Report - 3a8aec178e28…2cc8637ce6

Malicious HighFILE

Quota 32

First seen: 2026-09-13T15:29:02Z
Last seen: 2026-10-29T17:25:51Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYlazytrojan

RELATED INDICATORS20Connections in this report

ANALYSISMaliciousRecent

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 3a8aec178e284feeccfdc102b1fb35d4ce99cfc7ffef6c619c990e2cc8637ce6
SHA1: f325902a54e064a542089084a1b2daf58f4a1a39
MD5: 8ed062f71178e220f680457c1bbd1fd1
Filename: 3a8aec17_set-up.msi.bin
File type: msi
MIME: application/x-msi
File size: 3891200
TLSH: T18006220772A512FAD173933589621781EB727C200730A65B13A472B96F77B906D3FBB2
SSDEEP: 98304:SSqSh3Zqdx3ef4V1rcSFLjnWF8XzB6T4t:SxUJlfa/jgq6

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 59%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections59%

VirusSign confidence100%

Relationship context20 visible

Threat classificationlazy

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

20 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

2f26e611dd5b0a01e241331c610c86ba3961ca324ba4125d8de5dea045259d6b

57% critical peexe 3484672 bytes contains

Filename 2f26e611_7c1zz51.exe.bin Family ulise Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

7d14a89ab26ae12a3931a273c546de7d88f07dd80610afd48a2e05f14160a3ed

57% high peexe 337408 bytes drops

Filename 7d14a89a_2qtr9ebh1.exe.bin Family ulise Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

e615dc7f829349d173161a3467569f16d4dc86a75053023854da50e95ddcd844

0% text 90 bytes contains

Filename e615dc7f_!_columns (16).bin File type text MIME text/plain Size 90 SHA1 ae716fc7fd25edc6877fbdc5c12f51c56578ebab

c196c79cac8b29c428ebd5e84172425f0ae1f7a9beddd4b5aa05cba267210690

0% 12 bytes contains

Filename c196c79c_!media.bin MIME application/octet-stream Size 12 SHA1 145ca86ca54bb922a250b4aaaf88cdd641dd38de First seen 2015-07-23T17:02:53Z

512208a03aca2b2945b3d0d516f3d70cb0a33da4723c44ef5ea2849f1850d71b

0% 8 bytes contains

Filename 512208a0__icon.bin MIME application/octet-stream Size 8 SHA1 2a693a9cb16caba284976861e7f53b6954371aed First seen 2026-10-24T00:05:55Z

Related IPs

Network IPs associated with this indicator.

5shown

94.26.90.118

21% medium DE communicates

CIDR 94.26.90.0/24 Network 94.26.90.0-94.26.90.255 First seen 2025-04-28T11:31:54Z Last seen 2026-11-12T20:51:43Z

172.67.195.70

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-10-01T17:37:53Z Last seen 2026-11-13T12:40:48Z

104.21.92.149

0% US communicates

CIDR 104.21.0.0/17 Network 104.16.0.0-104.31.255.255 First seen 2023-09-30T05:34:55Z Last seen 2026-11-13T12:41:10Z

104.21.30.144

6% low US communicates

CIDR 104.21.0.0/17 Network 104.16.0.0-104.31.255.255 First seen 2023-09-30T20:45:19Z Last seen 2026-11-13T07:51:10Z

172.67.173.41

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-09-29T11:28:23Z Last seen 2026-11-13T01:46:11Z

Related domains

Domains associated with this indicator.

5shown

sonnetus4dot6.fun

11% medium .fun communicates

Root sonnetus4dot6.fun TLD fun First seen 2026-09-12T13:44:37Z Last seen 2026-10-29T17:24:53Z

localhost4000.fun

33% high .fun communicates

Root localhost4000.fun TLD fun First seen 2026-09-11T00:57:52Z Last seen 2026-11-12T20:51:43Z

api.localhost4000.fun

33% high .fun communicates

Root localhost4000.fun TLD fun Subdomain api First seen 2026-09-10T13:31:45Z Last seen 2026-11-11T21:01:14Z

tsisgettedflux.fun

5% low .fun communicates

Root tsisgettedflux.fun TLD fun First seen 2026-09-06T04:32:10Z Last seen 2026-10-29T17:24:53Z

api4.ipify.org

0% .org communicates

Root ipify.org TLD org Subdomain api4 First seen 2023-09-28T14:51:48Z Last seen 2026-11-13T19:48:05Z

Related URLs

URLs associated with this indicator.

5shown

https://sonnetus4dot6.fun/sync

0% communicates

TLD fun HTTP status 405 Content length 23 Content SHA256 12532477ed57684ac701cd69db198769976d62515bd9fe43ecd15d52dbb99025 First seen 2026-09-12T08:33:06Z

https://sonnetus4dot6.fun/data

0% communicates

TLD fun HTTP status 405 Content length 23 Content SHA256 12532477ed57684ac701cd69db198769976d62515bd9fe43ecd15d52dbb99025 First seen 2026-09-12T08:33:06Z

https://api.localhost4000.fun/new

32% high communicates

TLD fun HTTP status 200 Content length 3002 Content SHA256 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747 First seen 2026-09-09T19:32:19Z

https://tsisgettedflux.fun/sync

0% communicates

TLD fun HTTP status 405 Content length 23 Content SHA256 12532477ed57684ac701cd69db198769976d62515bd9fe43ecd15d52dbb99025 First seen 2026-09-06T14:11:59Z

https://tsisgettedflux.fun/data

0% communicates

TLD fun HTTP status 405 Content length 23 Content SHA256 12532477ed57684ac701cd69db198769976d62515bd9fe43ecd15d52dbb99025 First seen 2026-09-06T14:11:59Z

Analysis details

Severity: hightrojanusb-checkpolymorphicmsi

Freshness: Recent · Last seen 15 days ago.

Detection rate: 59%
Threat type: trojan
Family: lazy
Confidence: 100%
detection: 59 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 3a8aec178e284feeccfdc102b1fb35d4ce99cfc7ffef6c619c990e2cc8637ce6
SHA1: f325902a54e064a542089084a1b2daf58f4a1a39
MD5: 8ed062f71178e220f680457c1bbd1fd1
Filename: 3a8aec17_set-up.msi.bin
File type: msi
MIME: application/x-msi
File size: 3891200
TLSH: T18006220772A512FAD173933589621781EB727C200730A65B13A472B96F77B906D3FBB2
SSDEEP: 98304:SSqSh3Zqdx3ef4V1rcSFLjnWF8XzB6T4t:SxUJlfa/jgq6
First seen: 2026-09-13T15:29:02Z
Last seen: 2026-10-29T17:25:51Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 59%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family lazy.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 2015-07-23 to 2026-10-24. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 59%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 20 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification lazy

Classification context: type trojan, family lazy.

Intelligence freshness Recent

Last seen 15 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 3a8aec17_set-up.msi.bin
File type: msi
MIME: application/x-msi
Size: 3891200

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

usb-check

View details · 5 shown

Checks available memory
Checks for available system drives (often done to infect USB drives)
Checks system language via registry key (possible geofencing)
Checks the free space of harddrives
Classification label

5 shown

View MITRE ATT&CK details · 5 shown

T1082 — Checks available memory
Tactics: TA0007
T1091 · T1120 — Checks for available system drives (often done to infect USB drives)
Tactics: TA0001 · TA0007 · TA0008
T1055 — Creates a process in a suspended state, likely for injection
Tactics: TA0004 · TA0005
T1071 — HTTP traffic contains suspicious features which may be indicative of malware related traffic
Tactics: TA0011
T1543.003 — Modifies existing windows services
Tactics: TA0003 · TA0004

5 shown

View MBC details · 5 shown

Command and Control
Objectives: OB0004
Communication
Objectives: OC0006
C0016 — Create File
Objectives: OC0001
Defense Evasion
Objectives: OB0006
B0033 — Denial of Service
Objectives: OB0008

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 53, 7000

5+ outbound connections observed
4 domains, 5 IPs, 5+ URLs
Common ports: 443, 53, 7000, 80
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: api.localhost4000.fun
URL: https://api.localhost4000.fun/new
Protocol: HTTP

IP: 94.26.90.118
Port: 7000
Protocol: TCP

IP: 94.26.90.118
Port: 443
Protocol: TCP

Domain: sonnetus4dot6.fun
URL: https://sonnetus4dot6.fun/sync
Protocol: HTTP

Domain: sonnetus4dot6.fun
URL: https://sonnetus4dot6.fun/data
Protocol: HTTP

5 shown

DNS request activity5

A5+ response IPs

5 DNS requests observed
5 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: localhost4000.fun
Type: A
Answers: 94.26.90.118
Response: NOERROR

Query: api.localhost4000.fun
Type: A
Answers: 94.26.90.118
Response: NOERROR

Query: sonnetus4dot6.fun
Type: A
Answers: 172.67.195.70, 104.21.92.149
Response: NOERROR

Query: tsisgettedflux.fun
Type: A
Answers: 172.67.173.41, 104.21.30.144
Response: NOERROR

Query: api4.ipify.org
Type: A
Answers: 104.26.12.205, 172.67.74.152, 104.26.13.205
Response: NOERROR

C2 candidates5

DNS, TCP, HTTPports 53, 443, 7000

5 C2 candidate communications
2 domains, 1 IPs
Common ports: 53, 443, 7000
Protocols: DNS, TCP, HTTP

View details · 5 shown

Domain: api.localhost4000.fun
Protocol: HTTP

IP: 94.26.90.118
Domain: localhost4000.fun
Port: 53
Protocol: DNS

IP: 94.26.90.118
Domain: api.localhost4000.fun
Port: 53
Protocol: DNS

IP: 94.26.90.118
Port: 7000
Protocol: TCP

IP: 94.26.90.118
Port: 443
Protocol: TCP

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check