MALICIOUS — 123191fcf2167ea47cf1532159462cdff55aa4408204b5056347c4fec3e6157b.exe

MALICIOUS — 123191fcf2167ea47cf1532159462cdff55aa4408204b5056347c4fec3e6157b.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Dmwo family. 4 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 123191fcf2167ea47cf1532159462cdff55aa4408204b5056347c4fec3e6157b
SHA-1: 1317fe72f85d2ef46be0cfd5a90b5d53de84758c
MD5: 8266062f85308a1e73215c42f4bccf80
imphash: 42492c8bc2aad1800e134cedaf5754c9
File type: pe · Size: 5630922 bytes
Verdict: malicious (100/100) · Family: Dmwo

Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (4 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): PyInstaller
Detect It Easy (packer/type): DIE:PyInstaller
Emsisoft (Emergency Kit): Gen:Variant.Adware.Yogi.1551
Kaspersky (KVRT): Trojan-Dropper.Win32.Sysn.dmwo

MITRE ATT&CK

Dynamic analysis (windows)

14400 behavior events · 2 ATT&CK techniques · 15 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/13638/files/8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 — 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
/opt/CAPEv2/storage/analyses/13638/files/ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e — ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
/opt/CAPEv2/storage/analyses/13638/files/75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902 — 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
/opt/CAPEv2/storage/analyses/13638/files/e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae — e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
/opt/CAPEv2/storage/analyses/13638/files/664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2 — 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
/opt/CAPEv2/storage/analyses/13638/files/cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f — cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
/opt/CAPEv2/storage/analyses/13638/files/b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf — b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
/opt/CAPEv2/storage/analyses/13638/files/e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d — e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
/opt/CAPEv2/storage/analyses/13638/files/acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142 — acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
/opt/CAPEv2/storage/analyses/13638/files/798c3605fe24d94228acd75622d03e23f022b3b918e266be852c20fa27bba0a6 — 798c3605fe24d94228acd75622d03e23f022b3b918e266be852c20fa27bba0a6
/opt/CAPEv2/storage/analyses/13638/files/5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf — 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
/opt/CAPEv2/storage/analyses/13638/files/2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3 — 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
/opt/CAPEv2/storage/analyses/13638/files/3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204 — 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
/opt/CAPEv2/storage/analyses/13638/files/9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce — 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
2b5b5089015c0da1ead4b7e1d5090bb2595f99bc1b60e282d5991578bb1285af — 2b5b5089015c0da1ead4b7e1d5090bb2595f99bc1b60e282d5991578bb1285af

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786552923&P2=404&P3=2&P4=RjR2drbbVS1cXp4uktlTtlsIgFdVtaVJLjtsfNp6Y9Y1ngCSJedf5pIGim1zVpzuAIkSVXAuJPLasQt5cxGq1A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786552992&P2=404&P3=2&P4=HXrWOUAACskX%2fTRU%2bR8VjJ6gqgUZ5zIb%2fUyh6awv8mlIOqncD6sT%2b11QVAyPndAaaZtPdDwT43S8m8AbL4NAiQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://t.me/s/gononstopukraine
http://www.tiktok.com/@gononstopukraine
http://www.facebook.com/gononstopukraine
http://go-ns.org.ua/
http://go-ns.org.ua/wp-content/themes/go-ns/send-message-to-telegram.php
http://go-ns.org.ua/xmlrpc.php
http://go-ns.org.ua/wp-login.php
http://go-ns.org.ua/wp-admin/admin-ajax.php
http://go-ns.org.ua/wp-json/wp/v2/posts

Embedded domains

schemas.microsoft.com
l.sg
8.gq
t.me
telegram.org
cdn4.telesco.pe
www.tiktok.com
sf16-website-login.neutral.ttwstatic.com
go-ns.org.ua
ifconfig.me
www.instagram.com
accounts.meta.com
mon.tiktokv.com

Embedded IP addresses

20.50.73.5
52.123.252.245
4.230.171.124
48.211.4.16
20.247.185.124
172.215.188.232
74.178.76.128
135.233.95.135
4.150.223.104
13.89.179.15
52.123.252.198
74.178.232.29
203.26.79.13
135.234.160.246
20.11.121.11
52.123.252.192
4.237.188.71
149.154.167.99
149.154.164.25
135.233.45.223
72.145.35.116
104.46.162.224
13.89.179.12
52.148.114.188
34.160.111.145

File paths

G:\($
Y:\bG
m:\0HCp

More Dmwo samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report