- First seen
- Last seen
THREAT SIGNALHigh
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
36749748e93aab33d1f68e82f6360c0d91940dbea20ad1869bc18e4ad2875440- SHA1
5e3df0c2a538f80ede7a9c02227482c6f1d7160b- MD5
b40226eda0eb2e200cccc5919e993816- Filename
- b40226eda0eb2e200cccc5919e993816.virus
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 8946248
- Compile time
- 2019-06-26T19:51:23Z
- PE platform
- x86 32-bit
- PE sections
- 4
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 15. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 78%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections78%
VirusSign confidence100%
Relationship context15 visible
Threat classificationequationdrug
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
3shown
75%
high
peexe
351744 bytes
drops
Filename
rgmlwk.exe
Family
dacic
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
71%
high
peexe
340480 bytes
drops
Filename
kiufbmttb.exe
Family
masscan
Type
hacktool
File type
peexe
MIME
application/vnd.microsoft.portable-executable
80%
high
peexe
390304 bytes
drops
Filename
mimikatz.exe
Family
mimikatz
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Related IPs
Network IPs associated with this indicator.
5shown
US
communicates
CIDR
69.25.12.0/22
First seen
2023-03-03T05:09:11Z
Last seen
2025-12-26T03:14:34Z
US
communicates
CIDR
69.25.12.0/22
First seen
2024-04-29T03:44:34Z
Last seen
2025-12-26T03:14:34Z
US
communicates
CIDR
69.25.12.0/22
First seen
2023-03-03T05:09:11Z
Last seen
2025-12-26T03:14:34Z
US
communicates
CIDR
69.25.12.0/22
First seen
2023-03-03T05:09:11Z
Last seen
2025-12-26T03:14:34Z
US
communicates
CIDR
69.25.11.0/24
First seen
2024-08-07T05:17:01Z
Last seen
2025-12-26T03:14:34Z
Related domains
Domains associated with this indicator.
5shown
5%
low
.com
communicates
Root
ip138.com
TLD
com
Subdomain
2019
First seen
2023-10-01T09:11:15Z
Last seen
2026-11-07T11:04:36Z
28%
medium
.se
communicates
Root
hognoob.se
TLD
se
Subdomain
pxx
First seen
2022-05-02T17:04:14Z
Last seen
2026-10-20T00:45:48Z
21%
medium
.se
communicates
Root
hognoob.se
TLD
se
Subdomain
haq
First seen
2022-05-02T17:04:14Z
Last seen
2026-10-20T00:45:48Z
22%
medium
.se
communicates
Root
hognoob.se
TLD
se
Subdomain
yxw
First seen
2022-04-07T12:11:03Z
Last seen
2026-10-25T20:48:18Z
21%
high
.info
communicates
Root
heroherohero.info
TLD
info
Subdomain
uio
First seen
2023-09-30T19:25:29Z
Last seen
2026-10-25T20:48:18Z
Related URLs
URLs associated with this indicator.
2shown
14%
high
communicates
TLD
info
First seen
2019-03-11T09:30:12Z
Last seen
2026-10-20T00:45:49Z
18%
medium
communicates
TLD
se
First seen
2019-03-13T19:36:44Z
Last seen
2026-10-20T00:45:49Z
Analysis details
Severity: criticaltrojanexefile-overlaycpu-clockinput-checkdynamic-loadingmimikatzsigned
Freshness: Historical · Last seen 1350 days ago.
- Detection rate
- 78%
- Threat type
- trojan
- Family
- equationdrug
- Confidence
- 100%
- detection
- 78 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
36749748e93aab33d1f68e82f6360c0d91940dbea20ad1869bc18e4ad2875440- SHA1
5e3df0c2a538f80ede7a9c02227482c6f1d7160b- MD5
b40226eda0eb2e200cccc5919e993816- Filename
- b40226eda0eb2e200cccc5919e993816.virus
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 8946248
- Compile time
- 2019-06-26T19:51:23Z
- PE platform
- x86 32-bit
- PE sections
- 4
- Import libraries
- 16
- TLSH
T101960222B65084B1D1CA017055FB5B37AAB976190B24F5CFB79CCD6A2F32390EE36319- SSDEEP
196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1- Imphash
41d4c56009e4f7c74b5cb4a5919d9f05- Richhash
d21ee942caf32cae013641485ef8032c- First seen
- 2023-02-24T16:37:12Z
- Last seen
- 2023-03-04T07:02:25Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 15. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 78%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family equationdrug.
Relationship context
15 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
16 timestamped observations are arranged from 2018-08-19 to 2024-08-07. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family equationdrug.
Last seen 1350 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- b40226eda0eb2e200cccc5919e993816.virus
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 8946248
- Compile time
- 2019-06-26T19:51:23Z
- PE platform
- x86 32-bit
- Entry point
- 625877
- Sections
- 4
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- This sample appears to be an installer. capa cannot handle installers well. This means the results may be misleading or incomplete. You should try to understand the install mechanism and analyze created files with capa.
- This sample appears to be packed. Packed samples have often been obfuscated to hide their logic. capa cannot handle obfuscation well. This means the results may be misleading or incomplete. If possible, you should try to unpack this input file before analyzin…
- access PEB ldr_data
- all known techniques for receiving data from a potential C2 server
- all known techniques for sending data to a potential C2 server
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCP, HTTP, UDPports 7001, 443, 53
- 5+ outbound connections observed
- 2 domains, 5+ IPs, 2 URLs
- Common ports: 7001, 443, 53, 80
- Protocols: TCP, HTTP, UDP
View details · 5 shown
- Domain
- uio.hognoob.se
- URL
- http://uio.hognoob.se:63145/cfg.ini
- Protocol
- HTTP
- Domain
- uio.heroherohero.info
- URL
- http://uio.heroherohero.info:63145/cfg.ini
- Protocol
- HTTP
- IP
- 8.8.8.8
- Port
- 53
- Protocol
- UDP
- IP
- 69.25.9.234
- Port
- 7001
- Protocol
- TCP
- IP
- 69.25.9.173
- Port
- 7001
- Protocol
- TCP
5 shown
DNS request activity5+
A1 response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 1 response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- yxw.hognoob.se
- Query
- uio.hognoob.se
- Query
- uio.heroherohero.info
- Query
- pxx.hognoob.se
- Query
- pxi.hognoob.se
5 shown
C2 candidates2
HTTP
- 2 C2 candidate communications
- 2 domains, 0 IPs
- Protocols: HTTP
View details · 2 shown
- Domain
- uio.hognoob.se
- Protocol
- HTTP
- Domain
- uio.heroherohero.info
- Protocol
- HTTP
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit4 sections
- Platform: x86 32-bit
- Sections: 4
- Entry point: present
- Compile time: 2019-06-26T19:51:23Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 625877
- Sections
- 4
- Compile time
- 2019-06-26T19:51:23Z
PE sections4
4 sections
- 4 PE sections
- Common permissions: r, rw, rx
- 4 unique section names
View details · 4 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 756338
- Raw size
- 757760
- Permissions
- rx
- Entropy
- 6.52
- Name
- .rdata
- Virtual address
- 761856
- Virtual size
- 5856114
- Raw size
- 5857280
- Permissions
- r
- Entropy
- 7.74
- Name
- .data
- Virtual address
- 6619136
- Virtual size
- 302378
- Raw size
- 73728
- Permissions
- rw
- Entropy
- 5.25
- Name
- .rsrc
- Virtual address
- 6922240
- Virtual size
- 16
- Raw size
- 4096
- Permissions
- r
- Entropy
- 0.0
Imports5+
5+ DLL groups
- 5+ import DLL groups
- 5+ imported functions summarized
View details · 5 shown
- Library
- comdlg32.dll
- Functions
- ChooseColorA, GetFileTitleA, GetOpenFileNameA, GetSaveFileNameA
- Library
- iphlpapi.dll
- Functions
- GetAdaptersInfo
- Library
- OLEAUT32.dll
- Functions
- LHashValOfNameSys, LoadTypeLib, RegisterTypeLib, SafeArrayAccessData, SafeArrayCreate, SafeArrayDestroy, SafeArrayGetDim, SafeArrayGetElement …
- Library
- WINMM.dll
- Functions
- midiOutPrepareHeader, midiOutReset, midiOutUnprepareHeader, midiStreamClose, midiStreamOpen, midiStreamOut, midiStreamProperty, midiStreamRestart …
- Library
- WININET.dll
- Functions
- HttpOpenRequestA, HttpQueryInfoA, HttpSendRequestA, InternetCanonicalizeUrlA, InternetCloseHandle, InternetConnectA, InternetCrackUrlA, InternetOpenA …
5 shown
File certificate
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Certificates5+
5+ issuers
- Example subject: Microsoft Code Signing PCA
- Issued by: Microsoft Root Authority
View details · 5 shown
- Subject
- Microsoft Code Signing PCA
- Issuer
- Microsoft Root Authority
- Fingerprint
- 3036E3B25B88A55B86FC90E6E9EAAD5081445166
- Subject
- Microsoft Corporation
- Issuer
- Microsoft Code Signing PCA
- Fingerprint
- 9617094A1CFB59AE7C1F7DFDB6739E4E7C40508F
- Subject
- Microsoft Timestamping PCA
- Issuer
- Microsoft Root Authority
- Fingerprint
- 3EA99A60058275E0ED83B892A909449F8C33B245
- Subject
- Microsoft Time-Stamp Service
- Issuer
- Microsoft Timestamping PCA
- Fingerprint
- 4D6F357F0E6434DA97B1AFC540FB6FDD0E85A89F
- Subject
- Certum Code Signing CA SHA2
- Issuer
- Certum Trusted Network CA
- Fingerprint
- 905DE119F6A0118CFFBF8B69463EFE5BD0C1D322
5 shown