt/CAPEv2/storage/analyses/7888/files/e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae - e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
• /opt/CAPEv2/storage/analyses/7888/files/664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2 - 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
• /opt/CAPEv2/storage/analyses/7888/files/cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f - cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
• /opt/CAPEv2/storage/analyses/7888/files/b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf - b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
• /opt/CAPEv2/storage/analyses/7888/files/e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d - e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
• /opt/CAPEv2/storage/analyses/7888/files/acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142 - acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
• /opt/CAPEv2/storage/analyses/7888/files/5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf - 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
• /opt/CAPEv2/storage/analyses/7888/files/4413490fe5d5ab6ba9d3c5209f56a602961b5f99f0b605d2c35b9d4e457419ce - 4413490fe5d5ab6ba9d3c5209f56a602961b5f99f0b605d2c35b9d4e457419ce
• /opt/CAPEv2/storage/analyses/7888/files/2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3 - 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
• /opt/CAPEv2/storage/analyses/7888/files/3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204 - 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
• /opt/CAPEv2/storage/analyses/7888/files/9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce - 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
• e0dce89448a20f90ad99e2ffd2ed4759664cd9f52791a42708c314c95159c33b - e0dce89448a20f90ad99e2ffd2ed4759664cd9f52791a42708c314c95159c33b

Embedded URLs

• http://schemas.microsoft.com/SMI/2016/WindowsSettings

Embedded domains

• schemas.microsoft.com
• 8.gq
• t.me
• www.tiktok.com
• go-ns.org.ua
• aefd.nelreports.net
• ifconfig.me

File paths

• G:\($
• Y:\bG
• m:\0HCp

More Malgent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report