MALICIOUS — 2cd2e04af239b52ca438d515dc6ed41fc8bf005f5148989443a4049f86b0ef72
MALICIOUS — 2cd2e04af239b52ca438d515dc6ed41fc8bf005f5148989443a4049f86b0ef72 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Neyndy family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
2cd2e04af239b52ca438d515dc6ed41fc8bf005f5148989443a4049f86b0ef72 - SHA-1:
b1ca9111a78076295b0780dace36467775b89614 - MD5:
9273a9ff93cbb120c998284be63e293a - imphash:
f1a539a5b71ad53ac586f053145f08ec - File type: pe · Size: 795520 bytes
- Verdict: malicious (99/100) · Family: Neyndy
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Virus.8
MITRE ATT&CK
Dynamic analysis (windows)
2357 behavior events · 1 ATT&CK techniques · 17 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- msedge.api.cdp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- assets.msn.com
- kv801.prod.do.dsp.mp.microsoft.com
- cp801.prod.do.dsp.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/12618/files/139f38735edf02d3b2dfd0c32c15c60959c39f722efded92eca15ebca6c42932 —
139f38735edf02d3b2dfd0c32c15c60959c39f722efded92eca15ebca6c42932 - /opt/CAPEv2/storage/analyses/12618/files/d52b5afd58ceb2847e31a9c68c09630b5f46e1bb9e6bf6172ad9853d249db900 —
d52b5afd58ceb2847e31a9c68c09630b5f46e1bb9e6bf6172ad9853d249db900 - /opt/CAPEv2/storage/analyses/12618/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 —
b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - /opt/CAPEv2/storage/analyses/12618/files/64a7b2965936e32b172fc405acd560f2361fbff276618dc0c5327cb446c03e1d —
64a7b2965936e32b172fc405acd560f2361fbff276618dc0c5327cb446c03e1d - /opt/CAPEv2/storage/analyses/12618/files/e9a131bbff033c2c2ab7c32d1545fb9135d04bc1763e2853738eebc5f24a77b0 —
e9a131bbff033c2c2ab7c32d1545fb9135d04bc1763e2853738eebc5f24a77b0 - /opt/CAPEv2/storage/analyses/12618/files/913f9457eec1fab0e84aaf47361e6b7ec4bc779ab5bea30ed147dadbc226db82 —
913f9457eec1fab0e84aaf47361e6b7ec4bc779ab5bea30ed147dadbc226db82 - /opt/CAPEv2/storage/analyses/12618/files/9ae116bcd203474acdc39301e5d178a428db0de1a4a2d58e8aa6be2284643c4a —
9ae116bcd203474acdc39301e5d178a428db0de1a4a2d58e8aa6be2284643c4a - /opt/CAPEv2/storage/analyses/12618/files/22365324658b70cfbe8ba11e0f0df394435ae3e1fecf7f29752ac68b857c7abb —
22365324658b70cfbe8ba11e0f0df394435ae3e1fecf7f29752ac68b857c7abb - /opt/CAPEv2/storage/analyses/12618/files/51a7a6bf2afd040fb4bc7e3a47abf8ae61dff138de3085074db1609f8f16a7d2 —
51a7a6bf2afd040fb4bc7e3a47abf8ae61dff138de3085074db1609f8f16a7d2 - /opt/CAPEv2/storage/analyses/12618/files/e6ba15abc3fa5a054fe51f297c67626176315ef3260a13ff9e15ab8992f53c1f —
e6ba15abc3fa5a054fe51f297c67626176315ef3260a13ff9e15ab8992f53c1f - /opt/CAPEv2/storage/analyses/12618/files/77d6f97195cb9dcbd829941ff5b7adfa8b18f5697070ce5fe9c1f08df710e7b2 —
77d6f97195cb9dcbd829941ff5b7adfa8b18f5697070ce5fe9c1f08df710e7b2 - /opt/CAPEv2/storage/analyses/12618/files/67943166fa3e8b9f370e1e219252ade4b9843490019cf95c46073084976d47de —
67943166fa3e8b9f370e1e219252ade4b9843490019cf95c46073084976d47de - /opt/CAPEv2/storage/analyses/12618/files/bdd3ea4989e0bbb3f6dc6804369cb778247fbdda8f33e3609b6f8128afd1da60 —
bdd3ea4989e0bbb3f6dc6804369cb778247fbdda8f33e3609b6f8128afd1da60 - /opt/CAPEv2/storage/analyses/12618/files/0e451edf452c6504d05dd32ec198d338a7c70191acfa26097b7eb9916e096bd6 —
0e451edf452c6504d05dd32ec198d338a7c70191acfa26097b7eb9916e096bd6 - /opt/CAPEv2/storage/analyses/12618/files/547d2b6cbfbbb09b185f5ad806707565592600f8f27fefe11cb5e492149144af —
547d2b6cbfbbb09b185f5ad806707565592600f8f27fefe11cb5e492149144af
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786527107&P2=404&P3=2&P4=GBJDSbF6JYF6PVc1dT9FuTHb6MtsEJC0P6PF2ppqX3Wf9YaKxcya870JptS5nJYqAbp%2b8O7rrVkZghADDUz5ZA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786527139&P2=404&P3=2&P4=e1oIZisV1Y5J%2bbNHq8DEkKQblkQmp%2b8Tm9SEsYCM2bGn4vmaA51NlXShivDnVnyI0VzzBtI0LnYO4hAybAFRug%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 135.232.92.34
- 20.184.175.10
- 52.230.59.222
- 4.230.171.124
- 20.42.179.192
- 135.233.95.80
- 135.233.95.144
- 13.69.109.131
- 20.165.94.54
- 203.26.79.13
- 172.178.240.161
- 92.223.78.30
- 52.110.12.4
- 172.66.2.5
- 72.154.7.105
- 52.123.252.233
- 20.165.94.46
- 52.148.114.188
- 52.110.12.19
- 52.110.12.18
More Neyndy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report