Report - 4e7435bf83ef…848868dcf3

Malicious HighFILE

Quota 30

First seen: 2026-11-15T00:30:06Z
Last seen: 2026-11-15T22:40:13Z

THREAT SIGNALMedium Read alongside the verdict

CONFIDENCE91%VirusSign analysis

FAMILYlotoktrojan

RELATED INDICATORS18Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.

SHA256: 4e7435bf83ef468723909d8ca486e8934a6e94f702d5b121102213848868dcf3
SHA1: fd252d0254e82e5e2ebc976ce8e399db9bc0456d
MD5: 9aab0837cf0c21eee57d26285184f20c
Filename: 4e7435bf_nq6rg.exe.bin
File type: msi
MIME: application/x-msi
File size: 439296
TLSH: T14D944B07A3A601BAD567813489E78775B631B8150324AF7F76ACD7352F32B648E39B30
SSDEEP: 6144:79LZy3S2sPCFbRc95T6+pweVUNXtV9uEut1Zqz2MKR6pKs1d:79LZoS2sPCA5T6+p769uEDz2MhpKsT

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

High-confidence evidence. Related indicators in this report: 18. Review the supporting evidence before taking action.

Detection signal

Malicious. A limited set of engine detections is present (20%).

Confidence signal

VirusSign reports 91% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections20%

VirusSign confidence91%

Relationship context18 visible

Threat classificationlotok

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

18 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

1shown

3e51c7ee589978c85f0701f91626fb969f7a3de33b2104d9ec9d6dfde20ff0e0

6% high powershell 1390 bytes drops

Filename 3e51c7ee_install.ps1.bin Type trojan File type powershell MIME text/plain Size 1390

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

711ff42783df244fe2dd2b30e9bdf207393d23693a5b1423716971984827df97

0% json 10 bytes drops

Filename 711ff427_sleestak_payload_1.bin File type json MIME application/json Size 10 SHA1 62de00fa33fa9d85ab4f9ce9daea2f5dfa3bfe64

d1f854cf034b453bde17d22ea47b3e2560bbfc2887ce83e5051830bd648ccd8a

22% high peexe 1827840 bytes drops

Filename d1f854cf_ail8i4w8b.exe.bin Family steam Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

7771cb6db5631b9b1a68d2e97ab6002f25d88e97a42cb2d82b1e508b8dff6091

71% critical peexe 2554880 bytes drops

Filename 7771cb6d_bpe2bzshn.exe.bin Family stealer Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

354df3537e672d0c4ed4f74147c04b8f78de70ba6eb34776dd65e8e1b0405fc3

74% high peexe 264192 bytes drops

Filename 354df353_sup.exe.bin Family yogi Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

398a4418607dc1a3a3f91d44ad19096ea2382d95cf80985d17bc34e607b6533a

29% high peexe 14336 bytes drops

Filename 398a4418_windowsaudioperf.exe.bin Family donut Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

Related IPs

Network IPs associated with this indicator.

5shown

93.152.211.27

0% US communicates

CIDR 93.152.211.0/24 First seen 2024-05-18T23:56:57Z Last seen 2026-11-15T20:06:31Z

192.69.210.253

6% high US communicates

CIDR 192.69.192.0/19 Network 192.69.192.0-192.69.223.255 First seen 2026-10-08T03:18:12Z Last seen 2026-11-15T20:06:31Z

138.16.152.26

11% medium US communicates

CIDR 138.16.152.0/22 Network 138.16.152.0-138.16.155.255 First seen 2026-06-19T19:45:05Z Last seen 2026-11-15T23:04:02Z

195.208.21.65

11% medium RU communicates

CIDR 195.208.20.0/23 Network 195.208.20.0-195.208.21.255 First seen 2026-02-24T15:42:01Z Last seen 2026-11-15T20:06:31Z

104.26.0.179

0% US communicates

CIDR 104.26.0.0/20 Network 104.16.0.0-104.31.255.255 First seen 2023-10-01T07:39:38Z Last seen 2026-11-15T21:28:27Z

Related domains

Domains associated with this indicator.

2shown

sa1atik.cn

35% high .cn communicates

Root sa1atik.cn TLD cn First seen 2026-03-15T00:05:21Z Last seen 2026-11-15T20:06:32Z

toncenter.com

0% .com communicates

Root toncenter.com TLD com First seen 2023-10-01T11:48:56Z Last seen 2026-11-15T20:06:32Z

Related URLs

URLs associated with this indicator.

5shown

http://93.152.211.27/fl/vrs/131/hs.exe

0% communicates

HTTP status 200 Content length 14336 Content SHA256 398a4418607dc1a3a3f91d44ad19096ea2382d95cf80985d17bc34e607b6533a First seen 2026-11-15T00:30:59Z Last seen 2026-11-15T20:06:33Z

http://93.152.211.27/fl/vrs/131/MR.exe

0% communicates

HTTP status 200 Content length 2554880 Content SHA256 7771cb6db5631b9b1a68d2e97ab6002f25d88e97a42cb2d82b1e508b8dff6091 First seen 2026-11-15T00:30:59Z Last seen 2026-11-15T20:06:32Z

http://93.152.211.27/fl/vrs/131/cl2.exe

11% medium communicates

HTTP status 200 Content length 22016 Content SHA256 30f650edd736f2385078f329697985f5c6cff7b28df930a1506148b110f70d22 First seen 2026-11-15T00:30:59Z Last seen 2026-11-15T20:06:32Z

http://93.152.211.27/fl/vrs/131/BERSERK.exe

5% low communicates

HTTP status 200 Content length 1827840 Content SHA256 d1f854cf034b453bde17d22ea47b3e2560bbfc2887ce83e5051830bd648ccd8a First seen 2026-11-15T00:30:59Z Last seen 2026-11-15T20:06:32Z

http://93.152.211.27/fl/vrs/131/Sup.exe

10% high communicates

HTTP status 200 Content length 264192 Content SHA256 354df3537e672d0c4ed4f74147c04b8f78de70ba6eb34776dd65e8e1b0405fc3 First seen 2026-11-15T00:30:59Z Last seen 2026-11-15T20:06:32Z

Analysis details

Severity: hightrojanmsiusb-checkhosts-modifydebug-checkpersistence

Freshness: Fresh · Last seen today.

Detection rate: 20%
Threat type: trojan
Family: lotok
Confidence: 91%
confidence: 91 · VirusSign confidence; engine detections are reported separately.

Overview

SHA256: 4e7435bf83ef468723909d8ca486e8934a6e94f702d5b121102213848868dcf3
SHA1: fd252d0254e82e5e2ebc976ce8e399db9bc0456d
MD5: 9aab0837cf0c21eee57d26285184f20c
Filename: 4e7435bf_nq6rg.exe.bin
File type: msi
MIME: application/x-msi
File size: 439296
TLSH: T14D944B07A3A601BAD567813489E78775B631B8150324AF7F76ACD7352F32B648E39B30
SSDEEP: 6144:79LZy3S2sPCFbRc95T6+pweVUNXtV9uEut1Zqz2MKR6pKs1d:79LZoS2sPCA5T6+p769uEDz2MhpKsT
First seen: 2026-11-15T00:30:06Z
Last seen: 2026-11-15T22:40:13Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

High-confidence evidence. Related indicators in this report: 18. Review the supporting evidence before taking action.

Detection signal

Malicious. A limited set of engine detections is present (20%).

Confidence signal

VirusSign reports 91% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family lotok.

Relationship context

18 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

19 timestamped observations are arranged from 2023-10-01 to 2026-11-15. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.

Engine detections 20%

Reported engine detection rate. A low rate alone does not establish that the indicator is benign.

VirusSign confidence 91%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 18 visible

5 relationship group(s) provide pivot and infrastructure context.

Threat classification lotok

Classification context: type trojan, family lotok.

Intelligence freshness Fresh

Last seen today.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 4e7435bf_nq6rg.exe.bin
File type: msi
MIME: application/x-msi
Size: 439296

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

usb-checkdebug-checkhosts-modifypersistence

View details · 5 shown

A DLL was loaded from a suspicious directory
Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Attempted to interact with the Service Control Manager from dynamically allocated (unbacked) memory
Attempted to modify the Windows registry from dynamically allocated (unbacked) memory
Attempted to open, duplicate, or impersonate an access token from dynamically allocated (unbacked) memory, indicative of credential theft or lateral movement

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Tactics: TA0004 · TA0005
T1543 — Attempted to interact with the Service Control Manager from dynamically allocated (unbacked) memory
Tactics: TA0003 · TA0004
T1112 · T1547 — Attempted to modify the Windows registry from dynamically allocated (unbacked) memory
Tactics: TA0003 · TA0004 · TA0112
T1071 — Attempts to connect to a dead IP:Port
Tactics: TA0011

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Command and Control
Objectives: OB0004
Communication
Objectives: OC0006
C0016 — Create File
Objectives: OC0001
C0011 — DNS Communication
Objectives: OC0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 80

5+ outbound connections observed
2 domains, 5+ IPs, 5+ URLs
Common ports: 443, 80
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: 192.69.210.253
URL: https://192.69.210.253/client_report
Protocol: HTTP

Domain: 93.152.211.27
URL: http://93.152.211.27/fl/vrs/131/sup.exe
Protocol: HTTP

Domain: 93.152.211.27
URL: http://93.152.211.27/fl/vrs/131/cl2.exe
Protocol: HTTP

IP: 195.208.21.65
Port: 443
Protocol: UDP

IP: 138.16.152.26
Port: 443
Protocol: TCP

5 shown

DNS request activity2

A3 response IPs

2 DNS requests observed
2 unique queries
3 response IPs
Query types: A
Response codes: NOERROR

View details · 2 shown

Query: sa1atik.cn

Query: toncenter.com
Type: A
Answers: 104.26.1.179, 104.26.0.179, 172.67.73.244
Response: NOERROR

C2 candidates5+

HTTP, UDP, DNSports 443, 53

5+ C2 candidate communications
3 domains, 2 IPs
Common ports: 443, 53
Protocols: HTTP, UDP, DNS, TCP

View details · 5 shown

Domain: sa1atik.cn
Port: 53
Protocol: DNS

Domain: 192.69.210.253
Protocol: HTTP

Domain: 93.152.211.27
Protocol: HTTP

IP: 195.208.21.65
Port: 443
Protocol: UDP

IP: 138.16.152.26
Port: 443
Protocol: TCP

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check