- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
245b7e368c08bf0699b8700cc479861b110eb374b03ba625482a4093dcad6c4c- SHA1
c5cc1a0cad8e1b31dc83a488525a887db95ce8ab- MD5
83a2507fdbc758f6103408996ef922af- Filename
- 245b7e36_launcher25.zip.bin
- File type
- zip
- MIME
- application/zip
- File size
- 116133249
- TLSH
T1D148336CF0F5794EF0DEC53A80727E74CBAC6C3492AE21E50A74758A5C9369E5B2C834- SSDEEP
3145728:uI56W+0bxVYFSrIZV8S0Zw7iLvBopVFUlZJ0rr2lA:TL+0bxVYFScuwOLvflZSr6y
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (10%).
Confidence signal
VirusSign confidence is elevated at 68%. Use it as supporting evidence together with detections, family and relationship context.
Analysis signals
OBSERVEDEngine detections10%
VirusSign confidence68%
Relationship context12 visible
Threat classificationtrojan
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
pedll
191864 bytes
drops
Filename
2b35b108_fil9c0c57448597e16820ba9a01982044a6.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
191864
Compile time
2046-12-05T12:08:28Z
0%
pedll
264885 bytes
contains
Filename
27219d36__msys_readline8.dll_67cf6ecd_5771_4a84_a55a_da77da3f5a2f.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
264885
Compile time
2023-01-17T21:31:36Z
0%
pedll
668483 bytes
drops
Filename
95b75116_is-l6pcf.tmp.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
668483
Compile time
2023-02-16T12:12:20Z
0%
pedll
338239 bytes
drops
Filename
dd44fe3b__msys_ncursesw6.dll_ba8d97d4_b1e3_4a71_aad8_920ca2fb8e6a.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
338239
Compile time
2023-01-29T10:00:15Z
0%
pedll
243180 bytes
contains
Filename
76c5398f_2333446880.exe.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
243180
Compile time
2022-12-29T09:25:05Z
Related IPs
Network IPs associated with this indicator.
5shown
0%
US
communicates
CIDR
104.21.0.0/17
Network
104.16.0.0-104.31.255.255
First seen
2024-12-06T13:32:44Z
Last seen
2026-11-14T18:10:13Z
0%
US
communicates
CIDR
104.21.0.0/17
Network
104.16.0.0-104.31.255.255
First seen
2024-03-08T16:28:18Z
Last seen
2026-11-14T18:10:13Z
5%
medium
US
communicates
CIDR
104.21.0.0/17
Network
104.16.0.0-104.31.255.255
First seen
2024-12-06T14:35:26Z
Last seen
2026-11-14T18:10:13Z
0%
US
communicates
CIDR
104.21.0.0/17
Network
104.16.0.0-104.31.255.255
First seen
2024-06-16T06:54:40Z
Last seen
2026-11-14T18:10:13Z
5%
medium
US
communicates
CIDR
104.21.0.0/17
Network
104.16.0.0-104.31.255.255
First seen
2024-12-04T05:34:02Z
Last seen
2026-11-14T18:10:13Z
Related domains
Domains associated with this indicator.
2shown
0%
.net
communicates
Root
azureedge.net
TLD
net
Subdomain
functionscdn
First seen
2026-06-27T12:45:19Z
Last seen
2026-06-27T12:45:19Z
27%
high
.click
communicates
Root
kitestarepatt.click
TLD
click
First seen
2025-05-12T06:17:41Z
Last seen
2026-08-10T18:14:39Z
Analysis details
Severity: criticaltrojanexec-delayembedded-executableinput-checkenv-checkdebug-checkzipstealerdiscovery
Freshness: Historical · Last seen 342 days ago.
- Detection rate
- 10%
- Threat type
- trojan
- Confidence
- 68%
- detection
- 10 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
245b7e368c08bf0699b8700cc479861b110eb374b03ba625482a4093dcad6c4c- SHA1
c5cc1a0cad8e1b31dc83a488525a887db95ce8ab- MD5
83a2507fdbc758f6103408996ef922af- Filename
- 245b7e36_launcher25.zip.bin
- File type
- zip
- MIME
- application/zip
- File size
- 116133249
- TLSH
T1D148336CF0F5794EF0DEC53A80727E74CBAC6C3492AE21E50A74758A5C9369E5B2C834- SSDEEP
3145728:uI56W+0bxVYFSrIZV8S0Zw7iLvBopVFUlZJ0rr2lA:TL+0bxVYFScuwOLvflZSr6y- First seen
- 2025-01-25T09:47:29Z
- Last seen
- 2025-12-07T03:36:09Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (10%).
Confidence signal
VirusSign confidence is elevated at 68%. Use it as supporting evidence together with detections, family and relationship context.
Threat context
Classification includes type trojan.
Relationship context
12 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
13 timestamped observations are arranged from 2022-12-29 to 2046-12-05. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan.
Last seen 342 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 245b7e36_launcher25.zip.bin
- File type
- zip
- MIME
- application/zip
- Size
- 116133249
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- Abnormal high CPU Usage
- Allocates memory with a write watch (potentially for evading sandboxes)
- At least one IP Address, Domain, or File Name was found in a crypto call
- Attempts to connect to a dead IP:Port (1 unique times)
- Checks available memory
5 shown
View MITRE ATT&CK details · 5 shown
- T1202 — Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.Tactics: TA0005
- T1057 — Adversaries may attempt to get information about running processes on a system.Tactics: TA0007
- T1071 — Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.Tactics: TA0011
- T1573 — Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.Tactics: TA0011
- T1497 — Adversaries may employ various means to detect and avoid virtualization and analysis environments.Tactics: TA0005 · TA0007
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- B0009.005 — Check Registry KeysObjectives: OB0001
- CommunicationObjectives: OC0006
- Defense EvasionObjectives: OB0006
- F0004 — Disable or Evade Security ToolsObjectives: OB0006
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity1
TCPports 443
- 1 outbound connections observed
- 0 domains, 1 IPs, 0 URLs
- Common ports: 443
- Protocols: TCP
View details · 1 shown
- IP
- 104.21.48.1
- Port
- 443
- Protocol
- TCP
DNS request activity1
A5+ response IPs
- 1 DNS requests observed
- 1 unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 1 shown
- Query
- kitestarepatt.click
- Type
- A
- Answers
- 104.21.64.1, 104.21.80.1, 104.21.16.1, 104.21.48.1, 104.21.96.1, 104.21.32.1, 104.21.112.1
- Response
- NOERROR
C2 candidates1
DNSports 53
- 1 C2 candidate communications
- 1 domains, 1 IPs
- Common ports: 53
- Protocols: DNS
View details · 1 shown
- IP
- 104.21.64.1
- Domain
- kitestarepatt.click
- Port
- 53
- Protocol
- DNS