- First seen
- Last seen
THREAT SIGNALMedium
Read alongside the verdict
Indicator overview
INDICATOR PROFILEVirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.
- SHA256
31e044d3fbf6d6cc21f9fdff9560e058b07a8b3f47b35fa073289a75ee12646f- SHA1
37b8eebbedcd09dc09666d07d6cd1034ad1fb5f3- MD5
fc2d9db604bb25ee58b15f42f2cfbd14- Filename
- Installer_L_X64_x86_2024.zip
- File type
- zip
- MIME
- application/zip
- File size
- 66397755
- Filename variants
- 2 reported
- TLSH
T1AEE73360DF4E196AD25FBEF2D589172EE2A6D1589730E11F06F894413C933EA4F1B283- SSDEEP
1572864:a22L7I2+KDmtdj1WrF0s7JDIsZgz3Mk1Bu:aDatdBPs7JDBgbMSBu
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
High-confidence evidence. Related indicators in this report: 13. Review the supporting evidence before taking action.
Detection signal
Malicious. A limited set of engine detections is present (23%).
Confidence signal
VirusSign reports 93% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections23%
VirusSign confidence93%
Relationship context13 visible
Threat classificationrugmi
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
pedll
243180 bytes
drops
Filename
2333446880.exe
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
243180
Compile time
2022-12-29T09:25:05Z
0%
peexe
284448 bytes
drops
Filename
wf44s.exe
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
284448
Compile time
2022-10-29T11:36:08Z
0%
pedll
487736 bytes
drops
Filename
dokanfuse.dll
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
487736
Compile time
2021-11-26T17:42:23Z
0%
pedll
26752 bytes
contains
Filename
_92CADEE49D164AFCB17D56260C1AE1CE
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
26752
Compile time
2060-06-07T14:52:20Z
4%
low
pedll
493056 bytes
drops
Filename
VIDEO.DLL
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
493056
Compile time
2022-12-08T07:35:36Z
Related IPs
Network IPs associated with this indicator.
5shown
0%
US
communicates
CIDR
150.171.64.0/18
Network
150.171.0.0-150.171.255.255
First seen
2026-05-18T14:56:36Z
Last seen
2026-11-12T15:33:55Z
0%
US
communicates
CIDR
150.171.64.0/18
Network
150.171.0.0-150.171.255.255
First seen
2024-10-15T04:55:25Z
Last seen
2026-11-12T16:11:23Z
0%
US
communicates
CIDR
150.171.64.0/18
Network
150.171.0.0-150.171.255.255
First seen
2024-10-13T08:23:50Z
Last seen
2026-11-12T16:11:23Z
0%
US
communicates
CIDR
23.195.80.0/20
Network
23.192.0.0-23.223.255.255
First seen
2023-09-29T08:07:55Z
Last seen
2026-11-12T16:04:08Z
0%
US
communicates
CIDR
23.195.80.0/20
Network
23.192.0.0-23.223.255.255
First seen
2023-09-30T16:45:53Z
Last seen
2026-11-12T15:59:22Z
Related domains
Domains associated with this indicator.
3shown
0%
.net
communicates
Root
akamai.net
TLD
net
Subdomain
a1672.dscr
First seen
2025-05-29T12:07:07Z
Last seen
2026-11-12T16:11:34Z
0%
.net
communicates
Root
azureedge.net
TLD
net
Subdomain
edge-mobile-static
First seen
2023-09-30T16:35:46Z
Last seen
2026-11-12T16:11:24Z
0%
.com
communicates
Root
bing.com
TLD
com
Subdomain
business
First seen
2023-09-28T23:47:31Z
Last seen
2026-11-12T16:11:24Z
Analysis details
Severity: criticaltrojanembedded-executablezipdebug-checkloaderdiscoverypersistencestealerhijackloaderdefense-evasionspyware
Freshness: Fresh · Last seen 1 day ago.
- Detection rate
- 23%
- Threat type
- trojan
- Family
- rugmi
- Confidence
- 93%
- confidence
- 93 · VirusSign confidence; engine detections are reported separately.
Overview
- SHA256
31e044d3fbf6d6cc21f9fdff9560e058b07a8b3f47b35fa073289a75ee12646f- SHA1
37b8eebbedcd09dc09666d07d6cd1034ad1fb5f3- MD5
fc2d9db604bb25ee58b15f42f2cfbd14- Filename
- Installer_L_X64_x86_2024.zip
- File type
- zip
- MIME
- application/zip
- File size
- 66397755
- TLSH
T1AEE73360DF4E196AD25FBEF2D589172EE2A6D1589730E11F06F894413C933EA4F1B283- SSDEEP
1572864:a22L7I2+KDmtdj1WrF0s7JDIsZgz3Mk1Bu:aDatdBPs7JDBgbMSBu- First seen
- 2026-11-10T16:07:51Z
- Last seen
- 2026-11-11T11:19:45Z
- Filename variants
- 2 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
High-confidence evidence. Related indicators in this report: 13. Review the supporting evidence before taking action.
Detection signal
Malicious. A limited set of engine detections is present (23%).
Confidence signal
VirusSign reports 93% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family rugmi.
Relationship context
13 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
14 timestamped observations are arranged from 2021-11-26 to 2060-06-07. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family rugmi.
Last seen 1 day ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- Installer_L_X64_x86_2024.zip
- File type
- zip
- MIME
- application/zip
- Size
- 66397755
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- A file with an unusual extension was attempted to be loaded as a DLL.
- A scripting utility was executed
- Allocates memory with a write watch (potentially for evading sandboxes)
- At least one IP Address, Domain, or File Name was found in a crypto call
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1059 · T1064 — A scripting utility was executedTactics: TA0002 · TA0005
- T1497 — Allocates memory with a write watch (potentially for evading sandboxes)Tactics: TA0005 · TA0007
- T1071 — At least one IP Address, Domain, or File Name was found in a crypto callTactics: TA0011
- T1082 — Checks available memoryTactics: TA0007
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- B0009.005 — Check Registry KeysObjectives: OB0001
- E1059 — Command and Scripting InterpreterObjectives: OB0009
- CommunicationObjectives: OC0006
- Defense EvasionObjectives: OB0006
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity3
TCP, UDPports 443, 53
- 3 outbound connections observed
- 0 domains, 3 IPs, 0 URLs
- Common ports: 443, 53
- Protocols: TCP, UDP
View details · 3 shown
- IP
- 162.159.36.2
- Port
- 53
- Protocol
- UDP
- IP
- 150.171.73.13
- Port
- 443
- Protocol
- TCP
- IP
- 150.171.110.195
- Port
- 443
- Protocol
- TCP
DNS request activity3
A5 response IPs
- 3 DNS requests observed
- 3 unique queries
- 5 response IPs
- Query types: A
- Response codes: NOERROR
View details · 3 shown
- Query
- edge-mobile-static.azureedge.net
- Type
- A
- Answers
- 150.171.110.195
- Response
- NOERROR
- Query
- business.bing.com
- Type
- A
- Answers
- 150.171.74.13, 150.171.73.13
- Response
- NOERROR
- Query
- a1672.dscr.akamai.net
- Type
- A
- Answers
- 23.195.81.41, 23.195.81.34
- Response
- NOERROR