Report - 482d06d8f863…215d4e2f34

Suspicious HighFILE

Quota 40

First seen: 2026-10-16T10:06:04Z
Last seen: 2026-10-23T16:28:38Z

THREAT SIGNALMedium-low Read alongside the verdict

CONFIDENCE80%VirusSign analysis

FAMILYdefillertrojan

RELATED INDICATORS20Connections in this report

ANALYSISSuspiciousRecent

Indicator overview

INDICATOR PROFILE

VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.

SHA256: 482d06d8f8632419c9bcc5c08381e752e8622456d6cb6aa3c9e57f215d4e2f34
SHA1: a65e2843a10119134c380567a753ce8394ba514b
MD5: 72bbf1de5d3c7fb44302d7dcbaeef3e5
Filename: 3ttfyarryp.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 33814254
Compile time: 2022-07-08T23:37:58Z
PE platform: x64 64-bit
PE sections: 7

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

High-confidence evidence. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Suspicious. A limited set of engine detections is present (9%).

Confidence signal

VirusSign reports 80% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections9%

VirusSign confidence80%

Relationship context20 visible

Threat classificationdefiller

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

20 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

a7a0b5c9d3213154ab4da1c6edd8c4e5a60afc2587616764c2435d59ff53b9e1

0% 2289336 bytes drops

MIME application/octet-stream Size 2289336 SHA1 0756f5046c4b23bbd215a682143bb0de7c92dc78 First seen 2026-10-16T05:02:07Z Last seen 2026-10-16T05:02:07Z

f2c0375c6fb9493f082a631a7fa6eebe46866cfeea18e21cba476ed0497555a8

4% low pedll 3072 bytes drops

Filename nh4trke3.dll Type malware File type pedll MIME application/vnd.microsoft.portable-executable Size 3072

62188c0ab8d94d41bae4539f7caffd0490e6a4c08ecbeb080272d3c690f9a98b

0% coff 1324 bytes drops

Filename RES9296.tmp File type coff MIME application/octet-stream Size 1324 SHA1 8812c2d3cc504022839e197aed4e9da7d0cc20d4

1e36680b09618795f563965efe4e20503e37badbfdec179d8908b9ccd0258180

70% high peexe 2936832 bytes drops

Filename 434222774 Family sdum Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

3a34c821a9321e3799331f52a1a84b6eb1bc7a3e931c92006b6f52543722611d

33% high peexe 2929664 bytes drops

Filename 434822739 Family convagent Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

Related IPs

Network IPs associated with this indicator.

5shown

192.162.199.246

30% high DE communicates

CIDR 192.162.199.0/24 Network 192.162.199.0-192.162.199.255 First seen 2024-07-31T20:28:57Z Last seen 2026-10-29T20:05:46Z

104.21.73.196

0% US communicates

CIDR 104.21.0.0/17 Network 104.16.0.0-104.31.255.255 First seen 2023-10-01T13:50:08Z Last seen 2026-11-11T05:02:42Z

172.67.189.119

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-09-30T01:59:27Z Last seen 2026-11-11T16:52:38Z

104.21.41.59

0% US communicates

CIDR 104.21.0.0/17 Network 104.16.0.0-104.31.255.255 First seen 2023-09-30T12:15:56Z Last seen 2026-11-11T16:52:38Z

172.67.148.203

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-09-29T18:51:56Z Last seen 2026-11-11T05:02:42Z

Related domains

Domains associated with this indicator.

5shown

mail0.runport23.lat

25% high .lat communicates

Root runport23.lat TLD lat Subdomain mail0 First seen 2026-09-25T08:21:55Z Last seen 2026-11-11T16:51:50Z

content.brightplaza.lat

30% high .lat communicates

Root brightplaza.lat TLD lat Subdomain content First seen 2026-09-26T19:16:46Z Last seen 2026-11-11T05:02:42Z

queue.grovewest89.club

35% high .club communicates

Root grovewest89.club TLD club Subdomain queue First seen 2026-09-24T02:53:23Z Last seen 2026-11-11T16:52:38Z

grovewest89.club

26% high .club communicates

Root grovewest89.club TLD club First seen 2026-09-22T04:43:22Z Last seen 2026-11-09T15:00:40Z

guard7.barnfabric.click

38% high .click communicates

Root barnfabric.click TLD click Subdomain guard7 First seen 2026-08-28T03:22:04Z Last seen 2026-11-11T05:03:34Z

Related URLs

URLs associated with this indicator.

5shown

https://guard7.barnfabric.click/tqfpylvwjopqnbtcfpgcfilsfpbrlrpqpmfpgcfptgddmnd/z…

33% high communicates

TLD click HTTP status 200 First seen 2026-10-15T11:03:27Z Last seen 2026-10-15T11:03:27Z

https://api.telegra.ph/getPage/Still-summary-ivory-north-09-21?…

5% low communicates

TLD ph HTTP status 200 Content length 313 Content SHA256 598dac30410de969ed2ef50f23dc796ebc75b71d8b86a1c2f2ef1c694b40f85a First seen 2026-09-27T06:23:06Z

https://api.telegra.ph/getPage/Trail-field-09-21?…

5% low communicates

TLD ph HTTP status 200 Content length 270 Content SHA256 523f950c7d4eb9c9a311bec020fb076424f5434f720cb63ae0915a9ff0ab65a3 First seen 2026-09-27T06:23:06Z

https://queue.grovewest89.club/gateway

5% medium communicates

TLD club HTTP status 404 Content length 520 Content SHA256 3ecd8677c17e7bd75f697f2ab3fb8ee834705d4a2c36e7640e2e2d0133bfa985 First seen 2026-09-24T08:38:07Z

http://192.162.199.246/m2/mKM65Cf6QNqeOVw9.exe

36% high communicates

HTTP status 200 Content length 5298176 Content SHA256 ededb8c3c1bb860eec467899811b4216182ecc525ecdf9df11f8514adbbaeaed First seen 2026-09-16T00:50:39Z Last seen 2026-10-18T04:04:14Z

Analysis details

Severity: hightrojanfile-overlayfile-corrupted64bitexewmi-activitymacro-psobfuscatedpersistenceself-delete

Freshness: Recent · Last seen 19 days ago.

Detection rate: 9%
Threat type: trojan
Family: defiller
Confidence: 80%
confidence: 80 · VirusSign confidence; engine detections are reported separately.

Overview

SHA256: 482d06d8f8632419c9bcc5c08381e752e8622456d6cb6aa3c9e57f215d4e2f34
SHA1: a65e2843a10119134c380567a753ce8394ba514b
MD5: 72bbf1de5d3c7fb44302d7dcbaeef3e5
Filename: 3ttfyarryp.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 33814254
Compile time: 2022-07-08T23:37:58Z
PE platform: x64 64-bit
PE sections: 7
Import libraries: 11
TLSH: T160777C03B2A501E6E4B7D138C9A71203E772B86747358BCF325D02161FBBAE05A7E765
SSDEEP: 393216:qQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgE96l+ZArYsFRlv:q3on1HvSzxAMNEFZArYsH
Imphash: f0486e7e054aa57188c99b0f71783b75
Richhash: 99a88b8ab9b2858be1b5ce9fe67d1e20
First seen: 2026-10-16T10:06:04Z
Last seen: 2026-10-23T16:28:38Z
Filename variants: 3 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

High-confidence evidence. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Suspicious. A limited set of engine detections is present (9%).

Confidence signal

VirusSign reports 80% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family defiller.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 2022-01-30 to 2026-10-17. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.

Engine detections 9%

Reported engine detection rate. A low rate alone does not establish that the indicator is benign.

VirusSign confidence 80%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 20 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification defiller

Classification context: type trojan, family defiller.

Intelligence freshness Recent

Last seen 19 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 3ttfyarryp.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 33814254
Compile time: 2022-07-08T23:37:58Z
PE platform: x64 64-bit
Entry point: 16798056
Sections: 7

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

wmi-activitymacro-psobfuscatedpersistenceself-delete

View details · 5 shown

A DLL was loaded from a suspicious directory
A PE executable (not DLL) exports symbols, which is unusual and may indicate a dual-mode loader or packer that exposes its own entry points
A PE section has a virtual size significantly larger than its raw size, consistent with packed code expanding into virtual memory at runtime
A powershell command using multiple variables was executed possibly indicative of obfuscation
A process created a hidden window

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1027 — A PE executable (not DLL) exports symbols, which is unusual and may indicate a dual-mode loader or packer that exposes its own entry points
Tactics: TA0005
T1027 · T1059.001 · T1064 — A powershell command using multiple variables was executed possibly indicative of obfuscation
Tactics: TA0002 · TA0005
T1564.003 — A process created a hidden window
Tactics: TA0005
T1059 — A script or command line contains a long continuous string indicative of obfuscation
Tactics: TA0002

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
Command and Control
Objectives: OB0004
E1059 — Command and Scripting Interpreter
Objectives: OB0009
Communication
Objectives: OC0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 5353, 5355

5+ outbound connections observed
5 domains, 5+ IPs, 5+ URLs
Common ports: 443, 5353, 5355, 80
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: queue.grovewest89.club
URL: https://queue.grovewest89.club/gateway
Protocol: HTTP

Domain: mail.spark-trail95.xyz
URL: https://mail.spark-trail95.xyz/health
Protocol: HTTP

Domain: mail.spark-trail95.xyz
URL: https://mail.spark-trail95.xyz/collect
Protocol: HTTP

Domain: guard7.barnfabric.click
URL: https://guard7.barnfabric.click/tqfpylvwjopqnbtcfpgcfilsfpbrlrpqpmfpgcfptgddmnd/zepowrygiaileryvwfipmpmgifplsfp/eiifeijogisdfpgcfpbnpqtcpmnbtaeid/jdnfifplsfpdzpqjoeifpgcfpubowfplsfpstnbvwylstgi/igylsdgifpgcfpgitcxuxvkjfplsfppqw/anblrtcjorkiffpgcfpdnfplsfp/ylt…
Protocol: HTTP

Domain: guard7.barnfabric.click
URL: https://guard7.barnfabric.click/health
Protocol: HTTP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: queue.grovewest89.club
Type: A
Answers: 104.21.41.59, 172.67.189.119
Response: NOERROR

Query: mail0.runport23.lat

Query: mail.spark-trail95.xyz
Type: A
Answers: 104.21.78.216, 172.67.137.163
Response: NOERROR

Query: guard7.barnfabric.click
Type: A
Answers: 104.21.73.196, 172.67.148.203
Response: NOERROR

Query: content.brightplaza.lat

5 shown

C2 candidates5+

DNS, HTTP, TCPports 53, 80

5+ C2 candidate communications
5+ domains, 4 IPs
Common ports: 53, 80
Protocols: DNS, HTTP, TCP

View details · 5 shown

Domain: guard7.barnfabric.click
Protocol: HTTP

Domain: queue.grovewest89.club
Protocol: HTTP

IP: 104.21.41.59
Domain: queue.grovewest89.club
Port: 53
Protocol: DNS

Domain: mail0.runport23.lat
Port: 53
Protocol: DNS

IP: 104.21.78.216
Domain: mail.spark-trail95.xyz
Port: 53
Protocol: DNS

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2022-07-08T23:37:58Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 16798056
Sections: 7
Compile time: 2022-07-08T23:37:58Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 17106176
Raw size: 17106432
Permissions: rx
Entropy: 6.46

Name: .rdata
Virtual address: 17113088
Virtual size: 13121940
Raw size: 13122048
Permissions: r
Entropy: 6.21

Name: .data
Virtual address: 30236672
Virtual size: 2951404
Raw size: 154624
Permissions: rw
Entropy: 3.73

Name: .pdata
Virtual address: 33189888
Virtual size: 816108
Raw size: 816128
Permissions: r
Entropy: 6.73

Name: _RDATA
Virtual address: 34009088
Virtual size: 244
Raw size: 512
Permissions: r
Entropy: 2.45

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: dbghelp.dll
Functions: SymCleanup, SymFromAddr, SymGetLineFromAddr64, SymInitialize, SymSetOptions, UnDecorateSymbolName

Library: WS2_32.dll
Functions: __WSAFDIsSet, accept, bind, closesocket, connect, freeaddrinfo, FreeAddrInfoW, getaddrinfo …

Library: IPHLPAPI.DLL
Functions: ConvertInterfaceIndexToLuid, ConvertInterfaceLuidToNameW, GetAdaptersAddresses

Library: PSAPI.DLL
Functions: EnumProcessModules, GetModuleFileNameExW, GetProcessMemoryInfo

Library: USERENV.dll
Functions: GetUserProfileDirectoryW

5 shown

Exports5+

5+ exported items

5+ exported items

View details · 5 shown

Name: ??$Add@VIsolate@internal@v8@@@?$Dictionary@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VGlobalDictionary@internal@v8@@@12@PEAVIsolate@12@V312@V?$Handle@VName@internal@v8@@@12@V?$Handle@VObject@internal@v8@@@12@VProp

Name: ??$Add@VIsolate@internal@v8@@@?$Dictionary@VNameDictionary@internal@v8@@VNameDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNameDictionary@internal@v8@@@12@PEAVIsolate@12@V312@V?$Handle@VName@internal@v8@@@12@V?$Handle@VObject@internal@v8@@@12@VPropertyDe

Name: ??$Add@VIsolate@internal@v8@@@?$Dictionary@VNumberDictionary@internal@v8@@VNumberDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VNumberDictionary@internal@v8@@@12@PEAVIsolate@12@V312@IV?$Handle@VObject@internal@v8@@@12@VPropertyDetails@12@PEAVInternalIndex

Name: ??$Add@VIsolate@internal@v8@@@?$Dictionary@VSimpleNumberDictionary@internal@v8@@VSimpleNumberDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VSimpleNumberDictionary@internal@v8@@@12@PEAVIsolate@12@V312@IV?$Handle@VObject@internal@v8@@@12@VPropertyDetails@12

Name: ??$Add@VOffThreadIsolate@internal@v8@@@?$Dictionary@VGlobalDictionary@internal@v8@@VGlobalDictionaryShape@23@@internal@v8@@SA?AV?$Handle@VGlobalDictionary@internal@v8@@@12@PEAVOffThreadIsolate@12@V312@V?$Handle@VName@internal@v8@@@12@V?$Handle@VObject@inte

5 shown

Resources5+

5+ resources

5+ resources
Resource types: RT_ICON, RT_GROUP_ICON, RT_MANIFEST, RT_VERSION

View details · 4 shown

Type: RT_ICON
Language: ENGLISH US

Type: RT_GROUP_ICON
Language: ENGLISH US

Type: RT_VERSION
Language: ENGLISH US

Type: RT_MANIFEST
Language: ENGLISH US

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check