MALICIOUS — 23fee915a2ede0fa0ca36b1590ef0319703f58fbeaca1d5cfdef77ebf470582d.exe

MALICIOUS — 23fee915a2ede0fa0ca36b1590ef0319703f58fbeaca1d5cfdef77ebf470582d.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PowerShell family. 6 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 23fee915a2ede0fa0ca36b1590ef0319703f58fbeaca1d5cfdef77ebf470582d
• SHA-1: 162779abe15588612cdde42f43ff1aa0d2a9ec76
• MD5: d6d3bf3ffcb43ecf26ac0a5319aa75b7
• imphash: dcef13196d9946b892f62428821e6df6
• ssdeep: 3072:j0/zFkHuTJyJDwh9rxOvsq9ow7LAQqEsdUWPPhhSGc:jmJwDwh65oAAQZNWHhbc
• TLSH: T18A3E39A01017321BD6F1EC44A82CC9AE8837B1CD60319FDE4206D94D62D97F7E8F59A9
• Submitted as: 23fee915a2ede0fa0ca36b1590ef0319703f58fbeaca1d5cfdef77ebf470582d.exe
• File type: pe · Size: 144896 bytes
• Verdict: malicious (100/100) · Family: PowerShell

Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (6 of 53 engines)

• YARA: delivr.to detections: DLV_LNK_PowerShell_Launcher
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Hash: abuse.ch ThreatFox: known-malicious-hash
• Microsoft Defender: Trojan:Win32/LummaStealer.MBX!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Zusy.612899
• Kaspersky (KVRT): Trojan-PSW.MSIL.Typhon.co

MITRE ATT&CK

• T1071.001
• T1543.003
• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 18 weighted signals:

• Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 5776) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged Trojan:Win32/LummaStealer.MBX!MTB (rule Trojan:Win32/LummaStealer.MBX!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Zusy.612899 (rule Gen:Variant.Zusy.612899) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• YARA: delivr.to detections flagged DLV_LNK_PowerShell_Launcher (rule DLV_LNK_PowerShell_Launcher) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://ip-api.com/json/, https://whale-complex.site/upload/up4pc, https://discord.com/api/v9/users/@me - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

11262 behavior events · 2 ATT&CK techniques · 8 dropped files.

Runtime network

• searchapp.bundleassets.example
• staging.to-do.officeppe.com
• s-0005.dual-s-msedge.net
• teams.cloud.microsoft
• outlook.office.com
• SYD-efz.ms-acdc.office.com
• outlook.office365.com
• atm.outlook.mira.tm.svc.cloud.microsoft
• outlook.cloud.microsoft
• settings-prod-sea-2-tagged.southeastasia.cloudapp.azure.com
• www.msftconnecttest.com
• settings-prod-scus-2-tagged.southcentralus.cloudapp.azure.com
• github.com
• ln-0007.ln-msedge.net
• onedsblobvmssprdcus03.centralus.cloudapp.azure.com
• onedsblobvmssprdeus04.eastus.cloudapp.azure.com
• mr-b01.tm-azurefd.net
• onedscolprdeus13.eastus.cloudapp.azure.com
• ip-api.com
• onedscolprdeus03.eastus.cloudapp.azure.com

Dropped files

• /opt/CAPEv2/storage/analyses/3277/files/a9b52af4ee16d5dd3c70495fa7ed84cb79c10250f11b9ee6519a9070cd83a8fc - a9b52af4ee16d5dd3c70495fa7ed84cb79c10250f11b9ee6519a9070cd83a8fc
• /opt/CAPEv2/storage/analyses/3277/files/abdc201d4f065edc11a830c371a553bac12cc64a6ac33644f670bd9a58c1ec61 - abdc201d4f065edc11a830c371a553bac12cc64a6ac33644f670bd9a58c1ec61
• /opt/CAPEv2/storage/analyses/3277/files/7fde5f252aeff032e05bc43e7efb8edbab51cf4cb321e9ebfe790e04c92087b6 - 7fde5f252aeff032e05bc43e7efb8edbab51cf4cb321e9ebfe790e04c92087b6
• /opt/CAPEv2/storage/analyses/3277/files/9a1ebd6bdee3dbcaebd9d35b20e2cc9fc7112cc6e6ca084c226bda12053eceb4 - 9a1ebd6bdee3dbcaebd9d35b20e2cc9fc7112cc6e6ca084c226bda12053eceb4
• /opt/CAPEv2/storage/analyses/3277/files/756db1b96adde3cac169666d79eae15667a0cc3d59ac9df04ae9cebeb772b025 - 756db1b96adde3cac169666d79eae15667a0cc3d59ac9df04ae9cebeb772b025
• /opt/CAPEv2/storage/analyses/3277/files/96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
• /opt/CAPEv2/storage/analyses/3277/files/83fe2e7a9df89caed1174bafff80ee8c7a5c14e2614f4ca19120f22ad6181112 - 83fe2e7a9df89caed1174bafff80ee8c7a5c14e2614f4ca19120f22ad6181112
• /opt/CAPEv2/storage/analyses/3277/files/524d7e509638dc5b819df748ecb8a2e78d6ce5bad0315f14639d99864cdf59bd - 524d7e509638dc5b819df748ecb8a2e78d6ce5bad0315f14639d99864cdf59bd

Embedded URLs

• http://ip-api.com/json/
• https://whale-complex.site/upload/up4pc
• https://discord.com/api/v9/users/@me
• https://github.com/wubejack-cmd/rdp/releases/download/sdsd/chromelevator_x64.exe

Embedded domains

• ip-api.com
• whale-complex.site
• p.name
• discord.com
• c.name
• github.com
• reroute443.trafficmanager.net
• staging.to-do.officeppe.com
• s-0005.dual-s-msedge.net
• teams.cloud.microsoft
• atm.outlook.mira.tm.svc.cloud.microsoft
• outlook.cloud.microsoft
• glb.sls.prod.dcat.dsp.trafficmanager.net
• ln-0007.ln-msedge.net
• glb.api.prod.dcat.dsp.trafficmanager.net
• mr-b01.tm-azurefd.net
• mr-b02.tm-azurefd.net
• searchapp.bundleassets.example
• outlook.office.com
• syd-efz.ms-acdc.office.com
• outlook.office365.com
• settings-prod-sea-2-tagged.southeastasia.cloudapp.azure.com
• www.msftconnecttest.com
• settings-prod-scus-2-tagged.southcentralus.cloudapp.azure.com
• onedsblobvmssprdcus03.centralus.cloudapp.azure.com

Embedded IP addresses

• 23.33.238.107

File paths

• C:\Windows\System32\RuntimeBroker.exe

More PowerShell samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report