Report - 112d870878ff…83eaea497b

Malicious HighFILE

Quota 46

First seen: 2026-11-05T18:09:25Z
Last seen: 2026-11-13T07:44:26Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYgenbadurtrojan

RELATED INDICATORS22Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 112d870878ff503724c46bc8fe46bae27defcf70ae0a9dcf47cfd083eaea497b
SHA1: 69f232526d8752d4e91f2c644f4fdb760b89dcba
MD5: d343cce770fa9a21b1fa1a37816a75ad
Filename: 112d8708_sleestak_payload_1.lnk.bin
File type: lnk
MIME: application/x-ms-shortcut
File size: 1400
TLSH: T1B021FBFA9150FA10DD185FF5CD2FFD5D5989BD42CB881A0282693124DD7205127998DA
SSDEEP: 24:8HDBJJnHM4DTRIpbVj8s90VTVt28I+SyzMQKrivCca2XtezCo0Lx6Co4vCqhNVUq:8HdJxHPpkxj9iVTbSyJOp2XtO50E4v/

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 22. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 44%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections44%

VirusSign confidence100%

Relationship context22 visible

Threat classificationgenbadur

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

22 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

2shown

54a5f9e1c184a9ecf3efa0889b0f66dccbb0dd92408eca3a3199ecee109f58ca

5% high zip 1604 bytes contains

Filename 54a5f9e1_112d870878ff503724c46bc8fe46bae27defcf70ae0a9dcf47cfd083eaea497b.zip.bin Type trojan File type zip MIME application/zip Size 1604

18382fffa36892c1647b42461a9388dc91532e126b6c979c2f56a0a5ace968d4

47% high zip 1524 bytes contains

Filename 18382fff_1yddmf.exe.bin Family genbadur Type trojan File type zip MIME application/zip

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

e6fa076a8e7db058b94d03b7e9971a9faee12ec46f99d0ecd10599dd0a0f0558

19% high lnk 1069 bytes drops

Filename e6fa076a_sleestak_payload_1.lnk.bin Family lnkdrop Type trojan File type lnk MIME application/x-ms-shortcut

8678a057a70a2ac68c02e385826848f166287a459f34459d88a8b7dcb04c213b

15% high lnk 1065 bytes drops

Filename 8678a057_ff679595b52f2e3d306de04890b99500.lnk.bin Family lnkdrop Type trojan File type lnk MIME application/x-ms-shortcut

862d64aa9af12fdbaf360b5ceb01307b74f998f961edfd96ba30d8e358034037

0% html 122421 bytes drops

Filename 862d64aa_w909rdul.htm.bin File type html MIME text/html Size 122421 SHA1 40cb7c578318eaa80d984810c93e9c34b9401d86

168561fb18f8eba8043fa9fc4b8a95b628f2cf5584e5a3b96c9ebaf6dd740e3f

0% 64 bytes drops

Filename 168561fb_gtocbogj.exe.bin MIME application/x-msdos-program Size 64 SHA1 f33581ac2c60b1f02c978d14dc220dce57cc9562 First seen 2017-03-04T14:26:23Z

eb31de72690dc3041e4f8e7216fe26e0fd291831721d94083383d52e5bbebd56

0% csv 3175 bytes drops

Filename eb31de72_powershell.exe.log.bin File type csv MIME text/plain Size 3175 SHA1 9f5825c0d1ed7538709db5f7cf333115d6c7c3b8

Related IPs

Network IPs associated with this indicator.

5shown

150.171.110.149

5% low US communicates

CIDR 150.171.64.0/18 Network 150.171.0.0-150.171.255.255 First seen 2026-08-23T19:45:36Z Last seen 2026-11-15T10:54:21Z

150.171.109.152

5% low US communicates

CIDR 150.171.64.0/18 Network 150.171.0.0-150.171.255.255 First seen 2026-08-16T09:11:17Z Last seen 2026-11-15T10:41:50Z

150.171.110.210

0% US communicates

CIDR 150.171.64.0/18 Network 150.171.0.0-150.171.255.255 First seen 2026-05-06T05:25:22Z Last seen 2026-11-15T10:54:51Z

23.195.81.120

0% US communicates

CIDR 23.195.80.0/20 Network 23.192.0.0-23.223.255.255 First seen 2026-03-11T15:00:38Z Last seen 2026-11-15T10:46:20Z

150.171.110.2

0% US communicates

CIDR 150.171.64.0/18 Network 150.171.0.0-150.171.255.255 First seen 2025-12-12T00:10:47Z Last seen 2026-11-15T10:53:28Z

Related domains

Domains associated with this indicator.

5shown

stritil634.instrumentosaxofone.cfd

16% medium .cfd communicates

Root instrumentosaxofone.cfd TLD cfd Subdomain stritil634 First seen 2026-09-05T22:04:28Z Last seen 2026-11-13T07:44:26Z

instrumentosaxofone.cfd

16% medium .cfd communicates

Root instrumentosaxofone.cfd TLD cfd First seen 2026-08-22T07:54:26Z Last seen 2026-11-13T07:44:24Z

eip-terr-na.cdp1.digicert.com.akahost.net

0% .net communicates

Root akahost.net TLD net Subdomain eip-terr-na.cdp1.digicert.com First seen 2026-01-02T13:32:37Z Last seen 2026-11-15T10:55:03Z

wikipedia.org

0% .org communicates

Root wikipedia.org TLD org First seen 2023-10-01T00:24:10Z Last seen 2026-11-15T10:49:31Z

x.com

0% .com communicates

Root x.com TLD com First seen 2023-10-01T13:35:00Z Last seen 2026-11-15T10:46:16Z

Related URLs

URLs associated with this indicator.

5shown

http://stritil634.instrumentosaxofone.cfd:443/

5% medium communicates

TLD cfd HTTP status 200 Content SHA256 fdb88b5513f9065ea9fdf29b59e3449d7b680c3baeae2f3076676586e9582b1d First seen 2026-11-05T15:26:13Z Last seen 2026-11-05T15:54:49Z

https://stritil634.instrumentosaxofone.cfd/?…

10% critical communicates

TLD cfd HTTP status 200 Content length 410059 Content SHA256 da44db91fbafbb3f8d2fb5653e62db98976099f350cbe667402ff4824af9cf3c First seen 2026-11-05T10:25:34Z

http://www.twitter.com:443/

0% communicates

TLD com First seen 2019-08-09T22:29:46Z Last seen 2026-11-05T15:54:49Z

http://x.com:443/

0% communicates

TLD com First seen 2024-02-16T21:01:08Z Last seen 2026-11-05T15:54:49Z

http://www.linkedin.com:443/

0% communicates

TLD com HTTP status 200 Content length 144220 Content SHA256 15101f84830234b2335375f1196e9b9e78580ac7646057acc53d9c98287aa5e6 First seen 2013-12-25T00:51:47Z

Analysis details

Severity: hightrojanlnkobfuscatedpersistence

Freshness: Fresh · Last seen 2 days ago.

Detection rate: 44%
Threat type: trojan
Family: genbadur
Confidence: 100%
detection: 44 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 112d870878ff503724c46bc8fe46bae27defcf70ae0a9dcf47cfd083eaea497b
SHA1: 69f232526d8752d4e91f2c644f4fdb760b89dcba
MD5: d343cce770fa9a21b1fa1a37816a75ad
Filename: 112d8708_sleestak_payload_1.lnk.bin
File type: lnk
MIME: application/x-ms-shortcut
File size: 1400
TLSH: T1B021FBFA9150FA10DD185FF5CD2FFD5D5989BD42CB881A0282693124DD7205127998DA
SSDEEP: 24:8HDBJJnHM4DTRIpbVj8s90VTVt28I+SyzMQKrivCca2XtezCo0Lx6Co4vCqhNVUq:8HdJxHPpkxj9iVTbSyJOp2XtO50E4v/
First seen: 2026-11-05T18:09:25Z
Last seen: 2026-11-13T07:44:26Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 22. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 44%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family genbadur.

Relationship context

22 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

23 timestamped observations are arranged from 2013-12-25 to 2026-11-05. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 44%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 22 visible

5 relationship group(s) provide pivot and infrastructure context.

Threat classification genbadur

Classification context: type trojan, family genbadur.

Intelligence freshness Fresh

Last seen 2 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 112d8708_sleestak_payload_1.lnk.bin
File type: lnk
MIME: application/x-ms-shortcut
Size: 1400

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

obfuscatedpersistence

View details · 5 shown

A DLL was loaded from a suspicious directory
A HTTP/S link was seen in a script or command line
Attempts to connect to a dead IP:Port
Attempts to interact with an Alternate Data Stream (ADS)
Attempts to make a network connection via suspicious process

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1059 · T1071 — A HTTP/S link was seen in a script or command line
Tactics: TA0002 · TA0011
T1059 — Apparent Internal Usage of CMD.EXE
Tactics: TA0002
T1071 — Attempts to connect to a dead IP:Port
Tactics: TA0011
T1564.004 — Attempts to interact with an Alternate Data Stream (ADS)
Tactics: TA0005

5 shown

View MBC details · 5 shown

F0013 — Bootkit
Objectives: OB0006 · OB0012
E1059 — Command and Scripting Interpreter
Objectives: OB0009
Communication
Objectives: OC0006
C0016 — Create File
Objectives: OC0001
E1485 — Data Destruction
Objectives: OB0008

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 53

5+ outbound connections observed
5+ domains, 3 IPs, 5+ URLs
Common ports: 443, 53
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: stritil634.instrumentosaxofone.cfd
URL: https://stritil634.instrumentosaxofone.cfd:443/?4/_x
Protocol: HTTP

Domain: stritil634.instrumentosaxofone.cfd
URL: https://stritil634.instrumentosaxofone.cfd/?4/_x
Protocol: HTTP

Domain: stritil634.instrumentosaxofone.cfd
URL: http://stritil634.instrumentosaxofone.cfd:443/
Protocol: HTTP

Domain: stritil634.instrumentosaxofone.cfd
URL: http://stritil634.instrumentosaxofone.cfd:443
Protocol: HTTP

Domain: twitter.com
URL: http://twitter.com:443/
Protocol: HTTP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: stritil634.instrumentosaxofone.cfd
Type: A
Answers: 104.21.74.191, 172.67.162.95
Response: NOERROR

Query: stritil634.instrumentosaxofone.cfd
Type: A
Answers: 188.114.96.7
Response: NOERROR

Query: x.com
Type: A
Answers: 162.159.140.229
Response: NOERROR

Query: www.wikipedia.org
Type: A
Answers: 208.80.153.224
Response: NOERROR

Query: www.twitter.com
Type: A
Answers: 162.159.140.229
Response: NOERROR

5 shown

C2 candidates2

DNS, HTTPports 53

2 C2 candidate communications
1 domains, 1 IPs
Common ports: 53
Protocols: DNS, HTTP

View details · 2 shown

Domain: stritil634.instrumentosaxofone.cfd
Protocol: HTTP

IP: 172.67.162.95
Domain: stritil634.instrumentosaxofone.cfd
Port: 53
Protocol: DNS

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check