- First seen
- Last seen
THREAT SIGNALMedium-high
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
3753c224e5563843921dd75ba9eff3e7da784e993f75d042d4703d2f9ff4dec6- SHA1
b4e210eb5f4e8c807e4c5b94536677cc929aeeb8- MD5
a0a5d8a3e2c2ad6ffe67beb9b0e0d505- Filename
- 3753c224_57m1a.exe.bin
- File type
- vba
- MIME
- text/plain
- File size
- 753996
- TLSH
T159F47D368033BE9E163D2A88105C3C442CB83AC79375D5BDED49B472B5DD2A5EA3C9E4- SSDEEP
12288:FGMuySJIb4xIX/lGmTgsx10t9X07sQBGFM3nV/MHysw:FF8IP4mTgsx1OkJgyD
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 42%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections42%
VirusSign confidence100%
Relationship context20 visible
Threat classificationzbot
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
4%
low
peexe
3000 bytes
drops
Filename
1c20cea5_qis4i.exe.bin
Family
damaged
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
3000
38%
critical
powershell
748580 bytes
drops
Filename
96875a2b_rade145f.tmp.b64.bin
Family
tedy
Type
trojan
File type
powershell
MIME
text/plain
0%
284 bytes
drops
Filename
63f5865c_-b.bin
MIME
application/pkix-crl
Size
284
SHA1
335f8b4b1568a19a826540fb37d04e1a4b89d9e3
First seen
2026-11-11T18:45:42Z
0%
836 bytes
drops
Filename
10ce6a56_l)j.bin
MIME
application/octet-stream
Size
836
SHA1
fd73fb2e8db7ca9a391b2925cef3399e75d43790
First seen
2026-11-11T18:30:42Z
79%
critical
peexe
561152 bytes
drops
Filename
63589400_group_booking_1052_052img-1.exe.bin
Family
darkcloud
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Related IPs
Network IPs associated with this indicator.
5shown
SE
communicates
CIDR
23.216.128.0/21
Network
23.192.0.0-23.223.255.255
First seen
2025-04-10T13:00:18Z
Last seen
2026-11-13T14:18:40Z
0%
SE
communicates
CIDR
23.216.128.0/21
Network
23.192.0.0-23.223.255.255
First seen
2025-04-09T17:30:52Z
Last seen
2026-11-15T01:30:41Z
0%
DE
communicates
CIDR
88.221.168.0/22
Network
88.221.168.0-88.221.175.255
First seen
2024-02-28T12:14:35Z
Last seen
2026-11-15T07:30:30Z
0%
SE
communicates
CIDR
184.24.144.0/21
Network
184.24.0.0-184.31.255.255
First seen
2024-08-31T10:06:01Z
Last seen
2026-11-15T10:31:26Z
0%
US
communicates
CIDR
8.6.112.0/24
Network
8.6.112.0-8.6.112.255
First seen
2024-03-06T08:09:44Z
Last seen
2026-11-15T10:48:06Z
Related domains
Domains associated with this indicator.
5shown
0%
.org
communicates
Root
lencr.org
TLD
org
Subdomain
ye.c
First seen
2025-11-02T02:06:16Z
Last seen
2026-11-15T10:22:56Z
0%
.org
communicates
Root
lencr.org
TLD
org
Subdomain
ye1.c
First seen
2026-01-09T15:15:42Z
Last seen
2026-11-15T10:22:56Z
0%
.org
communicates
Root
lencr.org
TLD
org
Subdomain
x2.c
First seen
2023-09-29T07:34:34Z
Last seen
2026-11-15T10:22:56Z
5%
low
.net
communicates
Root
showip.net
TLD
net
First seen
2023-10-01T01:07:48Z
Last seen
2026-11-15T08:35:22Z
0%
.org
communicates
Root
lencr.org
TLD
org
Subdomain
x1.i
First seen
2023-09-30T05:09:58Z
Last seen
2026-11-15T10:52:07Z
Related URLs
URLs associated with this indicator.
5shown
0%
communicates
TLD
com
HTTP status
200
Content length
5652
Content SHA256
1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0
First seen
2026-11-13T09:23:15Z
0%
communicates
TLD
org
HTTP status
200
Content length
14833
Content SHA256
d974b14c7646d097035a577b056bcfc7f43d5a241b93a38492e0543ef65c1f0a
First seen
2026-06-14T17:12:28Z
0%
communicates
TLD
org
HTTP status
200
Content length
284
Content SHA256
63f5865ca379cf463bd50ee4f7ea5458d711654041a98b0c5bec93d8b1875703
First seen
2026-03-08T10:05:29Z
0%
communicates
TLD
org
HTTP status
200
Content length
368
Content SHA256
12e613923dd9ca250d5017082de3406acdc0fae64a425cd9ed6af0ace2a6295c
First seen
2021-06-29T15:53:43Z
5%
low
communicates
TLD
net
HTTP status
200
Content length
67200
Content SHA256
be0ec3a6812c29212503806c64692444770e3016142cc9a1d6023c9446403307
First seen
2012-09-16T21:23:59Z
Analysis details
Severity: hightrojanfile-writevbaexec-dllexecanalysis-evasionexe-patternobfuscated
Freshness: Fresh · Last seen 1 day ago.
- Detection rate
- 42%
- Threat type
- trojan
- Family
- zbot
- Confidence
- 100%
- detection
- 42 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
3753c224e5563843921dd75ba9eff3e7da784e993f75d042d4703d2f9ff4dec6- SHA1
b4e210eb5f4e8c807e4c5b94536677cc929aeeb8- MD5
a0a5d8a3e2c2ad6ffe67beb9b0e0d505- Filename
- 3753c224_57m1a.exe.bin
- File type
- vba
- MIME
- text/plain
- File size
- 753996
- TLSH
T159F47D368033BE9E163D2A88105C3C442CB83AC79375D5BDED49B472B5DD2A5EA3C9E4- SSDEEP
12288:FGMuySJIb4xIX/lGmTgsx10t9X07sQBGFM3nV/MHysw:FF8IP4mTgsx1OkJgyD- First seen
- 2026-11-13T08:12:50Z
- Last seen
- 2026-11-13T14:18:37Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 42%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family zbot.
Relationship context
20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
21 timestamped observations are arranged from 2012-09-16 to 2026-11-13. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family zbot.
Last seen 1 day ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 3753c224_57m1a.exe.bin
- File type
- vba
- MIME
- text/plain
- Size
- 753996
Observed behavior
summaryBehavioral indicators observed during analysis. More details and additional structured data are available through API and data access.
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
HTTP, TCPports 80, 443
- 5+ outbound connections observed
- 5+ domains, 4 IPs, 5+ URLs
- Common ports: 80, 443
- Protocols: HTTP, TCP
View details · 5 shown
- IP
- 162.55.60.2
- Port
- 443
- Protocol
- TCP
- IP
- 162.55.60.2
- Port
- 80
- Protocol
- TCP
- Domain
- showip.net
- URL
- http://showip.net/
- Protocol
- HTTP
- Domain
- ye1.c.lencr.org
- URL
- http://ye1.c.lencr.org/98.crl
- Protocol
- HTTP
- Domain
- ye.c.lencr.org
- URL
- http://ye.c.lencr.org/
- Protocol
- HTTP
5 shown
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- showip.net
- Type
- A
- Answers
- 162.55.60.2
- Response
- NOERROR
- Query
- ye1.c.lencr.org
- Type
- A
- Answers
- 8.6.112.0, 8.47.69.0
- Response
- NOERROR
- Query
- ye.c.lencr.org
- Type
- A
- Answers
- 23.216.134.163, 23.216.134.158
- Response
- NOERROR
- Query
- x2.c.lencr.org
- Type
- A
- Answers
- 184.24.145.128, 88.221.169.173
- Response
- NOERROR
- Query
- x2.c.lencr.org
- Type
- A
- Answers
- 184.24.145.128
- Response
- NOERROR
5 shown