MALICIOUS — 41d4cb022a1e382d26b6361562d75d4d8a03150a8d089c3dccae6b4b6c1061e3.exe
MALICIOUS — 41d4cb022a1e382d26b6361562d75d4d8a03150a8d089c3dccae6b4b6c1061e3.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Malgent family. 7 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
41d4cb022a1e382d26b6361562d75d4d8a03150a8d089c3dccae6b4b6c1061e3 - SHA-1:
af69d56bbbefdc9b46b34178e9ee9a09689a9693 - MD5:
9ed39d4187f83ab46780543e7cb9b964 - imphash:
8d981b368e8d95268bfe3f4a0860238a - ssdeep:
49152:4VwASOuGtlqgXPSI3YAicNzYekvruCGxU0SOGRnUYGhLCRKCiNHABrFb1kFnpCR:63vN0sxzKZPBUCRut3et0ceswz+ndaW - TLSH:
T104648D21465B2111E5F6D411BC108EECC8B6B06C6A35E99E5303EC1BE1BDE37E1E61AC - Submitted as: 41d4cb022a1e382d26b6361562d75d4d8a03150a8d089c3dccae6b4b6c1061e3.exe
- File type: pe · Size: 5418496 bytes
- Verdict: malicious (94/100) · Family: Malgent
Source: MalwareBazaar · first seen 2026-07-27T00:00:00.000Z · SHA-256 verified
Detections (7 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
- YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
- YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
- Detect It Easy (packer/type): DIE:Microsoft Linker
- Microsoft Defender: Trojan:Win32/Malgent
- Emsisoft (Emergency Kit): Gen:Variant.Yogi.34600
- Kaspersky (KVRT): UDS:Trojan.Win32.Scar
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 11 weighted signals:
- Microsoft Defender flagged Trojan:Win32/Malgent (rule
Trojan:Win32/Malgent) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Yogi.34600 (rule
Gen:Variant.Yogi.34600) - engine signal, weight 0.55, confidence 0.85 - YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule
ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70 - YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule
STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: 1.101.3.4, 12.2.2.8, 12.2.1.16 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (15 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
65 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- searchapp.bundleassets.example
- www.msftconnecttest.com
- desktop-hsgcbep
- www.bing.com
- config.edge.skype.com
- dns.msftncsi.com
- settings-win.data.microsoft.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- aps.prod.windows.com
- ecs.office.com
- g.live.com
- fs.microsoft.com
- www.msftncsi.com
- self.events.data.microsoft.com
- msedge.api.cdp.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- 169.254.59.211
- 192.168.122.105
- 192.168.122.1
Embedded URLs
- https://github.com/dot-asm
- http://schemas.microsoft.com/SMI/2020/WindowsSettings
Embedded domains
- github.com
- schemas.microsoft.com
Embedded IP addresses
- 1.101.3.4
- 12.2.2.8
- 12.2.1.16
- 5.3.1.9
- 61.1.1.1
- 1.9.16.3
- 31.56.184.213
File paths
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\include\internal/packet.h
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\include\internal/ring_buf.h
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\crypto\err\err_local.h
- C:\Program
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/kem/ec_kem.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/digests/sha2_prov.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/digests/sha3_prov.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/digests/cshake_prov.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/digests/blake2_prov.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/digests/ml_dsa_mu_prov.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/ciphers/cipher_null.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers\implementations\ciphers\cipher_aes_cts.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/ciphers/cipher_aes_xts.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/ciphers/cipher_aes_ocb.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/ciphers/cipher_aes_wrp.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/ciphers/cipher_aes_cbc_hmac_sha.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers\implementations\ciphers\cipher_camellia_cts.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/ciphers/cipher_sm4_xts.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/ciphers/cipher_chacha20.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/ciphers/cipher_chacha20_poly1305.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/ciphers/cipher_aes_siv.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/ciphers/cipher_aes_gcm_siv.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers\implementations\include\prov/blake2_params.inc
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers\implementations\macs\blake2_mac_impl.c
- D:\CFILES\Projects\WinSSL\build\versions\4.0\4.0.1\temp_x64\providers/implementations/macs/cmac_prov.inc
More Malgent samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report