Report - 0e8a32d068ae…5d8e558f39

Malicious CriticalFILE

Quota 32

First seen: 2023-10-04T23:05:22Z
Last seen: 2026-10-09T06:17:24Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYzusytrojan

RELATED INDICATORS20Connections in this report

ANALYSISMaliciousAging

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 0e8a32d068ae867e5296c365c837f273bcd56c48ce93130bb501c25d8e558f39
SHA1: 553f05b8b9cfc41fc1a49489f2edc8351e368c6a
MD5: 5afc8a066ac2bf3635b7ce56a741ca75
Filename: 0e8a32d068ae867e5296c365c837f273bcd56c48ce93130bb501c25d8e558f39.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 1199104
Compile time: 1992-06-19T22:22:17Z
PE platform: x86 32-bit
PE sections: 9

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 21. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 83%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections83%

VirusSign confidence100%

Relationship context21 visible

Threat classificationzusy

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

21 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

1shown

0e8a32d068ae867e5296c365c837f273bcd56c48ce93130bb501c25d8e558f39

83% critical peexe 1199104 bytes drops

Filename 0e8a32d068ae867e5296c365c837f273bcd56c48ce93130bb501c25d8e558f39.exe Family zusy Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

2ffe79a5ce4b620734d86a69c5173f4bad4beb4bddaec7b094deba85ba4cc74a

0% bmp 478 bytes contains

Filename LBABORT.bmp File type bmp MIME application/octet-stream Size 478 SHA1 ec64707de2c84114aeb0f8bd431adce95c3a2757

96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

0% powershell 60 bytes drops

Filename __PSScriptPolicyTest_iugzvutm.mi5.ps1 File type powershell MIME text/plain Size 60 SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d

88d14cc6638af8a0836f6d868dfab60df92907a2d7becaefbbd7e007acb75610

0% 16 bytes contains

Filename 5125 MIME application/octet-stream Size 16 SHA1 04f73efb0801b18f6984b14cd057fb56519cd31b First seen 2007-06-19T02:44:56Z

a0adcedb82b57089f64e2857f97cefd6cf25f4d27eefc6648bda83fd5fef66bb

0% ico 20 bytes contains

Filename 145 File type ico MIME application/octet-stream Size 20 SHA1 0754cbdf56c53de9ed7fbd47859d20b788c6f056

b8e6fc93d423931acbddae3c27dd3c4eb2a394005d746951a971cb700e0ee510

0% targa 308 bytes contains

Filename 9 File type targa MIME application/octet-stream Size 308 SHA1 cfa13c0ab30f1bbd566900dee3631902f9b6451c

Related IPs

Network IPs associated with this indicator.

5shown

178.218.166.216

0% HR communicates

CIDR 178.218.160.0/21 Network 178.218.166.192-178.218.166.255 First seen 2026-07-15T12:22:40Z Last seen 2026-07-15T12:22:40Z

172.67.137.163

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-09-29T15:27:42Z Last seen 2026-11-11T16:51:50Z

104.21.78.216

0% US communicates

CIDR 104.21.0.0/17 Network 104.16.0.0-104.31.255.255 First seen 2023-10-01T05:39:28Z Last seen 2026-11-11T16:51:50Z

13.107.43.13

0% US communicates

CIDR 13.107.42.0/23 Network 13.64.0.0-13.107.255.255 First seen 2026-07-16T16:41:27Z Last seen 2026-07-18T18:19:20Z

13.107.42.13

0% US communicates

CIDR 13.107.42.0/23 Network 13.64.0.0-13.107.255.255 First seen 2023-10-01T04:41:34Z Last seen 2026-10-27T03:03:58Z

Related domains

Domains associated with this indicator.

5shown

uwspog.dm.files.1drv.com

0% .com communicates

Root 1drv.com TLD com Subdomain uwspog.dm.files First seen 2023-10-25T10:38:32Z Last seen 2026-01-17T14:28:29Z

f5teta.ch.files.1drv.com

.com communicates

Root 1drv.com TLD com Subdomain f5teta.ch.files First seen 2025-07-06T02:05:48Z Last seen 2025-08-01T07:30:29Z

www.sweetvr.wiki

0% .wiki communicates

Root sweetvr.wiki TLD wiki Subdomain www First seen 2023-10-26T18:23:15Z Last seen 2023-10-26T18:23:15Z

sweetvr.wiki

5% low .wiki communicates

Root sweetvr.wiki TLD wiki First seen 2024-09-14T01:12:51Z Last seen 2026-01-16T12:47:30Z

www.dom-za-starije.com

.com communicates

Root dom-za-starije.com TLD com Subdomain www First seen 2025-08-01T00:22:01Z Last seen 2026-05-08T08:57:58Z

Related URLs

URLs associated with this indicator.

5shown

http://www.sweetvr.wiki/go04/?…

4% low communicates

TLD wiki HTTP status 200 Content length 27881 Content SHA256 3e5f47d16caa068f578ecfcf0ca2039ae5d61079448096a782a841a02ff4af39 First seen 2023-10-27T19:49:15Z

http://www.247mobilenotaryservice.net/go04/?…

4% medium communicates

TLD net HTTP status 404 Content length 2963 Content SHA256 ed456e96aebcb18e1da2e373964484a108ddc0bd0fed457d40ce922342a3dec3 First seen 2023-10-27T19:49:15Z

http://www.isaacbarker.net/go04/?…

4% low communicates

TLD net HTTP status 200 Content length 858 Content SHA256 3d6926ed0dff09abdedf46e093352c166491ad7964c9154e2557bc428ab9b49d First seen 2023-10-27T19:49:15Z

http://onedrive.live.com:443/

4% high communicates

TLD com First seen 2015-07-29T00:08:12Z Last seen 2026-08-01T18:08:32Z

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt

0% communicates

TLD com HTTP status 200 Content length 1547 Content SHA256 4f987bbe4e0d1dcf48fcefc9239ac6e62ee9df38cac2d32993b8533cd95c2e49 First seen 2014-01-24T17:20:22Z

Analysis details

Severity: criticaltrojaninput-checkexec-delaywmi-activitymalwareexepersistencedebug-checkbobsoftpolymorphicremcosdownloader

Freshness: Aging · Last seen 33 days ago.

Detection rate: 83%
Threat type: trojan
Family: zusy
Confidence: 100%
detection: 83 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 0e8a32d068ae867e5296c365c837f273bcd56c48ce93130bb501c25d8e558f39
SHA1: 553f05b8b9cfc41fc1a49489f2edc8351e368c6a
MD5: 5afc8a066ac2bf3635b7ce56a741ca75
Filename: 0e8a32d068ae867e5296c365c837f273bcd56c48ce93130bb501c25d8e558f39.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 1199104
Compile time: 1992-06-19T22:22:17Z
PE platform: x86 32-bit
PE sections: 9
Import libraries: 11
TLSH: T155456C34B3B50CB1F87A76B4C907A7F01DFF67A9A904689992B53D1B2C727417A2102F
SSDEEP: 24576:1RxK0h0gJ+HYS9XsILx0P83H5M8OG3sWYm3:1RNjHm3
Imphash: 0d3c91eaf5fe15612d88e7ce6d9c9b4f
First seen: 2023-10-04T23:05:22Z
Last seen: 2026-10-09T06:17:24Z
Filename variants: 3 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 21. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 83%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family zusy.

Relationship context

21 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 1992-06-19 to 2026-07-16. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 83%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 21 visible

5 relationship group(s) provide pivot and infrastructure context.

Threat classification zusy

Classification context: type trojan, family zusy.

Intelligence freshness Aging

Last seen 33 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 0e8a32d068ae867e5296c365c837f273bcd56c48ce93130bb501c25d8e558f39.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 1199104
Compile time: 1992-06-19T22:22:17Z
PE platform: x86 32-bit
Entry point: 501852
Sections: 9

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

wmi-activityinput-checkdebug-checkexec-delaypersistence

View details · 5 shown

Adds a directory exclusion to Windows Defender
Allocates many large memory junks
Allocates memory in foreign processes
Binary contains paths to debug symbols
C2 URLs / IPs found in malware configuration

5 shown

View MITRE ATT&CK details · 5 shown

T1562.001 — Adds a directory exclusion to Windows Defender
Tactics: TA0005
T1518.001 — Allocates many large memory junks
Tactics: TA0007
T1055 — Allocates memory in foreign processes
Tactics: TA0004 · TA0005
T1071 — C2 URLs / IPs found in malware configuration
Tactics: TA0011
T1497 · T1518.001 — Checks if the current process is being debugged
Tactics: TA0005 · TA0007

5 shown

View MBC details · 5 shown

C0007 — Allocate Memory
Objectives: OC0002
E1010 — Application Window Discovery
Objectives: OB0007
C0008 — Change Memory Protection
Objectives: OC0002
E1059 — Command and Scripting Interpreter
Objectives: OB0009
C0016 — Create File
Objectives: OC0001

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 80, 53

5+ outbound connections observed
5+ domains, 5+ IPs, 5+ URLs
Common ports: 443, 80, 53
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: www.247mobilenotaryservice.net
URL: http://www.247mobilenotaryservice.net/go04/?8pe4b2e=5t8jiavewumg1yhzxdwztoqardo/1bgymquv3+zmpvutpyyjmm9ihvisafy8l/ui/d9g&2db=4h88
Protocol: HTTP

Domain: www.sweetvr.wiki
URL: http://www.sweetvr.wiki/go04/?8pe4b2e=+oqdkxfioodhnrl/30a2h1rjbxbsim0+qhlslv7lb2vzzmwxcjm3xcnctlqosexa10jk&2db=4h88
Protocol: HTTP

Domain: www.isaacbarker.net
URL: http://www.isaacbarker.net/go04/?8pe4b2e=kwshr0hgctau0+h0j/ctgk3p+8zipz+udwpxdkj8m+lxco+sghavlteazevcmogo4qis&2db=4h88
Protocol: HTTP

Domain: onedrive.live.com
URL: http://onedrive.live.com:443/
Protocol: HTTP

IP: 91.195.240.19
Port: 80
Protocol: TCP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: www.sweetvr.wiki
Type: A
Answers: 91.195.240.19
Response: NOERROR

Query: www.isaacbarker.net
Type: A
Answers: 104.21.78.216, 172.67.137.163
Response: NOERROR

Query: www.dom-za-starije.com
Type: A
Answers: 178.218.166.216
Response: NOERROR

Query: www.247mobilenotaryservice.net
Type: A
Answers: 34.149.87.45
Response: NOERROR

Query: web.fe.1drv.com

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5+ sections

Platform: x86 32-bit
Sections: 5+
Entry point: present
Compile time: 1992-06-19T22:22:17Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 501852
Sections: 9
Compile time: 1992-06-19T22:22:17Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: rw, r, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 492412
Raw size: 492544
Permissions: rx
Entropy: 6.51

Name: .itext
Virtual address: 499712
Virtual size: 2212
Raw size: 2560
Permissions: rx
Entropy: 5.75

Name: .data
Virtual address: 503808
Virtual size: 554524
Raw size: 555008
Permissions: rw
Entropy: 4.38

Name: .bss
Virtual address: 1060864
Virtual size: 14072
Raw size: 0
Permissions: rw
Entropy: 0.0

Name: .idata
Virtual address: 1077248
Virtual size: 10904
Raw size: 11264
Permissions: rw
Entropy: 5.1

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: oleaut32.dll
Functions: GetErrorInfo, SafeArrayCreate, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayPtrOfIndex, SysAllocStringLen, SysFreeString, SysReAllocStringLen …

Library: advapi32.dll
Functions: GetUserNameA, RegCloseKey, RegCreateKeyExA, RegFlushKey, RegOpenKeyExA, RegQueryValueExA

Library: user32.dll
Functions: ActivateKeyboardLayout, AdjustWindowRectEx, BeginPaint, CallNextHookEx, CallWindowProcA, CharLowerA, CharLowerBuffA, CharNextA …

Library: kernel32.dll
Functions: CloseHandle, CompareStringA, CreateEventA, CreateFileA, CreateThread, DeleteCriticalSection, EnterCriticalSection, EnumCalendarInfoA …

Library: gdi32.dll
Functions: BitBlt, CopyEnhMetaFileA, CreateBitmap, CreateBrushIndirect, CreateCompatibleBitmap, CreateCompatibleDC, CreateDCA, CreateDIBitmap …

5 shown

Resources5+

5+ resources

5+ resources
Resource types: RT_STRING, RT_BITMAP, RT_CURSOR, RT_GROUP_CURSOR, RT_ICON

View details · 5 shown

Type: RT_CURSOR
Language: ENGLISH US

Type: RT_BITMAP
Language: ENGLISH US

Type: RT_ICON
Language: NEUTRAL

Type: RT_DIALOG
Language: NEUTRAL

Type: RT_STRING
Language: NEUTRAL

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check