MALICIOUS — 50421a15ad2458ac9518a4c8fe3b5c8341ac87d7838327d2eb55fa94fe334a39.exe
MALICIOUS — 50421a15ad2458ac9518a4c8fe3b5c8341ac87d7838327d2eb55fa94fe334a39.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Malgent family. 6 of 26 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
50421a15ad2458ac9518a4c8fe3b5c8341ac87d7838327d2eb55fa94fe334a39 - SHA-1:
f5f2634f60b18f0eddb9edd155f89329d85315a1 - MD5:
80bd4cf388f4109cbf2ec1433a1813aa - imphash:
4ba3f97ab4d7908411ad46e497198ac7 - ssdeep:
393216:f8fOx1dQb7LbJAqC70isxaAb55XMCHWUjXscuI3/PGTAI:f+Mcb7LbA70ia75XMb8X5H/O7 - TLSH:
T1B66E339727871091DAF3F5A45C548CEDE0A3F1681C32A24CAD43EC8DA0D09775CB66AB - Submitted as: 50421a15ad2458ac9518a4c8fe3b5c8341ac87d7838327d2eb55fa94fe334a39.exe
- File type: pe · Size: 14311584 bytes
- Verdict: malicious (98/100) · Family: Malgent
Source: MalwareBazaar · first seen 2026-07-27T00:00:00.000Z · SHA-256 verified
Detections (6 of 26 engines)
- MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
- Hash: abuse.ch ThreatFox: known-malicious-hash
- Detect It Easy (packer/type): DIE:Microsoft Linker
- Microsoft Defender: Trojan:Win32/Malgent
- Emsisoft (Emergency Kit): Gen:Variant.Yogi.14068
- Kaspersky (KVRT): HEUR:Trojan.Python.Agent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 6 weighted signals:
- Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule
known-malicious-hash) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Malgent (rule
Trojan:Win32/Malgent) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Yogi.14068 (rule
Gen:Variant.Yogi.14068) - engine signal, weight 0.55, confidence 0.85 - Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
5095 behavior events · 1 ATT&CK techniques · 27 dropped files.
Runtime network
- searchapp.bundleassets.example
- www.msftconnecttest.com
- desktop-hsgcbep
- www.bing.com
- aps.prod.windows.com
- config.edge.skype.com
- tas02.sls.update.microsoft.com
- dns.msftncsi.com
- to-do.microsoft.com
- settings-win.data.microsoft.com
- ctldl.windowsupdate.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- ecs.office.com
- g.live.com
- self.events.data.microsoft.com
- msedge.api.cdp.microsoft.com
- fs.microsoft.com
- www.msftncsi.com
- geo.prod.do.dsp.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/4503/files/baa782e84d31f0ffdcec8e1b70816ab8c3395e6d2292059fd509f05cb06481e0 -
baa782e84d31f0ffdcec8e1b70816ab8c3395e6d2292059fd509f05cb06481e0 - /opt/CAPEv2/storage/analyses/4503/files/36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 -
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 - /opt/CAPEv2/storage/analyses/4503/files/12827139c6d14c25132b57753bb141ec350bd33bc1c8561a578e1677922d215c -
12827139c6d14c25132b57753bb141ec350bd33bc1c8561a578e1677922d215c - /opt/CAPEv2/storage/analyses/4503/files/0945155ed510ddc5b3a13b9bb3dc53f1eab8a9d7ef5821d8306e3490b8eb1590 -
0945155ed510ddc5b3a13b9bb3dc53f1eab8a9d7ef5821d8306e3490b8eb1590 - /opt/CAPEv2/storage/analyses/4503/files/6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7 -
6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7 - /opt/CAPEv2/storage/analyses/4503/files/bb09df93b082825789d0a083229d5f6a5d17516790dbf404374dfd36a3d80360 -
bb09df93b082825789d0a083229d5f6a5d17516790dbf404374dfd36a3d80360 - /opt/CAPEv2/storage/analyses/4503/files/fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640 -
fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640 - /opt/CAPEv2/storage/analyses/4503/files/7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824 -
7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824 - /opt/CAPEv2/storage/analyses/4503/files/52cc29192727ae565a51e107b3263e5de5b4b3884b71666611d2bd8b93f8e399 -
52cc29192727ae565a51e107b3263e5de5b4b3884b71666611d2bd8b93f8e399 - /opt/CAPEv2/storage/analyses/4503/files/2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20 -
2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20 - /opt/CAPEv2/storage/analyses/4503/files/78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb -
78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb - /opt/CAPEv2/storage/analyses/4503/files/0a08d0e08b1faf18045b0fda57d02ad652c040549df43eec03927fdf2b7cfd4c -
0a08d0e08b1faf18045b0fda57d02ad652c040549df43eec03927fdf2b7cfd4c - /opt/CAPEv2/storage/analyses/4503/files/603005f2cd324824eeb7a5a906b8ecbf28738691519c56b1b3aaa2663897d8c4 -
603005f2cd324824eeb7a5a906b8ecbf28738691519c56b1b3aaa2663897d8c4 - /opt/CAPEv2/storage/analyses/4503/files/f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8 -
f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8 - /opt/CAPEv2/storage/analyses/4503/files/a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4 -
a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
Embedded URLs
- http://schemas.microsoft.com/SMI/2016/WindowsSettings
Embedded domains
- schemas.microsoft.com
- 6.me
- i.us
- 8.ru
File paths
- o:\^2
- c:\skcIRi.
- s:\qJd=
More Malgent samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report