MALICIOUS — 55328cd52aed6e375338b394b1bb8c4a1438e52d3ddf079c316f05e764b6f72d.exe

MALICIOUS — 55328cd52aed6e375338b394b1bb8c4a1438e52d3ddf079c316f05e764b6f72d.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Malgent family. 6 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 55328cd52aed6e375338b394b1bb8c4a1438e52d3ddf079c316f05e764b6f72d
SHA-1: 29a21b6970cf47fe514bdff500d8b1d326420024
MD5: 6afcaa8ef95e2867087f41d30b3e3e1b
imphash: 4ba3f97ab4d7908411ad46e497198ac7
ssdeep: 393216:HuKq/I8AhiMztXMCHWUjX5cuI3/PGTAI:HM/I8AhvztXMb8XOH/O7
TLSH: T1716E33232A9F3250D4F3F0A8D8458DDC9153F19A2933A09D4E83ED2EA098A775DF1B51
Submitted as: 55328cd52aed6e375338b394b1bb8c4a1438e52d3ddf079c316f05e764b6f72d.exe
File type: pe · Size: 14313001 bytes
Verdict: malicious (98/100) · Family: Malgent

Source: MalwareBazaar · first seen 2026-07-27T00:00:00.000Z · SHA-256 verified

Detections (6 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
Hash: abuse.ch ThreatFox: known-malicious-hash
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Malgent
Emsisoft (Emergency Kit): Gen:Variant.Yogi.14068
Kaspersky (KVRT): HEUR:Trojan.Python.Agent.gen

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 98/100 is the fusion of 6 weighted signals:

Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Malgent (rule Trojan:Win32/Malgent) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Yogi.14068 (rule Gen:Variant.Yogi.14068) - engine signal, weight 0.55, confidence 0.85
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

5228 behavior events · 1 ATT&CK techniques · 27 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/4519/files/36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 - 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
/opt/CAPEv2/storage/analyses/4519/files/6b5867becdb74f59ad3c74da4a19002a62fbce02e45d224fa82db02c8d70b42d - 6b5867becdb74f59ad3c74da4a19002a62fbce02e45d224fa82db02c8d70b42d
/opt/CAPEv2/storage/analyses/4519/files/6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7 - 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
/opt/CAPEv2/storage/analyses/4519/files/fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640 - fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
/opt/CAPEv2/storage/analyses/4519/files/a207a29fa49de5591226f4443cf83154a6ee22e0c0b80e5c7573fbc5a6681a91 - a207a29fa49de5591226f4443cf83154a6ee22e0c0b80e5c7573fbc5a6681a91
/opt/CAPEv2/storage/analyses/4519/files/7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824 - 7e19f273192e0f5f7954e51e8799002d97bc2a480c08f6ab29d291ce79b38824
/opt/CAPEv2/storage/analyses/4519/files/2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20 - 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
/opt/CAPEv2/storage/analyses/4519/files/597e8ab963272de776ae0ed60423d01bfef3a4c5ee61c4e170985707cd19f3ef - 597e8ab963272de776ae0ed60423d01bfef3a4c5ee61c4e170985707cd19f3ef
/opt/CAPEv2/storage/analyses/4519/files/78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb - 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
/opt/CAPEv2/storage/analyses/4519/files/f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8 - f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
/opt/CAPEv2/storage/analyses/4519/files/94a3e3d13d227708437d847768a5ea25d7415709cdfd31d8298e60cafb5719bf - 94a3e3d13d227708437d847768a5ea25d7415709cdfd31d8298e60cafb5719bf
/opt/CAPEv2/storage/analyses/4519/files/a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4 - a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
/opt/CAPEv2/storage/analyses/4519/files/f460fbf51be9a0fe376742c4454b2877eccb73b4761009e3983e90c3f24b3699 - f460fbf51be9a0fe376742c4454b2877eccb73b4761009e3983e90c3f24b3699
/opt/CAPEv2/storage/analyses/4519/files/3e643fe6ddf98209dec5bcc493267700822c8647252ddf9b4db8147b5cea71d2 - 3e643fe6ddf98209dec5bcc493267700822c8647252ddf9b4db8147b5cea71d2
/opt/CAPEv2/storage/analyses/4519/files/eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a - eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings

Embedded domains

schemas.microsoft.com
o.me
wh.it
6.me
i.us
8.ru

File paths

o:\.

More Malgent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report