MALICIOUS — e0a61a28a03edb731c78d4a3f98aa2d3c39e4087d314f55694ae78112a099d86.bin

MALICIOUS — e0a61a28a03edb731c78d4a3f98aa2d3c39e4087d314f55694ae78112a099d86.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Porcupine family. 5 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: e0a61a28a03edb731c78d4a3f98aa2d3c39e4087d314f55694ae78112a099d86
SHA-1: 498691b47fb699f0589fa0130d61dfecc9fb747e
MD5: 0a898ce55b2e5404d7c1bab841fa6de9
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 49152:ccEyjKrgywL4wf6AN49lAdv7+azqKbPpFt7MD3L75f108ZuyLAR0fzv4VJajqVi:ccE3FwL4wbC3u7+az3bTNMDU8IVPaee
TLSH: T1E75D339FA3995D07CCFF92DC7B9374DD90C651DBAAACA183CB11722416C2A3B2419063
Submitted as: e0a61a28a03edb731c78d4a3f98aa2d3c39e4087d314f55694ae78112a099d86.bin
File type: pe · Size: 2706432 bytes
Verdict: malicious (100/100) · Family: Porcupine

Source: MalShare · first seen 2026-08-24T12:20:05.763Z · SHA-256 verified

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV feed: SaneSecurity foxhole_generic: Porcupine.Malware.58887.UNOFFICIAL
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:MSIL/Spynoon.AF!MTB
Kaspersky (KVRT): HEUR:Trojan.MSIL.Crypt.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV feed: SaneSecurity foxhole_generic flagged Porcupine.Malware.58887.UNOFFICIAL (rule Porcupine.Malware.58887.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
4 behavioral detection(s) across 4 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.69, confidence 0.90
Microsoft Defender flagged Trojan:MSIL/Spynoon.AF!MTB (rule Trojan:MSIL/Spynoon.AF!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.MSIL.Crypt.gen (rule HEUR:Trojan.MSIL.Crypt.gen) - engine signal, weight 0.55, confidence 0.85
1 IDS alert(s): ThreatLens Telegram bot C2/exfil - network signal, weight 0.50, confidence 0.80
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

30533 behavior events · 3 ATT&CK techniques · 12 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\e743a81b51c89dfb25ee1c409ea8331b\PW_analyst_DESKTOP-HSGCBEP_20260824_052325.html - 7d689132001b11df79afc738bb59f8e43ff86422538d114050de3cdac9366d26
C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_nay2z3hi.ivw.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
d47e7222d2905ae7f012ca8a710cd9d5c03da744b68b54dbc5a936759c6ad82b - d47e7222d2905ae7f012ca8a710cd9d5c03da744b68b54dbc5a936759c6ad82b
ffa14fda763670e34a8f787f6e0d4245e3c9f56d60997e41b26832ce91cd7eee - ffa14fda763670e34a8f787f6e0d4245e3c9f56d60997e41b26832ce91cd7eee
55afccec7e520b620566e7177bf9e5b87d73c1dbe0417ce3949126bb57c8aa84 - 55afccec7e520b620566e7177bf9e5b87d73c1dbe0417ce3949126bb57c8aa84
4f7e61d305c77ebcd7ae7d1e6dac9ab51dfae5c6ccee7317bd491ff44843e314 - 4f7e61d305c77ebcd7ae7d1e6dac9ab51dfae5c6ccee7317bd491ff44843e314
82e1b56f666e72db4f9a00484bad90ddb178767aca32da5cefb0f9c7fa995c08 - 82e1b56f666e72db4f9a00484bad90ddb178767aca32da5cefb0f9c7fa995c08
8d0d5cca253ae27db341dc761edec9857969bdf7eb393222c71340028a388bc3 - 8d0d5cca253ae27db341dc761edec9857969bdf7eb393222c71340028a388bc3
34537b797bafad5c1160147fc19c61f2f7700dc2913165606669f30c6ffb84c9 - 34537b797bafad5c1160147fc19c61f2f7700dc2913165606669f30c6ffb84c9
b11fa4ea0edb11ec33779804d066fa21a35a82869eadffcb7e392365eb052527 - b11fa4ea0edb11ec33779804d066fa21a35a82869eadffcb7e392365eb052527
a62977e435ca0f0329305a8b0f167060f9092cd16a32911ae75f355c75910619 - a62977e435ca0f0329305a8b0f167060f9092cd16a32911ae75f355c75910619
e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690 - e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://icanhazip.com/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
icanhazip.com
api.telegram.org

Embedded IP addresses

4.150.223.110
4.230.171.124
20.247.185.124
85.210.193.152
48.211.4.16
74.178.240.61
40.79.197.34
20.165.94.54
20.247.184.197
52.110.12.16
52.110.12.44
92.223.78.30
172.66.2.5
40.84.85.40
20.184.175.5
135.234.160.245
104.16.184.241
149.154.166.110
52.148.114.188
72.154.7.96
52.110.12.47
52.110.12.48

File paths

W:\,W

More Porcupine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report