9ce5abd02d397689d99f62dfbd2a6a396876c6629cb5db453f1dcbbc3465ac9a

Classification: Malicious

9ce5abd02d397689d99f62dfbd2a6a396876c6629cb5db453f1dcbbc3465ac9a is a malicious file sample. Linked to Mustang Panda activity.

Detection summary

  • 35 antivirus detections (31% detection ratio)
  • 0 IDS alerts
  • 25 processes observed
  • 1 contacted hosts
  • 1 DNS requests

MITRE ATT&CK associations

Intrusion sets: MUSTANG PANDA (G0129)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Ta428 Maltiverse 2023-07-04 04:29:44 2023-07-05 20:50:41 malicious-activity
Generic.Malware Maltiverse 2023-07-05 11:14:04 2023-07-05 11:14:04 G0129 Mustang Panda
Generic Malware Hybrid-Analysis 2023-07-04 14:30:04 2023-07-04 14:30:04

Tags

apt malware backdoor plugx

Sample information

Filenames
9ce5abd02d397689d99f62dfbd2a6a396876c6629cb5db453f1dcbbc3465ac9a
File type
HTML document, ASCII text, with very long lines
Size
9557 bytes
MD5
a09e4ca13545425764b8d0d95eb97d63
SHA-1
9439cf64598bb25bd7015aadba673ffd520df19a
SHA-256
9ce5abd02d397689d99f62dfbd2a6a396876c6629cb5db453f1dcbbc3465ac9a
First indexed
2023-07-04 13:58:20
Last updated
2025-12-07 02:36:51

Antivirus detections

EngineDetection
LionicTrojan.HTML.Generic.4!c
FireEyeTrojan.Generic.33694752
VIPRETrojan.Generic.33694752
SymantecTrojan.Malscript
ESET-NOD32JS/Agent.QWS
AvastOther:Malware-gen [Trj]
KasperskyHEUR:Trojan.Script.Generic
BitDefenderTrojan.Generic.33694752
ViRobotHTML.Z.Agent.9557
MicroWorld-eScanTrojan.Generic.33694752
EmsisoftTrojan.Generic.33694752 (B)
GDataTrojan.Generic.33694752
ArcabitTrojan.Generic.D2022420
ZoneAlarmHEUR:Trojan.Script.Generic
MicrosoftTrojan:HTML/Phish.ALY!MTB
ALYacTrojan.Downloader.Script.gen
MAXmalware (ai score=83)
AVGOther:Malware-gen [Trj]
AhnLab-V3Trojan/HTML.Agent.SC190332
CAT-QuickHealScript.Trojan.47908.SL
CTXhtml.trojan.generic
DrWebJS.Siggen5.46506
GDataHTML.Trojan.Obfuscated.F@susp
GoogleDetected
KingsoftScript.Trojan.Generic.a
RisingTrojan.Agent/JS!8.11351 (TOPIS:E0:EdDZ6jidaXP)
SkyhighJS/Agent.hd
SophosTroj/HTMLDrp-RM
TencentScript.Trojan.Generic.Rnkl
TrellixENSJS/Agent.hd
TrendMicroTrojan.HTML.SMUGX.YEDGL
TrendMicro-HouseCallTrojan.HTML.SMUGX.YEDGL
VaristXML/ABTrojan.DJPD-
ZoneAlarmTroj/HTMLDrp-RM
alibabacloudTrojan:Javascript/Phish.AET2XJC

Network contacts

138.91.254.96

DNS requests

api.edgeoffer.microsoft.com

Process list

NameCommand line
msedge.exe--single-argument C:\9ce5abd02d397689d99f62dfbd2a6a396876c6629cb5db453f1dcbbc3465ac9a.html
msedge.exe--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 "--annotation=exe=%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=107.0.1418.56 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd8,0x7ffc1d70b208,0x7ffc1d70b218,0x7ffc1d70b228
msedge.exe--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:2
msedge.exe--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1940 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:3
msedge.exe--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1688478200792010 --launch-time-ticks=1194089540 --mojo-platform-channel-handle=3080 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:1
msedge.exe--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1688478200792010 --launch-time-ticks=1194577868 --mojo-platform-channel-handle=3108 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:1
msedge.exe--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3408 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4700 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --time-ticks-at-unix-epoch=-1688478200792010 --launch-time-ticks=1199138005 --mojo-platform-channel-handle=4796 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:1
msedge.exe--type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5656 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5784 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6052 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4444 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4340 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5216 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.16299.192 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3076 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:2
msedge.exe--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3940 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6680 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4836 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8
msedge.exe--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6408 --field-trial-handle=2004,i,1630633069551962757,16006515906665207771,131072 /prefetch:8