MALICIOUS — c836224e7f0ba7ff3639bd32c2b99e6d1715b23809d6499dffe486184fb045ce

MALICIOUS — c836224e7f0ba7ff3639bd32c2b99e6d1715b23809d6499dffe486184fb045ce is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Neyndy family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: c836224e7f0ba7ff3639bd32c2b99e6d1715b23809d6499dffe486184fb045ce
• SHA-1: 57c4ab0e4e8fb913286b3526d55cbb28c2518a6f
• MD5: 522857f5e158bdcaa4e45d1398a96ed6
• imphash: f1a539a5b71ad53ac586f053145f08ec
• File type: pe · Size: 2415528 bytes
• Verdict: malicious (99/100) · Family: Neyndy

Detections (6 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Malware.Zusy-9957983-0
• Detect It Easy (packer/type): DIE:UPX
• Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
• Microsoft Defender: Trojan:Win32/Prepscram!pz
• Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25

MITRE ATT&CK

• T1112
• T1105

Dynamic analysis (windows)

2381 behavior events · 1 ATT&CK techniques · 17 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• oneocsp.microsoft.com
• www.msn.com
• officeclient.microsoft.com
• settings-win.data.microsoft.com
• odc.officeapps.live.com
• licensing.mp.microsoft.com
• assets.msn.com
• www.bing.com
• tas02.sls.update.microsoft.com
• fe3cr.delivery.mp.microsoft.com
• v10.events.data.microsoft.com

Dropped files

• /opt/CAPEv2/storage/analyses/12624/files/f5d7af28c7f2b8fbc96cca9d82d6bee8acbf786de3e996b3d05c1ac005efe78d — f5d7af28c7f2b8fbc96cca9d82d6bee8acbf786de3e996b3d05c1ac005efe78d
• /opt/CAPEv2/storage/analyses/12624/files/8460566dd6afbfdd5de24b34c7971f08b8ba7f6c183f862f733d27bc1c5ee743 — 8460566dd6afbfdd5de24b34c7971f08b8ba7f6c183f862f733d27bc1c5ee743
• /opt/CAPEv2/storage/analyses/12624/files/6923d92a395a9ae10eb930ec9329795f82cd652981ff8606e81939e7e2dfdf57 — 6923d92a395a9ae10eb930ec9329795f82cd652981ff8606e81939e7e2dfdf57
• /opt/CAPEv2/storage/analyses/12624/files/5c3e88441a548d289de89f0f2b9a01f519b0c34fa75c9c4fbf3f69548053f52f — 5c3e88441a548d289de89f0f2b9a01f519b0c34fa75c9c4fbf3f69548053f52f
• /opt/CAPEv2/storage/analyses/12624/files/4fe972ac6dee809453d6a811b2a7e7cbb763697da4d32a31423c3eb84d6fa595 — 4fe972ac6dee809453d6a811b2a7e7cbb763697da4d32a31423c3eb84d6fa595
• /opt/CAPEv2/storage/analyses/12624/files/068417c25c559ae762afca774de7aeaf14e97f884eb61643befa94e0e8b50849 — 068417c25c559ae762afca774de7aeaf14e97f884eb61643befa94e0e8b50849
• /opt/CAPEv2/storage/analyses/12624/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 — b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
• /opt/CAPEv2/storage/analyses/12624/files/10e1306b4de140630a36b6ceda551147191bcae7b09550a351d028ef7f4290fe — 10e1306b4de140630a36b6ceda551147191bcae7b09550a351d028ef7f4290fe
• /opt/CAPEv2/storage/analyses/12624/files/b8e36ebc1ef0028e636ba43a61a4c9bd42f25d48efdc2b3328d2af1795494247 — b8e36ebc1ef0028e636ba43a61a4c9bd42f25d48efdc2b3328d2af1795494247
• /opt/CAPEv2/storage/analyses/12624/files/1c07b8821b3c814a376a4ab8cdaf595323a630345af5be20321db172046f5952 — 1c07b8821b3c814a376a4ab8cdaf595323a630345af5be20321db172046f5952
• /opt/CAPEv2/storage/analyses/12624/files/a6079fd338ba57226aae55a1b6ec745fa67b1a1c760230177858323b18418997 — a6079fd338ba57226aae55a1b6ec745fa67b1a1c760230177858323b18418997
• /opt/CAPEv2/storage/analyses/12624/files/0fc68d5fdd86e4d1111bdcc3c2e79085eca2cadfa838ba4785a9a06be4c261bd — 0fc68d5fdd86e4d1111bdcc3c2e79085eca2cadfa838ba4785a9a06be4c261bd
• /opt/CAPEv2/storage/analyses/12624/files/a6f5ff13a6cba8dfd2de9e21cfe400db887fa413431a2c2065845936f083b15c — a6f5ff13a6cba8dfd2de9e21cfe400db887fa413431a2c2065845936f083b15c
• /opt/CAPEv2/storage/analyses/12624/files/844538929daec62f37bc943d5d0aa43bfb5489cbab5166260fc71601cfbd9adf — 844538929daec62f37bc943d5d0aa43bfb5489cbab5166260fc71601cfbd9adf
• /opt/CAPEv2/storage/analyses/12624/files/1c24e92f58b3a568b153518699e123e62dcefa0ef2d2663808b9d32080907e0c — 1c24e92f58b3a568b153518699e123e62dcefa0ef2d2663808b9d32080907e0c

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786527303&P2=404&P3=2&P4=VXCOmYEHE%2fvdGhuh1e4Vo3FhOl0N%2fwW8o7Q18cQztuMwHEAqhrw8z%2bykFmS%2fzNWolc7LrhdHo02LZvJurbAx3Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786527371&P2=404&P3=2&P4=At0qLXPDp3kQ8RiPXm75tIRgxhAvKyspiAHiPklBV5ehc02jkiV%2fCcfxxehFqzv0%2fybaFoleAGdRKibR23hc%2fQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

• m.es

Embedded IP addresses

• 52.110.12.20
• 20.184.175.23
• 57.154.63.210
• 4.230.171.124
• 52.253.84.76
• 74.179.77.204
• 74.178.76.54
• 20.42.65.93
• 20.165.94.63
• 172.215.188.232
• 135.233.45.223
• 203.26.79.13
• 74.178.232.29
• 72.154.7.112
• 52.148.114.188
• 52.110.12.24
• 52.110.12.51

More Neyndy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report