MALICIOUS — 11621978916ef99d1c24cc4c7355d5a05d862dc9769b23f6685a21910d334726.exe
MALICIOUS — 11621978916ef99d1c24cc4c7355d5a05d862dc9769b23f6685a21910d334726.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 3 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
11621978916ef99d1c24cc4c7355d5a05d862dc9769b23f6685a21910d334726 - SHA-1:
5260b728d1027219cd355b9ded2110897923d00c - MD5:
9c1bee9ed7cc87bf6a874b71fea8e178 - imphash:
e2f14db9ebed773579f096bfcc8c1e6c - File type: pe · Size: 2152960 bytes
- Verdict: malicious (99/100)
Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified
Detections (3 of 52 engines)
- Microsoft Defender: Trojan:Win32/Malgent
- Emsisoft (Emergency Kit): Trojan.GenericKD.81008118
- Kaspersky (KVRT): Trojan.Win32.Autoit.adfmg
MITRE ATT&CK
Dynamic analysis (windows)
5420 behavior events · 2 ATT&CK techniques · 5 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- osMZyUGsXQRLmf.osMZyUGsXQRLmf
- microsoft.com
- play-update-store.com
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
Dropped files
- /opt/CAPEv2/storage/analyses/12564/files/92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45 —
92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45 - /opt/CAPEv2/storage/analyses/12564/files/331627bf72dde7064c97c0b07d080243257048c8726fb0cd22be8f13c904f370 —
331627bf72dde7064c97c0b07d080243257048c8726fb0cd22be8f13c904f370 - 529f017705a8edbcc32296c50dbcc277b7538da0a9947eec4ceaf21a73e6360c —
529f017705a8edbcc32296c50dbcc277b7538da0a9947eec4ceaf21a73e6360c - abb4bd5bd35c859dc431f64d326fc3f6d61ad7d421d02629dc097dd27f6fdf29 —
abb4bd5bd35c859dc431f64d326fc3f6d61ad7d421d02629dc097dd27f6fdf29 - a93c6614b49c5a38dc9321423b4b45f5188fefe35a0672e1127bea23525a239e —
a93c6614b49c5a38dc9321423b4b45f5188fefe35a0672e1127bea23525a239e
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786525863&P2=404&P3=2&P4=jV1xTD%2flOlsxp3uPB6lufbzqUp6%2fJaFMgp%2fzPkfOtirtCpy%2fOCRzbm03c61Ik%2bHkf7hKXQypiC%2fIzeRmwNfthA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786525944&P2=404&P3=2&P4=fMDVZUgsj1vSy%2fmWZmgtscqOrULi06NNEmSof90dFAYThFO6UpVjTEmuXzQlCeW%2bFzGTBUvBgnPDPVV0AY8XZQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- osmzyugsxqrlmf.osmzyugsxqrlmf
- play-update-store.com
Embedded IP addresses
- 20.184.175.3
- 52.123.252.235
- 20.247.184.197
- 85.210.196.11
- 4.230.171.124
- 74.178.76.128
- 104.208.16.94
- 74.178.240.51
- 135.233.95.144
- 203.26.79.13
- 135.233.45.222
- 92.223.78.30
- 52.123.252.227
- 135.233.95.80
- 4.150.223.104
- 52.168.117.175
- 72.153.5.61
- 52.148.114.188
- 52.110.12.1
- 20.165.94.46
- 52.110.12.44
File paths
- y:\.$5
- K:\O\
- b:\o
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report