MALICIOUS — 555e5544368694f5726c77cf1a12e3f2d6d57479a00c462476ec552312a753a4.exe

MALICIOUS — 555e5544368694f5726c77cf1a12e3f2d6d57479a00c462476ec552312a753a4.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PowerShell family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 555e5544368694f5726c77cf1a12e3f2d6d57479a00c462476ec552312a753a4
SHA-1: 95f00f95c96284adab1d7852e67fdcbb6445bba3
MD5: 3f577fe3546869bd9ea1f185c6646544
imphash: dcef13196d9946b892f62428821e6df6
ssdeep: 3072:30/zFkHuTJyJDwh9rxOvsq9ow7LAsqMsdUWPPhhSGc:3mJwDwh65oAAsRNWHhbc
TLSH: T1FD3E39A01017321BD6F1EC44A82CC9AE8837B1CD60319FDE4206D94D62D97F7E8F59A9
Submitted as: 555e5544368694f5726c77cf1a12e3f2d6d57479a00c462476ec552312a753a4.exe
File type: pe · Size: 144896 bytes
Verdict: malicious (100/100) · Family: PowerShell

Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (6 of 52 engines)

YARA: delivr.to detections: DLV_LNK_PowerShell_Launcher
YARA: Yara-Rules community: YR_AntiDebug_Checks
Hash: abuse.ch ThreatFox: known-malicious-hash
Microsoft Defender: Trojan:Win32/LummaStealer.MBX!MTB
Emsisoft (Emergency Kit): Trojan.Generic.40333049
Kaspersky (KVRT): Trojan-PSW.MSIL.Typhon.cn

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 6420) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/LummaStealer.MBX!MTB (rule Trojan:Win32/LummaStealer.MBX!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Generic.40333049 (rule Trojan.Generic.40333049) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
YARA: delivr.to detections flagged DLV_LNK_PowerShell_Launcher (rule DLV_LNK_PowerShell_Launcher) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://ip-api.com/json/, https://whale-complex.site/upload/build_01, https://discord.com/api/v9/users/@me - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

11198 behavior events · 2 ATT&CK techniques · 8 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/3377/files/0e6aeddc51a3f29f9e19c0db12dd240fb9b93e10aece3be9976443ef0fd20e1f - 0e6aeddc51a3f29f9e19c0db12dd240fb9b93e10aece3be9976443ef0fd20e1f
/opt/CAPEv2/storage/analyses/3377/files/b6a13a5d38157cf93f9b2528c3f32b40a9ce4ad66e981ddb6bca6cda8d95943d - b6a13a5d38157cf93f9b2528c3f32b40a9ce4ad66e981ddb6bca6cda8d95943d
/opt/CAPEv2/storage/analyses/3377/files/7fde5f252aeff032e05bc43e7efb8edbab51cf4cb321e9ebfe790e04c92087b6 - 7fde5f252aeff032e05bc43e7efb8edbab51cf4cb321e9ebfe790e04c92087b6
/opt/CAPEv2/storage/analyses/3377/files/9a1ebd6bdee3dbcaebd9d35b20e2cc9fc7112cc6e6ca084c226bda12053eceb4 - 9a1ebd6bdee3dbcaebd9d35b20e2cc9fc7112cc6e6ca084c226bda12053eceb4
/opt/CAPEv2/storage/analyses/3377/files/fce778cbc98357d9eb10bdb2b536df40ba7abafea9001b41e4e38f1b99b1a536 - fce778cbc98357d9eb10bdb2b536df40ba7abafea9001b41e4e38f1b99b1a536
/opt/CAPEv2/storage/analyses/3377/files/9625f3739178e3e5d30e03b8441da35cf13da9dc35ecbd7dfb646caf366fd0cd - 9625f3739178e3e5d30e03b8441da35cf13da9dc35ecbd7dfb646caf366fd0cd
/opt/CAPEv2/storage/analyses/3377/files/96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
/opt/CAPEv2/storage/analyses/3377/files/524d7e509638dc5b819df748ecb8a2e78d6ce5bad0315f14639d99864cdf59bd - 524d7e509638dc5b819df748ecb8a2e78d6ce5bad0315f14639d99864cdf59bd

Embedded URLs

http://ip-api.com/json/
https://whale-complex.site/upload/build_01
https://discord.com/api/v9/users/@me
https://github.com/wubejack-cmd/rdp/releases/download/sdsd/chromelevator_x64.exe

Embedded domains

ip-api.com
whale-complex.site
p.name
discord.com
c.name
github.com
www.msftconnecttest.com
config.edge.skype.com
dns.msftncsi.com
watson.events.data.microsoft.com
msedge.api.cdp.microsoft.com
aps.prod.windows.com
ecs.office.com
g.live.com
www.msftncsi.com
self.events.data.microsoft.com
fs.microsoft.com
geo.prod.do.dsp.mp.microsoft.com
geover.prod.do.dsp.mp.microsoft.com

File paths

C:\Windows\System32\RuntimeBroker.exe

More PowerShell samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report