MALICIOUS — 58c4dcef68b267e0e26da0165a3d7115c12fa69160d453521d5ae57988597ab5

MALICIOUS — 58c4dcef68b267e0e26da0165a3d7115c12fa69160d453521d5ae57988597ab5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Neyndy family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 58c4dcef68b267e0e26da0165a3d7115c12fa69160d453521d5ae57988597ab5
SHA-1: 7dd6f93143dfb6f933de868a5b3fb7c52cb3bccf
MD5: ca8e1f389fa1a3954767bebbca413e5c
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 49152:SG38cvOs86agQNXTtpD0TPxjZ0Ru4x7w+fkQjejeP3:B3vpvagm5pQTT8MqDjAy3
TLSH: T1F75C3366DD88D205CF7E6019BE619CDC32824A87D4E7C8F790C6681B15D3E4BC2987A3
Submitted as: 58c4dcef68b267e0e26da0165a3d7115c12fa69160d453521d5ae57988597ab5
File type: pe · Size: 2415528 bytes
Verdict: malicious (99/100) · Family: Neyndy

Detections (6 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - dynamic signal, weight 0.80, confidence 0.90
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Contacted 34 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2354 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/13395/files/a4221624982097176e87d914f0c1f96f0849b7d0b5ee8ceb44a849623d26e57f - a4221624982097176e87d914f0c1f96f0849b7d0b5ee8ceb44a849623d26e57f
/opt/CAPEv2/storage/analyses/13395/files/3c0684ed8582935a1ac0d3207e96a342841e5bdaee0356afec00672eae518f6c - 3c0684ed8582935a1ac0d3207e96a342841e5bdaee0356afec00672eae518f6c
/opt/CAPEv2/storage/analyses/13395/files/450ea2116a662706351cdb6b0b09be578e29c1d6136a1bcc0d002dbb4ceff88b - 450ea2116a662706351cdb6b0b09be578e29c1d6136a1bcc0d002dbb4ceff88b
/opt/CAPEv2/storage/analyses/13395/files/33c971dfe58f2dfa1917f75cf07ccbafc41af28916950865610cc2abfd8723b3 - 33c971dfe58f2dfa1917f75cf07ccbafc41af28916950865610cc2abfd8723b3
/opt/CAPEv2/storage/analyses/13395/files/dc825137a55d938917e32f50601c5656bd42bd6cad6f97f9cbd93ea8b5d4334d - dc825137a55d938917e32f50601c5656bd42bd6cad6f97f9cbd93ea8b5d4334d
/opt/CAPEv2/storage/analyses/13395/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
/opt/CAPEv2/storage/analyses/13395/files/5ce474e6c33689ff0a6a460032dbf66efa9b8e2556112ac588ffe5a2f12b3e47 - 5ce474e6c33689ff0a6a460032dbf66efa9b8e2556112ac588ffe5a2f12b3e47
/opt/CAPEv2/storage/analyses/13395/files/4b7361f96cbf973c6796afdd188c5b5abbb255ecfaa032d7b4dff90c7667d952 - 4b7361f96cbf973c6796afdd188c5b5abbb255ecfaa032d7b4dff90c7667d952
/opt/CAPEv2/storage/analyses/13395/files/8a63daddabfdcba8f152d7e8135352734de85b47aaa13a25327c6520bdfad7d0 - 8a63daddabfdcba8f152d7e8135352734de85b47aaa13a25327c6520bdfad7d0
/opt/CAPEv2/storage/analyses/13395/files/744ac50e4087dd6ed28c826a098c43c44115712947dedbaae549ae2569317c94 - 744ac50e4087dd6ed28c826a098c43c44115712947dedbaae549ae2569317c94
/opt/CAPEv2/storage/analyses/13395/files/bd11fddcfd4385d7a26dc8c02114c742ed5347f24b43fe360916d7dc2d709ad8 - bd11fddcfd4385d7a26dc8c02114c742ed5347f24b43fe360916d7dc2d709ad8
/opt/CAPEv2/storage/analyses/13395/files/91d1c4d35430d22b637f88d9cf11f44330011d460677d8baa10a43e684a72d08 - 91d1c4d35430d22b637f88d9cf11f44330011d460677d8baa10a43e684a72d08
/opt/CAPEv2/storage/analyses/13395/files/e37b8c4b4dbb2511c0bfabc52c339565a7f0714d6b75bdba42335e1c3dd4a6b6 - e37b8c4b4dbb2511c0bfabc52c339565a7f0714d6b75bdba42335e1c3dd4a6b6
/opt/CAPEv2/storage/analyses/13395/files/e2a8964743a46d7a7ba154a968ff636278c2f1bdd00ef533f51da6580c0d0d6e - e2a8964743a46d7a7ba154a968ff636278c2f1bdd00ef533f51da6580c0d0d6e
/opt/CAPEv2/storage/analyses/13395/files/c0a214aa31d16c449d13444b1a235269f12399285c38a502a74a29f0e224e671 - c0a214aa31d16c449d13444b1a235269f12399285c38a502a74a29f0e224e671

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786546838&P2=404&P3=2&P4=CcXxdtz4kgEqUChYfirMwfiN03EIl3lF7PDsR8YfcLOGqPlRfBkxUnOiB75oewC8M5u9FNjfGUI3cjNTm0mLxw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786546893&P2=404&P3=2&P4=dCALY53v%2fpe07H3joefG7YLxtzaEKhf84ixBv4sUQDzIsWQ3WPFYNsJkOf9nSG2bS47piCseeD%2bFZIEKPUqNWg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.247.188.233
4.207.44.64
52.123.252.223
20.247.184.197
4.230.171.124
40.84.85.40
135.233.95.144
74.178.240.51
4.150.223.105
85.210.193.152
52.123.252.231
4.207.44.70
203.26.79.13
52.123.252.197
74.179.71.159
20.184.175.4
172.178.240.163
162.159.142.9
72.154.7.97
52.110.12.22
52.110.12.18
52.148.114.188

More Neyndy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report