- First seen
- Last seen
THREAT SIGNALHigh
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
252fee9849621c94d082bb67cf50667b6b8d3bb183de523db85566d85c44366c- SHA1
6490214f978627bd2837229af25c4b53f88c6cb8- MD5
ad264d792a3cc89af6f70ea9d99e5b70- Filename
- csrss.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 1954304
- Compile time
- 2022-09-22T07:55:48Z
- PE platform
- x86 32-bit
- PE sections
- 4
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 19. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 75%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections75%
VirusSign confidence100%
Relationship context19 visible
Threat classificationjaik
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
1shown
75%
critical
peexe
1954304 bytes
drops
Filename
csrss.exe
Family
jaik
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Dropped / child files
Files dropped, bundled, or created by the queried file.
3shown
0%
ico
104 bytes
contains
Filename
118
File type
ico
MIME
application/octet-stream
Size
104
SHA1
fdc01cfa64eb3d2e79523650977aa574377c4952
0%
ico
104 bytes
contains
Filename
401
File type
ico
MIME
application/octet-stream
Size
104
SHA1
253a49e38ee7cb37a297abe0a951bb87459cb483
75%
critical
peexe
1954304 bytes
drops
Filename
csrss.exe
Family
jaik
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Related IPs
Network IPs associated with this indicator.
5shown
5%
low
US
communicates
CIDR
50.63.136.0/21
Network
50.62.0.0-50.63.255.255
First seen
2026-05-08T12:56:12Z
Last seen
2026-06-06T17:03:33Z
0%
US
communicates
CIDR
23.32.75.0/24
Network
23.32.0.0-23.67.255.255
First seen
2026-06-08T22:40:52Z
Last seen
2026-11-13T01:01:21Z
0%
US
communicates
CIDR
23.32.75.0/24
Network
23.32.0.0-23.67.255.255
First seen
2023-09-29T10:08:22Z
Last seen
2026-11-13T01:18:44Z
0%
US
communicates
CIDR
23.32.75.0/24
Network
23.32.0.0-23.67.255.255
First seen
2026-05-29T19:40:23Z
Last seen
2026-11-13T01:01:21Z
0%
US
communicates
CIDR
92.223.107.0/24
Network
92.223.107.0-92.223.107.255
First seen
2026-06-02T03:26:04Z
Last seen
2026-11-13T01:12:51Z
Related domains
Domains associated with this indicator.
5shown
0%
.com
communicates
Root
bmw-iraq.com
TLD
com
First seen
2025-08-02T18:05:52Z
Last seen
2026-05-11T15:19:06Z
0%
.com
communicates
Root
biglinktechnology.com
TLD
com
First seen
2026-04-07T19:42:13Z
Last seen
2026-04-29T19:14:43Z
0%
.edu.eg
communicates
Root
moe.edu.eg
TLD
edu.eg
Subdomain
behera4
First seen
2023-12-17T14:14:05Z
Last seen
2026-01-18T12:14:00Z
0%
.net
communicates
Root
baghyshaqlawa.net
TLD
net
First seen
2025-12-21T02:48:51Z
Last seen
2026-03-19T02:14:59Z
0%
.org
communicates
Root
amarfoundation.org
TLD
org
First seen
2025-12-31T15:37:54Z
Last seen
2026-03-26T00:05:46Z
Related URLs
URLs associated with this indicator.
5shown
0%
communicates
TLD
com
HTTP status
302
First seen
2023-10-19T12:41:36Z
Last seen
2026-01-18T12:14:01Z
12%
high
communicates
TLD
com
HTTP status
200
Content length
5935
Content SHA256
0b123c03e5b2b453b8a4d4f346c556c14c862f0a51a90f5cd55cc8116ce73fe8
First seen
2023-10-19T21:57:31Z
0%
communicates
TLD
co
HTTP status
404
Content length
1699
Content SHA256
cdc8b52c9402b72ef9c698027c0d2ea63058ed98b832a31d3ac57c9e7f8b35ed
First seen
2023-10-19T12:15:55Z
0%
communicates
TLD
net
HTTP status
404
Content length
5028
Content SHA256
5d06bf5a234da21fe9b78c37801f73112d52a937564c89d2a2eb5fa1202e0d11
First seen
2023-10-20T17:04:22Z
0%
communicates
TLD
co
HTTP status
404
Content length
315
Content SHA256
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
First seen
2023-10-20T11:18:41Z
Analysis details
Severity: criticaltrojansshpolymorphicexeexec-delaydebug-checkcve-2009-4873cve-2014-6345cve-2015-1729exploitsmtp
Freshness: Aging · Last seen 43 days ago.
- Detection rate
- 75%
- Threat type
- trojan
- Family
- jaik
- Confidence
- 100%
- detection
- 75 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
252fee9849621c94d082bb67cf50667b6b8d3bb183de523db85566d85c44366c- SHA1
6490214f978627bd2837229af25c4b53f88c6cb8- MD5
ad264d792a3cc89af6f70ea9d99e5b70- Filename
- csrss.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 1954304
- Compile time
- 2022-09-22T07:55:48Z
- PE platform
- x86 32-bit
- PE sections
- 4
- Import libraries
- 5
- TLSH
T10595229382E03C81E5AA8E369F1FC6E87A1DF1505F4E7B7A2105996F48721F2D323716- SSDEEP
49152:8NGmjPqiUZYT8e5URD33Aa7qshTTUGtxlJ:8RjV51WHN7qshTTvvb- Imphash
16c23701599478a5f3c58f9b8290f3cd- Richhash
bf0974591f9565fda82975f91c7b0b26- First seen
- 2023-10-20T03:38:59Z
- Last seen
- 2026-09-30T22:06:57Z
- Filename variants
- 2 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 19. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 75%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family jaik.
Relationship context
19 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
18 timestamped observations are arranged from 2017-04-05 to 2026-06-08. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
5 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family jaik.
Last seen 43 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- csrss.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 1954304
- Compile time
- 2022-09-22T07:55:48Z
- PE platform
- x86 32-bit
- Entry point
- 17743
- Sections
- 4
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- Binary may include packed or encrypted code
- Classification label
- Connects to IPs without corresponding DNS lookups
- Connects to several IPs in different countries
- Creates a process in suspended mode (likely to inject code)
5 shown
View MITRE ATT&CK details · 5 shown
- T1027.002 — Binary may include packed or crypted dataTactics: TA0005
- T1571 — Detected TCP or UDP traffic on non-standard portsTactics: TA0011
- T1036 — Drops PE files with benign system namesTactics: TA0005
- T1055 — Injects a PE file into a foreign processesTactics: TA0004 · TA0005
- T1497 — May sleep (evasive loops) to hinder dynamic analysisTactics: TA0005 · TA0007
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCP, HTTP, UDPports 443, 80, 9001
- 5+ outbound connections observed
- 5+ domains, 5+ IPs, 5+ URLs
- Common ports: 443, 80, 9001, 25, 995
- Protocols: TCP, HTTP, UDP
View details · 5 shown
- Domain
- academiapreuniversitariaelite.com
- URL
- http://academiapreuniversitariaelite.com/administrator/index.php
- Protocol
- HTTP
- Domain
- academiapreuniversitariaelite.com
- URL
- http://academiapreuniversitariaelite.com/administrator/
- Protocol
- HTTP
- Domain
- academiapreuniversitariaelite.com
- URL
- http://academiapreuniversitariaelite.com/admin
- Protocol
- HTTP
- IP
- 3.33.130.190
- Port
- 80
- Protocol
- TCP
- IP
- 198.185.159.144
- Port
- 80
- Protocol
- TCP
5 shown
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- zuhausbio.com
- Type
- A
- Answers
- 50.87.170.192
- Response
- NOERROR
- Query
- yihaomesh.com
- Type
- A
- Answers
- 162.241.253.36
- Response
- NOERROR
- Query
- ye-awards.com
- Type
- A
- Answers
- 192.185.129.41
- Response
- NOERROR
- Query
- www.nigeriaelectricityhub.com
- Type
- A
- Answers
- 104.21.25.18, 172.67.222.3
- Response
- NOERROR
- Query
- www.fastmail.com
- Type
- A
- Answers
- 141.193.213.21, 141.193.213.20
- Response
- NOERROR
5 shown
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit4 sections
- Platform: x86 32-bit
- Sections: 4
- Entry point: present
- Compile time: 2022-09-22T07:55:48Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 17743
- Sections
- 4
- Compile time
- 2022-09-22T07:55:48Z
PE sections4
4 sections
- 4 PE sections
- Common permissions: r, rw, rx
- 4 unique section names
View details · 4 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 1849890
- Raw size
- 1850368
- Permissions
- rx
- Entropy
- 8.0
- Name
- .data
- Virtual address
- 1855488
- Virtual size
- 1531900
- Raw size
- 7168
- Permissions
- rw
- Entropy
- 2.46
- Name
- .rsrc
- Virtual address
- 3387392
- Virtual size
- 81032
- Raw size
- 81408
- Permissions
- r
- Entropy
- 4.35
- Name
- .reloc
- Virtual address
- 3469312
- Virtual size
- 13964
- Raw size
- 14336
- Permissions
- r
- Entropy
- 1.85
Imports5
5 DLL groups
- 5 import DLL groups
- 5+ imported functions summarized
View details · 5 shown
- Library
- ADVAPI32.dll
- Functions
- RegOpenKeyA
- Library
- SHELL32.dll
- Functions
- ExtractAssociatedIconW
- Library
- KERNEL32.dll
- Functions
- AddAtomW, AddConsoleAliasW, BackupWrite, BeginUpdateResourceA, BeginUpdateResourceW, CloseHandle, CreateFileA, CreateHardLinkA …
- Library
- GDI32.dll
- Functions
- GetBitmapDimensionEx, GetCharABCWidthsFloatA
- Library
- USER32.dll
- Functions
- ChangeDisplaySettingsW, CharToOemBuffA, GetWindowTextLengthW, LoadMenuA
Resources5+
5+ resources
- 5+ resources
- Resource types: RT_ICON, RT_GROUP_ICON, RT_STRING, RT_ACCELERATOR, RT_VERSION
View details · 5 shown
- Type
- RT_ICON
- Language
- ENGLISH US
- Type
- RT_STRING
- Language
- ENGLISH US
- Type
- RT_ACCELERATOR
- Language
- ENGLISH US
- Type
- RT_GROUP_ICON
- Language
- ENGLISH US
- Type
- RT_VERSION
- Language
- ENGLISH US