MALICIOUS — 3a0ecd128bddb650c684af39de612fb50953c76e1be4677afff1b0a3ae7e01f8.exe

MALICIOUS — 3a0ecd128bddb650c684af39de612fb50953c76e1be4677afff1b0a3ae7e01f8.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PyInstaller family. 7 of 26 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 3a0ecd128bddb650c684af39de612fb50953c76e1be4677afff1b0a3ae7e01f8
SHA-1: d37a15e402c7d41e6139e563ff0f9696cf288a94
MD5: f19a0eda7ff0268f6c6faccfdce0879e
imphash: 4ba3f97ab4d7908411ad46e497198ac7
ssdeep: 393216:Af3QH6q+q9U1hsaR1JbKKjHNNf9HNThCXMCHWUjXdcuI3/PGTAI:APO/Om21bPf9tTYXMb8XqH/O7
TLSH: T1DB6E331A235F32C0C9F2D56499409C9CD013F5AE2632D29D5E83ED5EB0C867358F2A9B
Submitted as: 3a0ecd128bddb650c684af39de612fb50953c76e1be4677afff1b0a3ae7e01f8.exe
File type: pe · Size: 14273883 bytes
Verdict: malicious (100/100) · Family: PyInstaller

Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (7 of 26 engines)

capa (capabilities): beacon to command-and-control
MalwareAnalyser heuristics (entropy/packer): PyInstaller
Hash: abuse.ch ThreatFox: known-malicious-hash
Detect It Easy (packer/type): DIE:PyInstaller
Microsoft Defender: Trojan:Win32/Malgent
Emsisoft (Emergency Kit): Gen:Variant.Yogi.14068
Kaspersky (KVRT): HEUR:Trojan.Python.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8136) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Malgent (rule Trojan:Win32/Malgent) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Yogi.14068 (rule Gen:Variant.Yogi.14068) - engine signal, weight 0.55, confidence 0.85
beacon to command-and-control (rule beacon to command-and-control) - capa signal, weight 0.45, confidence 0.80
Contacted 48 external host(s) at runtime (33 HTTP) - network signal, weight 0.40, confidence 0.80
Contacted 48 external host(s) at runtime (33 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:PyInstaller (rule DIE:PyInstaller) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: PyInstaller - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

5103 behavior events · 1 ATT&CK techniques · 27 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/3321/files/ddd1d0065cb7bbe8bde85e694934016b8f4a1c47db253eb4ad8135e4702a2ae9 - ddd1d0065cb7bbe8bde85e694934016b8f4a1c47db253eb4ad8135e4702a2ae9
/opt/CAPEv2/storage/analyses/3321/files/36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 - 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
/opt/CAPEv2/storage/analyses/3321/files/6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7 - 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
/opt/CAPEv2/storage/analyses/3321/files/fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640 - fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
/opt/CAPEv2/storage/analyses/3321/files/7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824 - 7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824
/opt/CAPEv2/storage/analyses/3321/files/2d3ebf903f933998ee1b985f28fa1d3c15dbb482d45b3ff468d04b5d9451f986 - 2d3ebf903f933998ee1b985f28fa1d3c15dbb482d45b3ff468d04b5d9451f986
/opt/CAPEv2/storage/analyses/3321/files/2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20 - 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
/opt/CAPEv2/storage/analyses/3321/files/78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb - 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
/opt/CAPEv2/storage/analyses/3321/files/69e6e3d9125ab44d3dd4fcdfee9cc48e542e00045c1a5bdadee1d0de85753843 - 69e6e3d9125ab44d3dd4fcdfee9cc48e542e00045c1a5bdadee1d0de85753843
/opt/CAPEv2/storage/analyses/3321/files/2f72f263ec788a902e3542e19b5b84d95e50cc53394ca178ffe55a02dc67b8e5 - 2f72f263ec788a902e3542e19b5b84d95e50cc53394ca178ffe55a02dc67b8e5
/opt/CAPEv2/storage/analyses/3321/files/4ec2c2483ca5e35f7fdc914c9e9f1cac00e408d46adee9acfa352a8ea6c63562 - 4ec2c2483ca5e35f7fdc914c9e9f1cac00e408d46adee9acfa352a8ea6c63562
/opt/CAPEv2/storage/analyses/3321/files/f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8 - f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
/opt/CAPEv2/storage/analyses/3321/files/a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4 - a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
/opt/CAPEv2/storage/analyses/3321/files/eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a - eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
/opt/CAPEv2/storage/analyses/3321/files/4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43 - 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/92621512-d997-4742-9ae0-db0593ed93c6/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/92621512-d997-4742-9ae0-db0593ed93c6?P1=1785834062&P2=404&P3=2&P4=CcjOrGQX%2bMTTGCD5qpnbD6uWxoh6JRmx%2b%2bMTxz2TA5DmSper0Ctrj7eausGCFvX9Z%2fQy9HsgexQvcItL5IsCDw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/095b6cce-5952-42aa-a19f-9268ce8ce016/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/095b6cce-5952-42aa-a19f-9268ce8ce016?P1=1785834091&P2=404&P3=2&P4=XIhysU6in1pIv1MsJ4G3Okvb%2fbcYEM2Iu2XYRcGLuzHhiX78CEWzUzUbIrTQTkmfGLAPl8X8f4tx9SKlyQC%2fvA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://192.168.122.106:58969/>V]\x00U
http://203.26.79.13/filestreamingservice//files/0f1c0c50-b501-4e58-9b56-1b1ab85d76a2/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/0f1c0c50-b501-4e58-9b56-1b1ab85d76a2?P1=1785230449&P2=404&P3=2&P4=GaoCXcUZnEnDyqOtoYTcHPAD9UZYXkT0GBEuKalLkfBP0O02xZ0wayr57YD1KCASIFxDmTWJsr9XEO%2b6mKK61Q%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785230803&P2=404&P3=2&P4=SJF1scoFmBXizTrEZjP2TFHNK%2b8%2f9KdJfJHbAtj%2bAl01%2bub7BhQsd7MSd4XO%2bofYLOhnfm8MMsoI0zzH1xIPRA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
64.cc
a.ly
y.io
7s.us
u.fr
6.me
i.us
8.ru
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.cloud.microsoft
oneclient.sfx.ms
to-do.office.com
outlook.office.com
outlook.office365.com
www.msftconnecttest.com
www.bing.com
config.edge.skype.com
dns.msftncsi.com
tas02.sls.update.microsoft.com
aps.prod.windows.com
ctldl.windowsupdate.com
ocsp.digicert.com
officeclient.microsoft.com

Embedded IP addresses

150.171.22.17
23.33.238.102
135.233.95.144
150.171.109.25
172.64.154.167
52.110.12.49
20.42.73.24
57.155.101.212
23.221.133.185
52.98.142.210
20.236.44.162
52.98.143.82
52.123.129.14
52.98.8.34
204.79.197.203
52.123.128.14
23.11.37.157
23.40.52.209
23.40.52.85
172.178.240.161
74.178.240.51
20.42.72.131
203.26.79.13
20.165.94.46
51.105.71.136

File paths

k:\g

More PyInstaller samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report