MALICIOUS — 31e86a063a1bdb8f77d70a05c0b67ea7f962ccdd527a40311fe0debefb724375.exe

MALICIOUS — 31e86a063a1bdb8f77d70a05c0b67ea7f962ccdd527a40311fe0debefb724375.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Malgent family. 3 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 31e86a063a1bdb8f77d70a05c0b67ea7f962ccdd527a40311fe0debefb724375
SHA-1: 09b17c8374bfca50b7a634355a636f79af19e6a5
MD5: c88e46c406f6e91ac0175fc9f8efd240
imphash: 4ba3f97ab4d7908411ad46e497198ac7
ssdeep: 393216:HUuse67YdpNXtK6FQpRQwibpPkXMCHWUjXvcuI3/PGTAI:HU0RXtKkQpRQGXMb8XkH/O7
TLSH: T1D56E335A27EF2061CAF1E2A8B8048CDD40A3E15A2533E15D9D43DC2EB5C4E33D9F195A
Submitted as: 31e86a063a1bdb8f77d70a05c0b67ea7f962ccdd527a40311fe0debefb724375.exe
File type: pe · Size: 14302461 bytes
Verdict: malicious (93/100) · Family: Malgent

Source: MalwareBazaar · first seen 2026-07-30T00:00:00.000Z · SHA-256 verified

Detections (3 of 52 engines)

Microsoft Defender: Trojan:Win32/Malgent
Emsisoft (Emergency Kit): Gen:Variant.Yogi.14068
Kaspersky (KVRT): HEUR:Trojan.Python.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 93/100 is the fusion of 6 weighted signals:

Microsoft Defender flagged Trojan:Win32/Malgent (rule Trojan:Win32/Malgent) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Yogi.14068 (rule Gen:Variant.Yogi.14068) - engine signal, weight 0.55, confidence 0.85
Dropped a suspicious payload: 5da7cba9adf10575a7a673962870d2d918349b8c7b7168f51a50d85477cbdb8c - dynamic signal, weight 0.50, confidence 0.90
Contacted 33 external host(s) at runtime (13 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2777 behavior events · 1 ATT&CK techniques · 27 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/7136/files/5da7cba9adf10575a7a673962870d2d918349b8c7b7168f51a50d85477cbdb8c - 5da7cba9adf10575a7a673962870d2d918349b8c7b7168f51a50d85477cbdb8c
/opt/CAPEv2/storage/analyses/7136/files/66cfe86024dd21701ca87bfaac7f169fa10688d53c1ea1e310042527aef7b467 - 66cfe86024dd21701ca87bfaac7f169fa10688d53c1ea1e310042527aef7b467
/opt/CAPEv2/storage/analyses/7136/files/36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 - 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
/opt/CAPEv2/storage/analyses/7136/files/6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7 - 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
/opt/CAPEv2/storage/analyses/7136/files/fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640 - fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
/opt/CAPEv2/storage/analyses/7136/files/7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824 - 7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824
/opt/CAPEv2/storage/analyses/7136/files/3f581877bc9615e7c292883172b42dd25ec962e2f6d70acb45ae823bb0679a54 - 3f581877bc9615e7c292883172b42dd25ec962e2f6d70acb45ae823bb0679a54
/opt/CAPEv2/storage/analyses/7136/files/2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20 - 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
/opt/CAPEv2/storage/analyses/7136/files/5bb93cee727691953346e52338efe5052e9e96be1f426408fc30ea0b006f0090 - 5bb93cee727691953346e52338efe5052e9e96be1f426408fc30ea0b006f0090
/opt/CAPEv2/storage/analyses/7136/files/78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb - 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
/opt/CAPEv2/storage/analyses/7136/files/f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8 - f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
/opt/CAPEv2/storage/analyses/7136/files/a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4 - a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
/opt/CAPEv2/storage/analyses/7136/files/eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a - eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
/opt/CAPEv2/storage/analyses/7136/files/36a310cdd594b41b4c8502be20f667731e7f92729f39b1c9778a1558980d488e - 36a310cdd594b41b4c8502be20f667731e7f92729f39b1c9778a1558980d488e
/opt/CAPEv2/storage/analyses/7136/files/968f44b89a463c3013eaf0c29e004b767f6ccc90f9aba34868af7eac8208ca4e - 968f44b89a463c3013eaf0c29e004b767f6ccc90f9aba34868af7eac8208ca4e

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786246668&P2=404&P3=2&P4=B%2bQ5ezhKxPzJtGcGiQuWBjsA%2beTlbPFjPMreujN15exS0OQ1zPEdAExR9pABeaz21%2faffNp0AlkftgYO8%2fOQqw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786246707&P2=404&P3=2&P4=Indu1afgLqe6gGwudtuIZT2l05xxv6TzdfVQehLKotznA%2bZD3EcwUuaD2R3OuKy6F8uhXESRZWXoSXSBYU5Jlg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
s.fr
m.ua
my.ru
6.ml
6.me
i.us
8.ru

Embedded IP addresses

20.184.175.21
52.230.59.222
4.230.171.124
172.215.188.232
74.178.76.54
74.179.77.204
13.89.179.12
135.233.45.221
92.223.78.30
52.123.252.218
20.165.94.46
203.26.79.13
135.233.95.144
48.200.63.27
52.148.114.188
52.168.117.169
52.110.12.19
52.110.12.37
72.153.5.132

More Malgent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report