MALICIOUS — 3c8c1d7684efd4edf61207179a7893ecea46dc49a26eed378f5197a5340182c3.exe
MALICIOUS — 3c8c1d7684efd4edf61207179a7893ecea46dc49a26eed378f5197a5340182c3.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Malgent family. 4 of 24 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
3c8c1d7684efd4edf61207179a7893ecea46dc49a26eed378f5197a5340182c3 - SHA-1:
4081a567b593f51ca6c8d98902311e872513ccd6 - MD5:
baff942fdabd6c068b3e941dd29fddad - imphash:
4ba3f97ab4d7908411ad46e497198ac7 - ssdeep:
393216:Hq6Vl1Ojw6B7gLoeunwWHGEjFBKjqguXMCHWUjX9cuI3/PGTAI:HFOjw6ZXeXWHGQguXMb8XKH/O7 - TLSH:
T1BE6E3307564F71E1C9E2F5A8E494DD6DA093F08A1D37E18A8E83DD1F90848339CF265A - Submitted as: 3c8c1d7684efd4edf61207179a7893ecea46dc49a26eed378f5197a5340182c3.exe
- File type: pe · Size: 14327499 bytes
- Verdict: malicious (98/100) · Family: Malgent
Source: MalwareBazaar · first seen 2026-07-30T00:00:00.000Z · SHA-256 verified
Detections (4 of 24 engines)
- Hash: abuse.ch ThreatFox: known-malicious-hash
- Microsoft Defender: Trojan:Win32/Malgent
- Emsisoft (Emergency Kit): Gen:Variant.Yogi.14068
- Kaspersky (KVRT): HEUR:Trojan.Python.Agent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 5 weighted signals:
- Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule
known-malicious-hash) - engine signal, weight 0.90, confidence 0.95 - Dropped a malicious payload: 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 - dynamic signal, weight 0.80, confidence 0.90
- Contacted 35 external host(s) at runtime (12 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1622 - dynamic signal, weight 0.40, confidence 0.75
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
2823 behavior events · 1 ATT&CK techniques · 27 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- v20.events.data.microsoft.com
- desktop-hsgcbep
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- assets.msn.com
- msedge.api.cdp.microsoft.com
- www.bing.com
- geo.prod.do.dsp.mp.microsoft.com
- kv801.prod.do.dsp.mp.microsoft.com
- cp801.prod.do.dsp.mp.microsoft.com
- dl.delivery.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/7240/files/36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 -
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 - /opt/CAPEv2/storage/analyses/7240/files/6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7 -
6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7 - /opt/CAPEv2/storage/analyses/7240/files/b001e156dde48e12880f258d4e092fbb3f814b1e9984167a732cf0fa01eea671 -
b001e156dde48e12880f258d4e092fbb3f814b1e9984167a732cf0fa01eea671 - /opt/CAPEv2/storage/analyses/7240/files/11c2130a57511ce7da1fe75059da39a2fc6ebcc7ce91877b44f577afe2e8f88c -
11c2130a57511ce7da1fe75059da39a2fc6ebcc7ce91877b44f577afe2e8f88c - /opt/CAPEv2/storage/analyses/7240/files/fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640 -
fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640 - /opt/CAPEv2/storage/analyses/7240/files/83408f36fd8b529b2707e3224973ffea155aea973d2451950c2854f8801222b7 -
83408f36fd8b529b2707e3224973ffea155aea973d2451950c2854f8801222b7 - /opt/CAPEv2/storage/analyses/7240/files/7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824 -
7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824 - /opt/CAPEv2/storage/analyses/7240/files/3a2b6a0727630cf30184044dc04eb7d725cdee37a4abf503cc1cdca70f55ed99 -
3a2b6a0727630cf30184044dc04eb7d725cdee37a4abf503cc1cdca70f55ed99 - /opt/CAPEv2/storage/analyses/7240/files/2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20 -
2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20 - /opt/CAPEv2/storage/analyses/7240/files/78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb -
78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb - /opt/CAPEv2/storage/analyses/7240/files/97559e4c8931996dd7294e96269668e7909117a5921d1be4c11609b19317c1f9 -
97559e4c8931996dd7294e96269668e7909117a5921d1be4c11609b19317c1f9 - /opt/CAPEv2/storage/analyses/7240/files/f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8 -
f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8 - /opt/CAPEv2/storage/analyses/7240/files/a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4 -
a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4 - /opt/CAPEv2/storage/analyses/7240/files/eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a -
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a - /opt/CAPEv2/storage/analyses/7240/files/4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43 -
4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
Embedded URLs
- http://schemas.microsoft.com/SMI/2016/WindowsSettings
- http://www.msftconnecttest.com/connecttest.txt
Embedded domains
- schemas.microsoft.com
- 6.tw
- r.pl
- xp.hk
- y.gg
- 6.me
- i.us
- 8.ru
Embedded IP addresses
- 20.184.175.4
- 4.230.171.124
- 20.42.179.204
- 20.247.184.142
- 74.178.232.29
- 135.233.95.135
- 135.232.92.137
- 52.168.112.66
- 135.234.160.245
- 92.223.78.30
- 172.175.111.170
- 20.184.175.8
- 52.123.252.241
- 72.145.35.101
- 52.110.12.10
- 52.110.12.55
- 20.184.175.2
- 4.150.223.96
- 52.123.252.234
- 52.148.114.188
- 52.110.12.54
- 52.110.12.32
File paths
- y:\y4
- W:\Vh
More Malgent samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report