MALICIOUS — 6414a3635380ca1f3ae2c2fcda43f16d3d398e4344520deb7e09b04d93960037.bin
MALICIOUS — 6414a3635380ca1f3ae2c2fcda43f16d3d398e4344520deb7e09b04d93960037.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the Phonzy family. 4 of 25 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
6414a3635380ca1f3ae2c2fcda43f16d3d398e4344520deb7e09b04d93960037 - SHA-1:
cb8408d837c77cae0184698a25ac22f0b931df90 - MD5:
9cd15c3cb87b702cd6438a1665f93a3b - imphash:
4ba3f97ab4d7908411ad46e497198ac7 - ssdeep:
196608:PhHAE1t6LtbW897GJr1LDsBTG9WdnW1/zwirkDCMPWhFWQGa/R6O:ZHF1e1S3sB1ErWDzCFWQhAO - TLSH:
T1A66D3355018536C1EEE5D9648CC58C6D68F3E6ED163AB41DF943CC2E34A1CA3ABB0AC4 - Submitted as: 6414a3635380ca1f3ae2c2fcda43f16d3d398e4344520deb7e09b04d93960037.bin
- File type: pe · Size: 12509804 bytes
- Verdict: malicious (87/100) · Family: Phonzy
Source: MalShare · first seen 2026-08-03T20:22:29.325Z · SHA-256 verified
Detections (4 of 25 engines)
- MalwareAnalyser heuristics (entropy/packer): PyInstaller
- YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
- Detect It Easy (packer/type): DIE:PyInstaller
- Microsoft Defender: Trojan:Win32/Phonzy.B!ml
MITRE ATT&CK
Why this verdict
The malicious score of 87/100 is the fusion of 6 weighted signals:
- Microsoft Defender flagged Trojan:Win32/Phonzy.B!ml (rule
Trojan:Win32/Phonzy.B!ml) - engine signal, weight 0.55, confidence 0.85 - Dropped a suspicious payload: 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723 - dynamic signal, weight 0.50, confidence 0.90
- YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule
ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:PyInstaller (rule
DIE:PyInstaller) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: PyInstaller - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
24460 behavior events · 1 ATT&CK techniques · 99 dropped files.
Runtime network
- www.msftconnecttest.com
- searchapp.bundleassets.example
- desktop-hsgcbep
- ctldl.windowsupdate.com
- config.edge.skype.com
- www.bing.com
- msedge.api.cdp.microsoft.com
- watson.events.data.microsoft.com
- dns.msftncsi.com
- edge.microsoft.com
- aefd.nelreports.net
- www.msftncsi.com
- time.windows.com
- geover.prod.do.dsp.mp.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- 192.168.122.112
- 224.0.0.252
- 192.168.122.1
- 192.168.122.255
- 192.168.122.105
Dropped files
- /opt/CAPEv2/storage/analyses/9141/files/1548988458bbf0dfccc23b7487cec0e9c64e4cc8e045723e50bec37c454a8c81 -
1548988458bbf0dfccc23b7487cec0e9c64e4cc8e045723e50bec37c454a8c81 - /opt/CAPEv2/storage/analyses/9141/files/b54215edddcbf3c2ba13cb4ba16fa9a152a035b75a4aacfddfa46d1581f2db42 -
b54215edddcbf3c2ba13cb4ba16fa9a152a035b75a4aacfddfa46d1581f2db42 - /opt/CAPEv2/storage/analyses/9141/files/3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723 -
3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723 - /opt/CAPEv2/storage/analyses/9141/files/a33b1562acc8201411971f54444bd9c648f2d194d9914f0eb734904882213828 -
a33b1562acc8201411971f54444bd9c648f2d194d9914f0eb734904882213828 - /opt/CAPEv2/storage/analyses/9141/files/062e31d48dc33160999074e49205e08c3655dff91c2c87f254522e6ebce2dd96 -
062e31d48dc33160999074e49205e08c3655dff91c2c87f254522e6ebce2dd96 - /opt/CAPEv2/storage/analyses/9141/files/087f597d223a0835262b0fb963924628fc7316ba2dffb28b73c1fe0db001f531 -
087f597d223a0835262b0fb963924628fc7316ba2dffb28b73c1fe0db001f531 - /opt/CAPEv2/storage/analyses/9141/files/eb86cb9d05a7b659b90765e244d535669cb8a78a65a0cf7a2c617e3544d85003 -
eb86cb9d05a7b659b90765e244d535669cb8a78a65a0cf7a2c617e3544d85003 - /opt/CAPEv2/storage/analyses/9141/files/81bebfd9a61e9f17495763b68d57742fab2a1a43871015699a2c8e5fded4ec19 -
81bebfd9a61e9f17495763b68d57742fab2a1a43871015699a2c8e5fded4ec19 - /opt/CAPEv2/storage/analyses/9141/files/3130bf26da0c840c1e02203a90c3b1c38966fb203130e2fbb3dd7cb3865a3539 -
3130bf26da0c840c1e02203a90c3b1c38966fb203130e2fbb3dd7cb3865a3539 - /opt/CAPEv2/storage/analyses/9141/files/8924545cc92584169138aadb64683c07bbf846a57014c2e668d23b63f43f3610 -
8924545cc92584169138aadb64683c07bbf846a57014c2e668d23b63f43f3610 - /opt/CAPEv2/storage/analyses/9141/files/3c283132d53c4608ca2d2d886aa9e466d1b8e7f4fa5bd26fa2dfe540878abb12 -
3c283132d53c4608ca2d2d886aa9e466d1b8e7f4fa5bd26fa2dfe540878abb12 - /opt/CAPEv2/storage/analyses/9141/files/a9cb4f4ca111608f882729bc5eb1c2f15530c515ef02dd2ca62f2d8dc5a210cf -
a9cb4f4ca111608f882729bc5eb1c2f15530c515ef02dd2ca62f2d8dc5a210cf - /opt/CAPEv2/storage/analyses/9141/files/08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99 -
08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99 - /opt/CAPEv2/storage/analyses/9141/files/4f05f31ca026bbfeeee49ed86504cb060784137a9cfae0e5954d276e837ab5de -
4f05f31ca026bbfeeee49ed86504cb060784137a9cfae0e5954d276e837ab5de - /opt/CAPEv2/storage/analyses/9141/files/fa7b657aa7d5bbd1bf1e3fbba8bb26fddd6ccff5805625d2e400db5ebe1f968a -
fa7b657aa7d5bbd1bf1e3fbba8bb26fddd6ccff5805625d2e400db5ebe1f968a
Embedded URLs
- http://schemas.microsoft.com/SMI/2016/WindowsSettings
Embedded domains
- schemas.microsoft.com
- w.tw
- 9.fr
- 9.me
- q.sg
- a36.no
- aefd.nelreports.net
File paths
- l:\x%
- T:\KH@
- L:\:B:J:C:N:^:Q:I:Y:]:S
- a:\{
- m:\x~^
- o:\D\
More Phonzy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report