MALICIOUS — 1e3c8f4eaa7cf7249cfbb7b253d9f4cb8db4e096afe24bb9c7dc975f250891ce
MALICIOUS — 1e3c8f4eaa7cf7249cfbb7b253d9f4cb8db4e096afe24bb9c7dc975f250891ce is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Neyndy family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
1e3c8f4eaa7cf7249cfbb7b253d9f4cb8db4e096afe24bb9c7dc975f250891ce - SHA-1:
ac353088551d53c21b81ea3989ef6eee6e9f04c4 - MD5:
b50a037f5eace80aaeb1b3adee5c5f9d - imphash:
f1a539a5b71ad53ac586f053145f08ec - File type: pe · Size: 988032 bytes
- Verdict: malicious (100/100) · Family: Neyndy
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Virus.8
MITRE ATT&CK
Dynamic analysis (windows)
53810 behavior events · 2 ATT&CK techniques · 77 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- tas02.sls.update.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13539/files/7368e77d0f547797579bad68d017d51499afdaaff0b7f99365029d244cddccb7 —
7368e77d0f547797579bad68d017d51499afdaaff0b7f99365029d244cddccb7 - /opt/CAPEv2/storage/analyses/13539/files/8426d8281f5a4462298af7313fa92947421f55357531c86c955e41258dc36cb7 —
8426d8281f5a4462298af7313fa92947421f55357531c86c955e41258dc36cb7 - /opt/CAPEv2/storage/analyses/13539/files/557b0cdc09bdeabb4cf73535abf687d3ccf2f639beceeccaf90cc3e249d07d62 —
557b0cdc09bdeabb4cf73535abf687d3ccf2f639beceeccaf90cc3e249d07d62 - /opt/CAPEv2/storage/analyses/13539/files/45f2663753814726d342f3b6c70520127856ccdc5f879e1da1c086edb3a60f30 —
45f2663753814726d342f3b6c70520127856ccdc5f879e1da1c086edb3a60f30 - /opt/CAPEv2/storage/analyses/13539/files/1ac9785462b0e86303d612861b4ed1bb06116d6e8b095a615e724a1427fba7f4 —
1ac9785462b0e86303d612861b4ed1bb06116d6e8b095a615e724a1427fba7f4 - /opt/CAPEv2/storage/analyses/13539/files/5945ae2c7eb1f075343025f526f43d2f952ae092996855dfc07e3439c236c4c2 —
5945ae2c7eb1f075343025f526f43d2f952ae092996855dfc07e3439c236c4c2 - /opt/CAPEv2/storage/analyses/13539/files/e379263490a0293697962c1a909de4dd2257d7124fe7d576e695f86d2be6937d —
e379263490a0293697962c1a909de4dd2257d7124fe7d576e695f86d2be6937d - /opt/CAPEv2/storage/analyses/13539/files/4a2ed42459b7a2e0734c7eef56b88c8d4c8697fd99f9df9d3ec3718f7af81d51 —
4a2ed42459b7a2e0734c7eef56b88c8d4c8697fd99f9df9d3ec3718f7af81d51 - /opt/CAPEv2/storage/analyses/13539/files/aa074a1f68654a5a680af221118b1d39ea4c51e31799c379a4f2b98d8ed27f4d —
aa074a1f68654a5a680af221118b1d39ea4c51e31799c379a4f2b98d8ed27f4d - /opt/CAPEv2/storage/analyses/13539/files/e8479c27a78f67f2b04e1de607bae49a7abe5de87b2d5006d57098a0d76ca740 —
e8479c27a78f67f2b04e1de607bae49a7abe5de87b2d5006d57098a0d76ca740 - /opt/CAPEv2/storage/analyses/13539/files/d1622f81dbe1a7f44bb8ca421f96b3b9a51e814d29c66f3791b69dd27e06ec34 —
d1622f81dbe1a7f44bb8ca421f96b3b9a51e814d29c66f3791b69dd27e06ec34 - /opt/CAPEv2/storage/analyses/13539/files/3ef943b3ce49661ff0fabdfdd4d1140757bcef21406fc81debb95e7c17633fe9 —
3ef943b3ce49661ff0fabdfdd4d1140757bcef21406fc81debb95e7c17633fe9 - /opt/CAPEv2/storage/analyses/13539/files/41fcf1d2d05c03b76e8413120bada079c71dddf9b7339ea06740a97171f54e74 —
41fcf1d2d05c03b76e8413120bada079c71dddf9b7339ea06740a97171f54e74 - /opt/CAPEv2/storage/analyses/13539/files/d7f50d5099bd77ff70963702a28358af71514a024a1865892384962fbf69ab8b —
d7f50d5099bd77ff70963702a28358af71514a024a1865892384962fbf69ab8b - /opt/CAPEv2/storage/analyses/13539/files/69108c86e91eb56c6a95e69eafffc56ee9385d0506b5609498e65c504d97457d —
69108c86e91eb56c6a95e69eafffc56ee9385d0506b5609498e65c504d97457d
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786550399&P2=404&P3=2&P4=TY3LPgZvAEig09veZMLP1ylWSr7M86ySqeBh1TIpCyxVSmyeAJAlB1YHBYXGK52%2fxzcxtUW%2bwciixOe%2bEoljyA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786550494&P2=404&P3=2&P4=UcLTVkVXDxzt1qxMGC3nvkiGum6zHAChY07RNENp0sXNzR5EtfJo0ytPo6Uhd7JeayvhFG5MYTH1tDD%2b42RhoA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 13.89.179.12
- 52.123.252.223
- 48.211.4.16
- 4.230.171.124
- 52.230.60.54
- 85.210.196.11
- 74.179.77.204
- 74.178.76.54
- 20.50.73.5
- 135.233.45.221
- 92.223.78.30
- 135.234.160.246
- 203.26.79.13
- 162.159.142.9
- 172.66.2.5
- 52.123.252.240
- 74.178.76.44
- 52.110.12.30
- 52.110.12.54
- 20.184.175.10
- 4.150.223.109
- 51.11.192.50
- 52.148.114.188
- 72.153.5.136
- 52.110.12.20
More Neyndy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report