MALICIOUS — 1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19.exe
MALICIOUS — 1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the execute family. 7 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19 - SHA-1:
7d64a644d8a36da7188ed6ffd41e1db0cb9c35f1 - MD5:
2643d603d7ab8745978cd1ee44f18a39 - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
12288:yJqLPgI38zYLcnhfR+u/VsJLjcIGDv/wksyR50CeidRV9gRKStRiHAkY9mc97Be:Dgk8G4+muhjCDv/wkspWfIZ/E9b0BeZ - TLSH:
T1B65012CFE56C4A00D2E74491784040DCADC9AEE6E96CB7D8EB091D2306DED37845DAA3 - Submitted as: 1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19.exe
- File type: pe · Size: 807424 bytes
- Verdict: malicious (100/100) · Family: execute
Source: MalwareBazaar · first seen 2026-07-27T00:00:00.000Z · SHA-256 verified
Detections (7 of 53 engines)
- capa (capabilities): execute via PowerShell
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
- ClamAV (daily): Win.Trojan.Spynoon-9939401-0
- Hash: abuse.ch ThreatFox: known-malicious-hash
- Kaspersky (KVRT): HEUR:Backdoor.MSIL.XWorm.gen
- Microsoft Defender: Trojan:MSIL/FormBook.ABFG!MTB
- Emsisoft (Emergency Kit): Gen:Variant.AgentTesla.577
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 13 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Spynoon-9939401-0 (rule
Win.Trojan.Spynoon-9939401-0) - engine signal, weight 0.90, confidence 0.95 - Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule
known-malicious-hash) - engine signal, weight 0.90, confidence 0.95 - 1 behavioral detection(s): Defense Evasion: disable AV / Defender [high] (rule
tl-defender-tamper) - dynamic signal, weight 0.60, confidence 0.90 - 1 behavioral detection(s): Defense Evasion: disable AV / Defender [high] (rule
tl-defender-tamper) - dynamic signal, weight 0.60, confidence 0.90 - Memory forensics: 2 finding(s), e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - Contacted 50 external host(s) at runtime (6 HTTP) - network signal, weight 0.40, confidence 0.80
- Contacted 50 external host(s) at runtime (6 HTTP) - network signal, weight 0.40, confidence 0.80
- Extracted XWorm config (0 C2) - engine signal, weight 0.45, confidence 0.60
- Extracted XWorm config (0 C2) - engine signal, weight 0.45, confidence 0.60
- Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
6557 behavior events · 1 ATT&CK techniques · 14 dropped files.
Runtime network
- www.msftconnecttest.com
- searchapp.bundleassets.example
- carrenzaalwarex.ddns.net
- desktop-hsgcbep
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- tas02.sls.update.microsoft.com
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- v10.events.data.microsoft.com
- 1.0.240.10.in-addr.arpa
- 157.37.11.23.in-addr.arpa
- 165.142.190.20.in-addr.arpa
- settings-win.data.microsoft.com
- 101.223.150.4.in-addr.arpa
- 212.101.155.57.in-addr.arpa
- 251.0.0.224.in-addr.arpa
Dropped files
- /opt/CAPEv2/storage/analyses/3807/files/4905a7b2929d78ca807060dbb2319dca2f3466c50fc175e4ff08cc0939bca49b -
4905a7b2929d78ca807060dbb2319dca2f3466c50fc175e4ff08cc0939bca49b - c6ea2b2bcc8bcd077386e6e655bcb856b2fb2d881b7532b8a8a34f88f77b3ff1 -
c6ea2b2bcc8bcd077386e6e655bcb856b2fb2d881b7532b8a8a34f88f77b3ff1 - b618b01e5e4e7945e747575bf0d4f4ab0b173eb2921a6bcdeb321caff4b426de -
b618b01e5e4e7945e747575bf0d4f4ab0b173eb2921a6bcdeb321caff4b426de - 47a856ff7d9bf14949f9a1deed4ba4ec9495a9ef95ee41ba6d78f630561d166c -
47a856ff7d9bf14949f9a1deed4ba4ec9495a9ef95ee41ba6d78f630561d166c - 8fcf43f044d305ac1186be597dad18c2549688b0c26744a81021a7cd9eca8602 -
8fcf43f044d305ac1186be597dad18c2549688b0c26744a81021a7cd9eca8602 - 166c43c485860abcbddc8d17100f864bbd3a4d1b0c9bf902033863f89dee6237 -
166c43c485860abcbddc8d17100f864bbd3a4d1b0c9bf902033863f89dee6237 - 706785a27684fb951d30e9cecca9f6c88e80d83ef991fb122bd4cd39108da65e -
706785a27684fb951d30e9cecca9f6c88e80d83ef991fb122bd4cd39108da65e - e689b74e1e038ca4a8aeaba0d2175a3d224066c40e22d172bc8c1c923c95af7f -
e689b74e1e038ca4a8aeaba0d2175a3d224066c40e22d172bc8c1c923c95af7f - 06b26ae259a73e76e0f4dbe0fb02d9e66955b6759f0a944392d212f310ef9a07 -
06b26ae259a73e76e0f4dbe0fb02d9e66955b6759f0a944392d212f310ef9a07 - a43a3d985ac4ba4f278d4345170b65e0bc206d2e7708dc108ceb6acd43049350 -
a43a3d985ac4ba4f278d4345170b65e0bc206d2e7708dc108ceb6acd43049350 - f2d13d2ec3aa58532fd06afdd977571e466f8c6e3ba0d900327abe34d1f33762 -
f2d13d2ec3aa58532fd06afdd977571e466f8c6e3ba0d900327abe34d1f33762 - d89574bdd508f1ea0045ef9ccbabff5de7a5cf969c3a7983c5b5a8303afed73a -
d89574bdd508f1ea0045ef9ccbabff5de7a5cf969c3a7983c5b5a8303afed73a - 7e29564687f81ca2a922064ab6aef2ea4339ec5975a4f308212309bfa9dba0c1 -
7e29564687f81ca2a922064ab6aef2ea4339ec5975a4f308212309bfa9dba0c1 - a8b16b6679e936d08ff68cd36ce8c78873c98a25dd650212e06f8616798c9266 -
a8b16b6679e936d08ff68cd36ce8c78873c98a25dd650212e06f8616798c9266
Embedded domains
- carrenzaalwarex.ddns.net
Embedded IP addresses
- 142.250.207.14
- 135.232.92.137
- 23.40.52.85
- 151.101.30.172
- 4.150.223.101
- 4.247.188.233
- 23.11.37.157
- 57.155.101.212
- 23.40.52.209
- 74.179.77.204
- 4.150.223.98
- 199.232.138.172
- 20.190.142.165
- 23.214.54.132
- 48.211.4.16
- 102.220.160.204
- 72.145.35.113
- 203.26.79.13
- 20.165.94.46
- 172.172.255.218
- 23.221.133.182
- 20.184.175.7
- 172.172.255.217
- 23.40.52.148
- 23.40.52.123
File paths
- Z:\z\
- s:\uvb
More execute samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report