MALICIOUS — 35bcc443025f622df0e121a32b7949f8ed2dd5936cb0b1673b249116b79cbe3a.exe

MALICIOUS — 35bcc443025f622df0e121a32b7949f8ed2dd5936cb0b1673b249116b79cbe3a.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the PyInstaller family. 6 of 26 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 35bcc443025f622df0e121a32b7949f8ed2dd5936cb0b1673b249116b79cbe3a
SHA-1: 8c262389973004356fda04dd69f61c74e7100432
MD5: 222ae53b9f3b4956bac7b9d0217623d9
imphash: 4ba3f97ab4d7908411ad46e497198ac7
ssdeep: 393216:BLvWqRv7Usvm1GTN570XiXMCHWUjXucuI3/PGTAI:BLeqRvvmMT/0SXMb8XDH/O7
TLSH: T1D06E33D32A9F2561D5F2E678AE144CAD0023F56E0C39A18D8D83DC2F34C453B9AB2567
Submitted as: 35bcc443025f622df0e121a32b7949f8ed2dd5936cb0b1673b249116b79cbe3a.exe
File type: pe · Size: 14309426 bytes
Verdict: malicious (95/100) · Family: PyInstaller

Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (6 of 26 engines)

capa (capabilities): beacon to command-and-control
MalwareAnalyser heuristics (entropy/packer): PyInstaller
Detect It Easy (packer/type): DIE:PyInstaller
Microsoft Defender: Trojan:Win32/Sabsik.FL.A!ml
Emsisoft (Emergency Kit): Gen:Variant.Yogi.14068
Kaspersky (KVRT): HEUR:Trojan.Python.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 95/100 is the fusion of 8 weighted signals:

Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7788) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Sabsik.FL.A!ml (rule Trojan:Win32/Sabsik.FL.A!ml) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Yogi.14068 (rule Gen:Variant.Yogi.14068) - engine signal, weight 0.55, confidence 0.85
beacon to command-and-control (rule beacon to command-and-control) - capa signal, weight 0.45, confidence 0.80
Detect It Easy (packer/type) flagged DIE:PyInstaller (rule DIE:PyInstaller) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: PyInstaller - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

5254 behavior events · 1 ATT&CK techniques · 27 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/3312/files/36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 - 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
/opt/CAPEv2/storage/analyses/3312/files/65305fa3dcbbf0efb7b4058ae0913424936e41ccee2cff591829168d9e11de22 - 65305fa3dcbbf0efb7b4058ae0913424936e41ccee2cff591829168d9e11de22
/opt/CAPEv2/storage/analyses/3312/files/6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7 - 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
/opt/CAPEv2/storage/analyses/3312/files/b465ae472049a6f7f01d9530d7f405ba5e248c60e6e12f2f720d11e2e420bfc2 - b465ae472049a6f7f01d9530d7f405ba5e248c60e6e12f2f720d11e2e420bfc2
/opt/CAPEv2/storage/analyses/3312/files/fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640 - fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
/opt/CAPEv2/storage/analyses/3312/files/7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824 - 7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824
/opt/CAPEv2/storage/analyses/3312/files/2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20 - 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
/opt/CAPEv2/storage/analyses/3312/files/78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb - 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
/opt/CAPEv2/storage/analyses/3312/files/ebc88ffa4cb510b0e417caa7243e3187f766fb32c09a803cef581e3ce9a5baa7 - ebc88ffa4cb510b0e417caa7243e3187f766fb32c09a803cef581e3ce9a5baa7
/opt/CAPEv2/storage/analyses/3312/files/f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8 - f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
/opt/CAPEv2/storage/analyses/3312/files/8c3adebf84fe112159f7fb8a572e58847fc96c8f2fb2e66da6db73b47bb5b877 - 8c3adebf84fe112159f7fb8a572e58847fc96c8f2fb2e66da6db73b47bb5b877
/opt/CAPEv2/storage/analyses/3312/files/a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4 - a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
/opt/CAPEv2/storage/analyses/3312/files/aef14cbc68a3770904887330f588ba671b817b7feda1cf851cbb6fed8553526c - aef14cbc68a3770904887330f588ba671b817b7feda1cf851cbb6fed8553526c
/opt/CAPEv2/storage/analyses/3312/files/eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a - eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
/opt/CAPEv2/storage/analyses/3312/files/ad3efdc4db4937055c3a1e9a6dec88525cf0a86df21156099b72db8b23c409aa - ad3efdc4db4937055c3a1e9a6dec88525cf0a86df21156099b72db8b23c409aa

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings

Embedded domains

schemas.microsoft.com
g.au
6.me
i.us
8.ru
www.msftconnecttest.com
searchapp.bundleassets.example
dns.msftncsi.com
config.edge.skype.com
www.bing.com
msedge.api.cdp.microsoft.com
aps.prod.windows.com
edge.microsoft.com
ecs.office.com
g.live.com
fs.microsoft.com
self.events.data.microsoft.com
www.msftncsi.com
geo.prod.do.dsp.mp.microsoft.com
geover.prod.do.dsp.mp.microsoft.com
watson.events.data.microsoft.com

More PyInstaller samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report