MALICIOUS — 13788f2e8becd577550a6e8cdf712b7ad10db795bd0de5bfe6c71764c6b05db2.exe

MALICIOUS — 13788f2e8becd577550a6e8cdf712b7ad10db795bd0de5bfe6c71764c6b05db2.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Dqah family. 4 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 13788f2e8becd577550a6e8cdf712b7ad10db795bd0de5bfe6c71764c6b05db2
• SHA-1: 6c9facc979286d96160cbcb0287f446fa7360107
• MD5: 30d28c27a413a0c8528fe6953e3cb89b
• imphash: 42492c8bc2aad1800e134cedaf5754c9
• File type: pe · Size: 5632899 bytes
• Verdict: malicious (99/100) · Family: Dqah

Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (4 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): PyInstaller
• Detect It Easy (packer/type): DIE:PyInstaller
• Emsisoft (Emergency Kit): Gen:Variant.Adware.Yogi.1551
• Kaspersky (KVRT): Trojan-Dropper.Win32.Sysn.dqah

MITRE ATT&CK

• T1543.003
• T1112
• T1105

Dynamic analysis (windows)

11252 behavior events · 2 ATT&CK techniques · 15 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• t.me
• telegram.org
• cdn4.telesco.pe
• edge-consumer-static.azureedge.net
• www.tiktok.com
• www.facebook.com
• go-ns.org.ua
• ifconfig.me
• static.xx.fbcdn.net
• scontent-syd2-1.xx.fbcdn.net
• core.telegram.org
• scontent.xx.fbcdn.net
• static.cloudflareinsights.com
• code.jquery.com
• sf16-website-login.neutral.ttwstatic.com
• mon.tiktokv.com
• xpaycdn-prod.azureedge.net
• xpaywalletcdn-prod.azureedge.net

Dropped files

• /opt/CAPEv2/storage/analyses/13697/files/8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02 — 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
• /opt/CAPEv2/storage/analyses/13697/files/ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e — ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
• /opt/CAPEv2/storage/analyses/13697/files/75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902 — 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
• /opt/CAPEv2/storage/analyses/13697/files/e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae — e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
• /opt/CAPEv2/storage/analyses/13697/files/664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2 — 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
• /opt/CAPEv2/storage/analyses/13697/files/cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f — cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
• /opt/CAPEv2/storage/analyses/13697/files/b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf — b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
• /opt/CAPEv2/storage/analyses/13697/files/e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d — e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
• /opt/CAPEv2/storage/analyses/13697/files/acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142 — acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
• /opt/CAPEv2/storage/analyses/13697/files/5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf — 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
• /opt/CAPEv2/storage/analyses/13697/files/2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3 — 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
• /opt/CAPEv2/storage/analyses/13697/files/3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204 — 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
• /opt/CAPEv2/storage/analyses/13697/files/57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977 — 57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977
• /opt/CAPEv2/storage/analyses/13697/files/9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce — 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
• 6d7777984a1402a581a3f892aff01c00c0b36da9873ddc812e306297f3edcdd5 — 6d7777984a1402a581a3f892aff01c00c0b36da9873ddc812e306297f3edcdd5

Embedded URLs

• http://schemas.microsoft.com/SMI/2016/WindowsSettings
• http://www.msftconnecttest.com/connecttest.txt
• http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786555127&P2=404&P3=2&P4=d1VecMUn5RKKjhosUbUyl%2fc3MBI9jV%2fBXMWb%2frhw%2bMbOPdN5JD6H07tDGXli5ciOP9NlytEf2kB%2fj9NwfqZWGA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://go-ns.org.ua/s/gononstopukraine
• http://go-ns.org.ua/@gononstopukraine
• http://go-ns.org.ua/gononstopukraine
• http://go-ns.org.ua/
• http://go-ns.org.ua/wp-content/themes/go-ns/send-message-to-telegram.php
• http://go-ns.org.ua/xmlrpc.php
• http://go-ns.org.ua/wp-login.php
• http://go-ns.org.ua/wp-admin/admin-ajax.php
• http://go-ns.org.ua/wp-json/wp/v2/posts

Embedded domains

• schemas.microsoft.com
• 8.gq
• t.me
• telegram.org
• cdn4.telesco.pe
• www.tiktok.com
• go-ns.org.ua
• ifconfig.me
• core.telegram.org
• sf16-website-login.neutral.ttwstatic.com
• mon.tiktokv.com

Embedded IP addresses

• 142.250.195.104
• 216.239.34.178
• 20.42.65.91
• 52.123.252.247
• 4.230.171.124
• 48.211.4.16
• 4.144.132.223
• 172.215.188.225
• 20.165.94.63
• 20.165.94.54
• 51.105.71.136
• 13.89.179.15
• 203.26.79.13
• 172.178.240.162
• 52.123.252.222
• 135.232.92.34
• 52.123.252.193
• 149.154.167.99
• 40.115.75.193
• 52.123.252.243
• 20.11.121.11
• 135.234.160.247
• 92.223.78.30
• 142.251.222.238
• 104.21.85.170

File paths

• G:\($
• Y:\bG
• m:\0HCp

More Dqah samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report