Suspicious
PyInstaller executable with low-trust heuristic detections and offensive MITRE techniques, but no tier-1 consensus, malicious sandbox verdict, or confirmed C2 contact.
41b01a63bcb94d3466…40bc9f2402The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The file exhibits a mixed-signal profile. On one hand, three low-trust engines flagged it, and heuristics detected process-injection (T1055) and credential-dumper (LSASS) techniques — offensive MITRE patterns. On the other hand, all 16 tier-1 engines remained silent, no malicious sandbox verdict was issued, and 10 dropped children were inspected with zero malicious verdicts. The PyInstaller signature (confirmed by 8 YARA rules) explains the process-injection and LSASS-access signals: PyInstaller bundles Python code and uses legitimate runtime unpacking that can mimic malware behaviour. The file's medium prevalence (133 submitters, 36 days old) and a community researcher's 'Clean' assessment further suggest this is a benign or suspicious application rather than confirmed malware. The absence of tier-1 family consensus, malicious children, and malicious host contact argues against a remote-access trojan.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines: 3/70 malicious, all low-trust tier (APEX, Bkav, Cylance); tier1Malicious=0; onlyLowTrustFlagging=true
yaraify: 8 rules matched, including 'Detect_PyInstaller' and 'PyInstaller' — file is PyInstaller-compiled executable
behaviour: offensiveCount=2 (T1055, T1486) but hasMaliciousSandboxVerdict=false, droppedChildren.hasMaliciousChild=false (0/10), contactedHosts.maliciousHosts=none
prevalence: medium (133 submitters, 163 submissions, 36 days old) — not rare/new; community comment reports 'Clean' verdict
signing: unsigned; no signer history; no brand mismatch detected
- All 16 tier-1 antivirus engines silent — no high-trust malware detection
- No malicious sandbox verdict recorded
- All 10 dropped children inspected, zero malicious verdicts
- Contacted hosts not in our malicious cache (CDN IPs)
- Medium prevalence (133 submitters) — not a brand-new rare sample; community researcher reported 'Clean'
- Unsigned executable — no publisher identity verification
- Process-injection detected (T1055) — could indicate code obfuscation or malware, but consistent with PyInstaller unpacking
- LSASS access detected — credential-dumper heuristic fired, but no malicious sandbox verdict
- Direct-IP C2 contact (no DNS) — evasion indicator, but contacted IPs are legitimate CDN providers
- Low-trust-only detections — no tier-1 engine consensus
Treat this file as suspicious pending further investigation. If it is a known legitimate Python application, the detections are likely false positives. If the source is unknown or untrusted, isolate and do not execute. Monitor for any malicious behaviour; the absence of tier-1 consensus and malicious runtime activity suggests low immediate risk, but the offensive MITRE techniques warrant caution.
DebuggerCheck API corroborated by 1 source
- 8 YARA rulesDebuggerCheck__API, DebuggerException__SetConsoleCtrl, Detect_PyInstaller
1 contradiction resolved by the scoring engine
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 104.18.14.72
- 199.232.192.193
- C:\Users\<USER>\AppData\Local\Temp\_MEI55242\PIL\_avif.cp314-win_amd64.pyd
- C:\Users\<USER>\AppData\Local\Temp\_MEI55242\PIL\_imaging.cp314-win_amd64.pyd
- C:\Users\<USER>\AppData\Local\Temp\_MEI55242\PIL\_imagingcms.cp314-win_amd64.pyd
- C:\Users\<USER>\AppData\Local\Temp\_MEI55242\PIL\_imagingft.cp314-win_amd64.pyd
- C:\Users\<USER>\AppData\Local\Temp\_MEI55242\PIL\_imagingmath.cp314-win_amd64.pyd
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- 48f4a239c25354f0e9f8…17ecedNever scannednever seen before
- 3271d39d7b4dcd841e8e…efe5e5Never scannednever seen before
- cb71909bf01a3a7a4c73…d46e13Never scannednever seen before
- 6a99bc0128e0c7d6cbbf…cbc6c8Never scannednever seen before
- 98074c85650a420a095a…b084e9Never scannednever seen before
- 81eca6840b87f2def9fc…d7aaaaNever scannednever seen before
- 4f05f31ca026bbfeeee4…7ab5deNever scannednever seen before
- 3130bf26da0c840c1e02…5a3539Never scannednever seen before
- 47576cae321c80e69c7f…ac6b91Never scannednever seen before
- 165be658ab7d61ffc3df…d3acd7Never scannednever seen before
1 corroborating signal from researcher-curated sources
- DebuggerCheck__API
- DebuggerException__SetConsoleCtrl
- Detect_PyInstallerby Obscurity Labs LLCDetects PyInstaller compiled executables across platforms
- golang_bin_JCorn_CSC846by Justin CornwellCSC-846 Golang detection ruleset
- PyInstallerby @bartblazeIdentifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
- DebuggerCheck__API
- DebuggerException__SetConsoleCtrl
- Detect_PyInstaller
- golang_bin_JCorn_CSC846
- PyInstaller
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
EvidenceC:\Windows\System32\svchost.exe -k NetworkService -pSandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
EvidenceC:\Windows\system32\lsass.exeSample contacted 2 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence104.18.14.72 · 199.232.192.193
3 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- NepTunnel 2.2.exe
- Size
- 19.09 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- 41b01a63bcb94d3466ada5e9df375ab92cd777377270aebd09597740bc9f2402
- MD5
- 271d8a10cd69696c2a3f8369893a1ca4
- SHA-1
- 0e9a151c6585c1164a2d893e58af2f623d76f788
- PE imphash
- dcaf48c1f10b0efa0a4472200f3850ed
- First seen (VT)
- 5/24/2026, 8:35:33 AM
- Last analysis (VT)
- 6/26/2026, 1:00:08 AM
- First scan (MalwareTips)
- 6/29/2026, 2:07:42 AM
- Last scan (MalwareTips)
- 6/29/2026, 2:07:42 AM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.