Report - 21fbfdbd1ffd…470db5916b

Suspicious HighFILE

Quota 48

First seen: 2026-11-10T04:23:15Z
Last seen: 2026-11-11T16:18:16Z

THREAT SIGNALLow Read alongside the verdict

CONFIDENCE58%VirusSign analysis

FAMILYagentbtrojan

RELATED INDICATORS18Connections in this report

ANALYSISSuspiciousFresh

Indicator overview

INDICATOR PROFILE

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

SHA256: 21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b
SHA1: c96e5bcbb13b107c4525771a8e156cac736d8f63
MD5: 88960e5d6079c359e6a76063eddbf3fe
Filename: WlanSvc_Helper.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 2358272
Compile time: 2026-10-14T19:29:49Z
PE platform: x64 64-bit
PE sections: 7

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (4%).

Confidence signal

VirusSign confidence is elevated at 58%. Use it as supporting evidence together with detections, family and relationship context.

Analysis signals

OBSERVED

Engine detections4%

VirusSign confidence58%

Relationship context18 visible

Threat classificationagentb

Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.

RELATIONSHIP CONSTELLATION

SELECT A NODE TO EXPLORE

FILEDOMAINIPURL

Visible connections

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

18 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

4shown

91205528895b158452920d7f610ae94ddc4024509248deefcf67e8e1a06bf790

26% high peexe 845824 bytes drops

Filename SysMain.exe Family defiller Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

5c3b82cf6761104454ade0dd640bdff28a15051d82dc49f7513ce788a55414f9

61% high peexe 3504128 bytes drops

Filename winmgmt_task.exe Family toolxmr Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

72ae19a66b5d012088d762d3e2de6498a9b3b8fc153352ca6c76cf045d1fe96e

0% xml 585 bytes contains

Filename 1 File type xml MIME application/xml Size 585 SHA1 df759518191bad6608c336186b31c120b3dadb34

076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560

0% isoimage 512 bytes contains

Filename [25] Type malware File type isoimage MIME application/octet-stream Size 512

Related IPs

Network IPs associated with this indicator.

5shown

52.123.248.56

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-09-29T11:08:21Z Last seen 2026-11-11T17:45:55Z

52.123.248.46

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-09-30T14:08:51Z Last seen 2026-11-11T17:52:48Z

52.123.248.21

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-10-07T08:26:17Z Last seen 2026-11-11T17:33:00Z

52.123.248.11

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-10-03T11:33:55Z Last seen 2026-11-11T17:47:32Z

52.123.248.83

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-09-29T11:08:21Z Last seen 2026-11-11T17:35:00Z

Related domains

Domains associated with this indicator.

5shown

atm.teams.mira.tm.svc.cloud.microsoft

0% .microsoft communicates

Root cloud.microsoft TLD microsoft Subdomain atm.teams.mira.tm.svc First seen 2024-08-26T16:41:58Z Last seen 2026-11-11T17:58:40Z

dns.quad9.net

0% .net communicates

Root quad9.net TLD net Subdomain dns First seen 2023-10-01T09:59:52Z Last seen 2026-11-11T16:18:21Z

pool.hashvault.pro

25% high .pro communicates

Root hashvault.pro TLD pro Subdomain pool First seen 2023-09-30T20:34:23Z Last seen 2026-11-11T17:50:37Z

ssl.com

0% .com communicates

Root ssl.com TLD com First seen 2023-10-01T00:22:34Z Last seen 2026-11-11T16:52:00Z

ocsps.ssl.com

0% .com communicates

Root ssl.com TLD com Subdomain ocsps First seen 2023-10-01T00:22:34Z Last seen 2026-11-11T16:52:00Z

Related URLs

URLs associated with this indicator.

4shown

https://cloudflare-dns.com/dns-query?…

0% communicates

TLD com HTTP status 400 First seen 2026-11-11T14:52:03Z Last seen 2026-11-11T16:18:22Z

http://167.86.74.11/api/v2/payload/download

5% low communicates

HTTP status 405 Content length 31 Content SHA256 83c09ba9a8daedb136f90b17a294caa90ad471a016e430df6e229acb5a81e100 First seen 2026-11-11T04:11:06Z Last seen 2026-11-11T16:18:22Z

http://167.86.74.11/api/v3/gate

5% low communicates

HTTP status 405 Content length 31 Content SHA256 83c09ba9a8daedb136f90b17a294caa90ad471a016e430df6e229acb5a81e100 First seen 2026-11-10T16:07:48Z Last seen 2026-11-11T16:18:22Z

http://ocsps.ssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQsejSLTD/jnEsvKhkZe…

0% communicates

TLD com HTTP status 200 Content length 314 Content SHA256 41491069cc76d95eb42a02ca8470fc4b30260486fac8caa6cc81c511b5ecdc13 First seen 2025-09-30T10:57:46Z

Analysis details

Severity: hightrojanwmi-activityexedebug-checkobfuscated64bitexec-delay

Freshness: Fresh · Last seen today.

Detection rate: 4%
Threat type: trojan
Family: agentb
Confidence: 58%
detection: 4 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b
SHA1: c96e5bcbb13b107c4525771a8e156cac736d8f63
MD5: 88960e5d6079c359e6a76063eddbf3fe
Filename: WlanSvc_Helper.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 2358272
Compile time: 2026-10-14T19:29:49Z
PE platform: x64 64-bit
PE sections: 7
Import libraries: 8
TLSH: T159B58D06A26800E8D1A7D1BC8D869807EBB27C45073597DF13D0D6A61FB76E19EFEB10
SSDEEP: 49152:TA/hbnZ+f1Mpu7kJbTpePMFx9p53GhW501zvYT6+YlNoPc2pCFcIY4Qwc9E:kMgJb+haTAahpCFE
Imphash: 8ef41c889c92bd0a85513ce83ab96670
Richhash: 6ce57e9ed3972740e76a01def0268b54
First seen: 2026-11-10T04:23:15Z
Last seen: 2026-11-11T16:18:16Z
Filename variants: 5 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (4%).

Confidence signal

VirusSign confidence is elevated at 58%. Use it as supporting evidence together with detections, family and relationship context.

Threat context

Classification includes type trojan and family agentb.

Relationship context

18 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

19 timestamped observations are arranged from 2007-03-01 to 2026-11-11. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

Engine detections 4%

Reported engine detection rate. A low rate alone does not establish that the indicator is benign.

VirusSign confidence 58%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 18 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification agentb

Classification context: type trojan, family agentb.

Intelligence freshness Fresh

Last seen today.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: WlanSvc_Helper.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 2358272
Compile time: 2026-10-14T19:29:49Z
PE platform: x64 64-bit
Entry point: 1289616
Sections: 7

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

wmi-activitydebug-checkexec-delayobfuscated

View details · 5 shown

A DLL was loaded from a suspicious directory
A process attempted to delay the analysis task.
Attempts to connect to a dead IP:Port
Authenticode signature is invalid
Binary contains paths to debug symbols

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1071 — A process attempted to delay the analysis task.
Tactics: TA0011
T1059 — Apparent Internal Usage of CMD.EXE
Tactics: TA0002
T1036 · T1553.002 — Authenticode signature is invalid
Tactics: TA0005 · TA0112
T1089 — Blocks network connection to security products
Tactics: TA0005

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
B0001.002 — CheckRemoteDebuggerPresent
Objectives: OB0001
Command and Control
Objectives: OB0004
Communication
Objectives: OC0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCPports 443, 80, 5053

5+ outbound connections observed
4 domains, 5+ IPs, 5+ URLs
Common ports: 443, 80, 5053
Protocols: HTTP, TCP

View details · 5 shown

Domain: 167.86.74.11
URL: http://167.86.74.11/api/v3/gate
Protocol: HTTP

Domain: 167.86.74.11
URL: http://167.86.74.11/api/v2/payload/download
Protocol: HTTP

IP: 9.9.9.9
Port: 5053
Protocol: TCP

IP: 8.8.8.8
Port: 443
Protocol: TCP

Domain: dns.google
URL: https://dns.google/resolve?name=get.yabgo.top&type=txt
Protocol: HTTP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: pool.hashvault.pro
Type: A
Answers: 185.84.98.85, 45.77.67.39
Response: NOERROR

Query: ocsps.ssl.com
Type: A
Answers: 99.84.132.47, 99.84.132.101, 99.84.132.62, 99.84.132.107
Response: NOERROR

Query: ocsps.ssl.com
Type: A
Answers: 52.85.129.3, 52.85.129.27, 52.85.129.57, 52.85.129.86
Response: NOERROR

Query: dns.quad9.net
Type: A
Answers: 149.112.112.112, 9.9.9.9
Response: NOERROR

Query: dns.google
Type: A
Answers: 8.8.8.8, 8.8.4.4
Response: NOERROR

5 shown

C2 candidates1

DNSports 53

1 C2 candidate communications
1 domains, 1 IPs
Common ports: 53
Protocols: DNS

View details · 1 shown

IP: 185.84.98.85
Domain: pool.hashvault.pro
Port: 53
Protocol: DNS

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2026-10-14T19:29:49Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 1289616
Sections: 7
Compile time: 2026-10-14T19:29:49Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 1669164
Raw size: 1669632
Permissions: rx
Entropy: 6.39

Name: .rdata
Virtual address: 1675264
Virtual size: 462330
Raw size: 462336
Permissions: r
Entropy: 5.56

Name: .data
Virtual address: 2138112
Virtual size: 156756
Raw size: 138752
Permissions: rw
Entropy: 4.84

Name: .pdata
Virtual address: 2297856
Virtual size: 68076
Raw size: 68096
Permissions: r
Entropy: 6.14

Name: .fptable
Virtual address: 2367488
Virtual size: 256
Raw size: 512
Permissions: rw
Entropy: 0.0

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: WINHTTP.dll
Functions: WinHttpAddRequestHeaders, WinHttpCloseHandle, WinHttpConnect, WinHttpGetDefaultProxyConfiguration, WinHttpGetIEProxyConfigForCurrentUser, WinHttpGetProxyForUrl, WinHttpOpen, WinHttpOpenRequest …

Library: bcrypt.dll
Functions: BCryptCloseAlgorithmProvider, BCryptCreateHash, BCryptDecrypt, BCryptDestroyHash, BCryptDestroyKey, BCryptEncrypt, BCryptFinishHash, BCryptGenerateSymmetricKey …

Library: CRYPT32.dll
Functions: CertFreeCertificateChain, CertFreeCertificateContext, CertGetCertificateChain, CertVerifyCertificateChainPolicy, CryptProtectData, CryptUnprotectData, CryptUnprotectMemory

Library: KERNEL32.dll
Functions: AcquireSRWLockExclusive, CancelIo, CancelIoEx, CloseHandle, CloseThreadpoolWork, CompareStringEx, CompareStringOrdinal, CompareStringW …

Library: ADVAPI32.dll
Functions: AdjustTokenPrivileges, AllocateAndInitializeSid, CloseServiceHandle, CreateProcessAsUserW, CreateServiceW, DuplicateTokenEx, FreeSid, GetAce …

5 shown

Resources2

2 resources

2 resources
Resource types: RT_MANIFEST, RT_VERSION

View details · 2 shown

Type: RT_VERSION
Language: ENGLISH US

Type: RT_MANIFEST
Language: ENGLISH US

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check