MALICIOUS — 448044e888fd0e8631ade2b543ffcf0438f392637842dbbf27da79456adfdeff

MALICIOUS — 448044e888fd0e8631ade2b543ffcf0438f392637842dbbf27da79456adfdeff is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Neyndy family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 448044e888fd0e8631ade2b543ffcf0438f392637842dbbf27da79456adfdeff
SHA-1: 5f3aa90610b9d2af1be8d1f0b5f0dff05c5c2f0a
MD5: c2615ec80e044d4e7de2ec409fd748b9
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 24576:S4QLTeOx/3hqrGBOYidT429tgNuZKvRvi90G+a9+v:S4QBBEGBOHd19Suqi65aAv
TLSH: T14D5133E2D427836CCEF17498A8CC61DDB752E9046CF0E4DA6090E9C5FE444B7DA4A349
Submitted as: 448044e888fd0e8631ade2b543ffcf0438f392637842dbbf27da79456adfdeff
File type: pe · Size: 877952 bytes
Verdict: malicious (99/100) · Family: Neyndy

Detections (6 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - dynamic signal, weight 0.80, confidence 0.90
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Contacted 39 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2358 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/12933/files/4bc80611ace27a248e5906bbb02f1acf74a1399be773465d4f83147eea97d7b5 - 4bc80611ace27a248e5906bbb02f1acf74a1399be773465d4f83147eea97d7b5
/opt/CAPEv2/storage/analyses/12933/files/bb9adb1ba943fffae08224c4d3f492b9d8aa82e527955a266d47b0330728bb4e - bb9adb1ba943fffae08224c4d3f492b9d8aa82e527955a266d47b0330728bb4e
/opt/CAPEv2/storage/analyses/12933/files/6b1c263b32804516b099fb79cd705504a824baefd8e1aaf8a9120a9322282580 - 6b1c263b32804516b099fb79cd705504a824baefd8e1aaf8a9120a9322282580
/opt/CAPEv2/storage/analyses/12933/files/7fed2b9976d1adb8577f8caffe58b195b12fa519bb3c85a0b9fb4f65072ea647 - 7fed2b9976d1adb8577f8caffe58b195b12fa519bb3c85a0b9fb4f65072ea647
/opt/CAPEv2/storage/analyses/12933/files/b59b60b6f25744d3e03fbd8fc7314dddb1ce20323388d3353162a9cfba95d36f - b59b60b6f25744d3e03fbd8fc7314dddb1ce20323388d3353162a9cfba95d36f
/opt/CAPEv2/storage/analyses/12933/files/fd3b4ef9dd6e6f135d15a2050bf8a12082a8b63799560b3f74a4f50322c115b0 - fd3b4ef9dd6e6f135d15a2050bf8a12082a8b63799560b3f74a4f50322c115b0
/opt/CAPEv2/storage/analyses/12933/files/4f10079c6e71844411f5a9b401887fdf6f49c50170b3f9b9cbe9f0a0ad2cf21d - 4f10079c6e71844411f5a9b401887fdf6f49c50170b3f9b9cbe9f0a0ad2cf21d
/opt/CAPEv2/storage/analyses/12933/files/bbb5a814b94ff9a827f2e6bff73855b8b157fc1f5b9ecf67aff5c65cbd51b948 - bbb5a814b94ff9a827f2e6bff73855b8b157fc1f5b9ecf67aff5c65cbd51b948
/opt/CAPEv2/storage/analyses/12933/files/e551e14a7bd1c1b5731018d8b74591ea497e0bf417c1748a1aa540fe5dba347c - e551e14a7bd1c1b5731018d8b74591ea497e0bf417c1748a1aa540fe5dba347c
/opt/CAPEv2/storage/analyses/12933/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
/opt/CAPEv2/storage/analyses/12933/files/02d2b75d7544f0caad40db43bc47b82d745a1f0594afc56650a6c0f29a4bfbfd - 02d2b75d7544f0caad40db43bc47b82d745a1f0594afc56650a6c0f29a4bfbfd
/opt/CAPEv2/storage/analyses/12933/files/781bfb0c14fd14621da03ece184877cbb4dd28b049f9c43de3422d69c8e593a7 - 781bfb0c14fd14621da03ece184877cbb4dd28b049f9c43de3422d69c8e593a7
/opt/CAPEv2/storage/analyses/12933/files/754d1ae014b1d709bfeeab67a42fce7384a2695a0b6cb597f26a4f7e38b75f8c - 754d1ae014b1d709bfeeab67a42fce7384a2695a0b6cb597f26a4f7e38b75f8c
/opt/CAPEv2/storage/analyses/12933/files/b1b75ba4bb42cfc3965618c69e5a3216e106c3aecec5bb2f12b8c6615eb1ee8f - b1b75ba4bb42cfc3965618c69e5a3216e106c3aecec5bb2f12b8c6615eb1ee8f
/opt/CAPEv2/storage/analyses/12933/files/1968f1e368972d85b05314325dbd7802b7d26989f39c3763d29a4cc969de948b - 1968f1e368972d85b05314325dbd7802b7d26989f39c3763d29a4cc969de948b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786535010&P2=404&P3=2&P4=eLxzWvL7ouHMjIUtj4n9ip2aWpKWDKzKbyVjX2ao9vmfBPWn5BuY1FSkNBdunO7lVkZvCyYPz%2figg96ALhMTNA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786535049&P2=404&P3=2&P4=RSJALdmMXnuRleoTf7nnt5mUGfe0JVzCHBTNmZeNxZlk8odtKCw3j3KSE3LOgV7hBhyfFvGTuTlCzZ8xTrGSDQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

74.179.71.159
20.184.175.4
52.123.252.232
4.230.171.124
20.42.179.204
52.253.84.76
57.155.104.224
74.178.76.128
135.232.92.97
4.150.223.107
40.79.150.122
203.26.79.13
74.178.76.44
172.178.240.163
20.89.1.13
20.42.73.24
72.154.7.107
52.110.12.31
52.110.12.10
52.110.12.47
52.148.114.188

More Neyndy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report