Report - 007bbae53d1e…cdf5c560f9

Malicious CriticalFILE

Quota 34

First seen: 2026-10-25T22:15:12Z
Last seen: 2026-11-06T16:17:03Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYyogitrojan

RELATED INDICATORS20Connections in this report

ANALYSISMaliciousRecent

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 007bbae53d1e88a03f7e6d86fca7fea829745dae8a9764472f56c3cdf5c560f9
SHA1: 5231c7d40f92787c75b5a73d6e9b56682599cdd2
MD5: 0f25ca0fb3392d21ddba041be8424c31
Filename: 007bbae5_ms-teamss.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 17425856
PE platform: x64 64-bit
PE sections: 9
Import libraries: 1

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 58%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections58%

VirusSign confidence100%

Relationship context20 visible

Threat classificationyogi

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

20 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

eef6f4a9d8f79e847e786fbb90991939552d2d9acc57877d9cca1f54951734fa

43% critical peexe 14531000 bytes drops

Filename eef6f4a9_lev59jd.exe.bin Family remus Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

c26dc2a39b1b244ce199da9f535f251f221fdc3aecefd05325f0faf3016a9cc0

0% lnk 1179 bytes drops

Filename c26dc2a3_executable.lnk.bin File type lnk MIME application/x-ms-shortcut Size 1179 SHA1 dc244b7eb2e26ebbd96460393b441e652e4187be

5b8f46ef6c45fdb5fcd4fca4161852c87e4b2a4a1f1b4ca9bdf49d1c1d3826da

0% lnk 1371 bytes drops

Filename 5b8f46ef_4treelgbvxm1u03eplfvow963v.lnk.bin File type lnk MIME application/x-ms-shortcut Size 1371 SHA1 795dd3dd04ac1ea57a93b9598c0075a58b84c4ff

256468ce19000fbb55a9f6b6289a2194fca9d1e09ff7239cce56209b33304cd8

0% lnk 1251 bytes drops

Filename 256468ce_o0w0jhjh7dvj6um9.lnk.bin File type lnk MIME application/x-ms-shortcut Size 1251 SHA1 93a67b4fcca6a9ba95084951117d663547d6f9f5

217dcaa5339456e573ec7c291a14ac6a6f5d6ed6d5de1e039e3296de1c8c4b28

48% high peexe 6367097 bytes drops

Filename 217dcaa5_21mot1e.exe.bin Family usbljg26 Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

Related IPs

Network IPs associated with this indicator.

5shown

142.251.155.7

0% US communicates

CIDR 142.250.0.0/15 Network 142.250.0.0-142.251.255.255 First seen 2026-09-03T19:43:49Z Last seen 2026-11-15T06:00:53Z

142.251.154.7

0% US communicates

CIDR 142.250.0.0/15 Network 142.250.0.0-142.251.255.255 First seen 2024-07-20T00:07:14Z Last seen 2026-11-15T06:00:53Z

142.251.153.7

0% US communicates

CIDR 142.250.0.0/15 Network 142.250.0.0-142.251.255.255 First seen 2026-09-10T12:54:55Z Last seen 2026-11-15T10:07:16Z

142.251.152.7

0% US communicates

CIDR 142.250.0.0/15 Network 142.250.0.0-142.251.255.255 First seen 2026-10-01T14:29:47Z Last seen 2026-11-15T08:49:23Z

142.251.151.7

0% US communicates

CIDR 142.250.0.0/15 Network 142.250.0.0-142.251.255.255 First seen 2026-08-16T06:27:18Z Last seen 2026-11-15T08:45:31Z

Related domains

Domains associated with this indicator.

5shown

bl4ckyhills.com

25% medium .com communicates

Root bl4ckyhills.com TLD com First seen 2026-10-29T08:50:53Z Last seen 2026-11-14T17:07:08Z

sidebyside26.org

5% low .org communicates

Root sidebyside26.org TLD org First seen 2025-08-24T06:30:17Z Last seen 2026-10-26T16:01:09Z

tran5feroff.com

16% medium .com communicates

Root tran5feroff.com TLD com First seen 2026-10-24T20:50:30Z Last seen 2026-11-13T10:11:35Z

ren3worog.com

21% medium .com communicates

Root ren3worog.com TLD com First seen 2026-10-26T17:04:37Z Last seen 2026-11-13T10:11:35Z

ferta8.click

11% medium .click communicates

Root ferta8.click TLD click First seen 2026-10-19T12:36:13Z Last seen 2026-11-06T16:17:12Z

Related URLs

URLs associated with this indicator.

5shown

https://gitlab.com/geagae-group/ageagaegae/-/raw/main/ms-teamss.exe

0% communicates

TLD com HTTP status 200 Content length 17425856 Content SHA256 007bbae53d1e88a03f7e6d86fca7fea829745dae8a9764472f56c3cdf5c560f9 First seen 2026-10-25T14:51:53Z

https://www.sidebyside26.org/ChromeSync.exe

10% medium communicates

TLD org HTTP status 200 Content length 14531000 Content SHA256 eef6f4a9d8f79e847e786fbb90991939552d2d9acc57877d9cca1f54951734fa First seen 2026-10-25T14:51:53Z

https://gitlab.com/geagae-group/ageagaegae/-/raw/main/enc/WORD.zip

0% communicates

TLD com HTTP status 200 Content length 17783127 Content SHA256 7fd0d0c28bfcdb93bbeb06ea659cbdf8cc88ae9be033314026d1c25337239312 First seen 2026-10-25T17:10:21Z

http://windowsupdate.microsoft.com:4021/

0% communicates

TLD com HTTP status 200 Content length 3002 Content SHA256 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747 First seen 2026-10-25T13:14:33Z

https://bugerror.info/

33% high communicates

TLD info HTTP status 200 Content length 982 Content SHA256 8e4152f144d5a779c00a59f66003e6f16196580c3d7e7ee441d35cd40022f7f3 First seen 2026-10-24T00:24:49Z

Analysis details

Severity: criticaltrojaninvalid-signatureexefile-overlaypolymorphic64bitwmi-activitycryptomacro-psobfuscatedpersistencesigned

Freshness: Recent · Last seen 8 days ago.

Detection rate: 58%
Threat type: trojan
Family: yogi
Confidence: 100%
detection: 58 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 007bbae53d1e88a03f7e6d86fca7fea829745dae8a9764472f56c3cdf5c560f9
SHA1: 5231c7d40f92787c75b5a73d6e9b56682599cdd2
MD5: 0f25ca0fb3392d21ddba041be8424c31
Filename: 007bbae5_ms-teamss.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 17425856
PE platform: x64 64-bit
PE sections: 9
Import libraries: 1
TLSH: T14F07D623A6B81AA8C4578638CD7A751E6DB07C48473DF2F76E3361A4EE397C466B4700
SSDEEP: 49152:5nBp4FG5aXj8GeU8N5jy0e9a5L3+YMApDMIC+bNd10E5ESK0u1oI2TrfqIex4AYv:15MQFy0yXSLEDj1lBx4ZTf
Imphash: d42595b695fc008ef2c56aabd8efd68e
First seen: 2026-10-25T22:15:12Z
Last seen: 2026-11-06T16:17:03Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 58%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family yogi.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 2024-07-20 to 2026-10-29. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 58%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 20 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification yogi

Classification context: type trojan, family yogi.

Intelligence freshness Recent

Last seen 8 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 007bbae5_ms-teamss.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 17425856
PE platform: x64 64-bit
Entry point: 474912
Sections: 9

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

wmi-activitycryptomacro-psobfuscatedpersistenceself-delete

View details · 5 shown

A DLL was loaded from a suspicious directory
A document or script file initiated network communications indicative of a potential exploit or payload download
A file with an unusual extension was attempted to be loaded as a DLL.
A potential decoy document was displayed to the user
A process created a hidden window

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1071 — A potential decoy document was displayed to the user
Tactics: TA0011
T1564.003 — A process created a hidden window
Tactics: TA0005
T1059 · T1064 — A script process created a new process
Tactics: TA0002 · TA0005
T1059 · T1064 · T1071 — A script process initiated network activity
Tactics: TA0002 · TA0005 · TA0011

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
B0030 — C2 Communication
Objectives: OB0004
B0001.002 — CheckRemoteDebuggerPresent
Objectives: OB0001
Command and Control
Objectives: OB0004

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 30, 4021

5+ outbound connections observed
4 domains, 5+ IPs, 5 URLs
Common ports: 443, 30, 4021, 53, 5353
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: bugerror.info
URL: https://bugerror.info/
Protocol: HTTP

Domain: www.sidebyside26.org
URL: https://www.sidebyside26.org/chromesync.exe
Protocol: HTTP

Domain: gitlab.com
URL: https://gitlab.com/geagae-group/ageagaegae/-/raw/main/ms-teamss.exe
Protocol: HTTP

Domain: gitlab.com
URL: https://gitlab.com/geagae-group/ageagaegae/-/raw/main/enc/word.zip
Protocol: HTTP

Domain: windowsupdate.microsoft.com
URL: http://windowsupdate.microsoft.com:4021/
Protocol: HTTP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: bugerror.info
Type: A
Answers: 176.65.144.99
Response: NOERROR

Query: ferta8.click
Type: A
Answers: 159.223.48.178
Response: NOERROR

Query: play.google.com
Type: A
Answers: 142.251.155.7, 142.251.150.7, 142.251.157.7, 142.251.151.7, 142.251.153.7, 142.251.156.7, 142.251.152.7, 142.251.154.7
Response: NOERROR

Query: www.sidebyside26.org
Type: A
Answers: 89.42.223.146
Response: NOERROR

Query: www.gstatic.com
Type: A
Answers: 142.251.156.120, 142.251.157.120, 142.251.154.120, 142.251.151.120, 142.251.152.120, 142.251.150.120, 142.251.153.120, 142.251.155.120
Response: NOERROR

5 shown

C2 candidates4

DNS, HTTPports 53

4 C2 candidate communications
3 domains, 2 IPs
Common ports: 53
Protocols: DNS, HTTP

View details · 4 shown

Domain: bugerror.info
Protocol: HTTP

IP: 176.65.144.99
Domain: bugerror.info
Port: 53
Protocol: DNS

Domain: www.sidebyside26.org
Protocol: HTTP

IP: 159.223.48.178
Domain: ferta8.click
Port: 53
Protocol: DNS

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present

View details · 1 shown

Platform: x64 64-bit
Entry point: 474912
Sections: 9

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 4158432
Raw size: 4158464
Permissions: rx
Entropy: 6.12

Name: .rdata
Virtual address: 4165632
Virtual size: 4171616
Raw size: 4171776
Permissions: r
Entropy: 5.91

Name: .data
Virtual address: 8339456
Virtual size: 543880
Raw size: 217600
Permissions: rw
Entropy: 5.18

Name: .pdata
Virtual address: 8884224
Virtual size: 57672
Raw size: 57856
Permissions: r
Entropy: 5.45

Name: .xdata
Virtual address: 8945664
Virtual size: 180
Raw size: 512
Permissions: r
Entropy: 1.76

5 shown

Imports1

1 DLL groups

1 import DLL groups
5+ imported functions summarized

View details · 1 shown

Library: kernel32.dll
Functions: AddVectoredContinueHandler, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateIoCompletionPort, CreateThread, CreateWaitableTimerExW, DuplicateHandle …

Resources2

2 resources

2 resources
Resource types: RT_GROUP_ICON, RT_ICON

View details · 2 shown

Type: RT_ICON
Language: ENGLISH US

Type: RT_GROUP_ICON
Language: ENGLISH US

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates4

4 issuers

Example subject: Falcon Anchor Analytics
Issued by: Falcon Anchor Analytics

View details · 4 shown

Subject: Falcon Anchor Analytics
Issuer: Falcon Anchor Analytics
Fingerprint: 77518CD051E5DAE5452023A1EBAA19525C235C4C

Subject: DigiCert Trusted Root G4
Issuer: DigiCert Assured ID Root CA
Fingerprint: A99D5B79E9F1CDA59CDAB6373169D5353F5874C6

Subject: DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1
Issuer: DigiCert Trusted Root G4
Fingerprint: 07894D00FC194A17DB273AEB5CF8FACEF14423A4

Subject: DigiCert SHA256 RSA4096 Timestamp Responder 2026 1
Issuer: DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1
Fingerprint: 51D9ABDA034973D84F4266ACA48248E6B369C439

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check