- First seen
- Last seen
THREAT SIGNALMedium-high
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
5573597932a8ab9f1e9b78d7a6754ac135f632c4a8d77dc819154f5a0dd9d77a- SHA1
fe0e980c9e3e889d6ebec95856bac290aa7e6bdd- MD5
9272ffa08cac1a2542ae48639ce7b247- Filename
- nffyzi.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 2459136
- Compile time
- 2026-06-30T10:40:28Z
- PE platform
- x64 64-bit
- PE sections
- 4
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 3. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 52%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections52%
VirusSign confidence100%
Relationship context3 visible
Threat classificationbeug
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
1shown
45%
high
powershell
3279076 bytes
drops
Filename
cf-verification.ps1
Family
abtrojan
Type
trojan
File type
powershell
MIME
text/plain
Related IPs
Network IPs associated with this indicator.
2shown
29%
high
DE
communicates
CIDR
45.142.182.0/23
Network
45.142.180.0-45.142.183.255
First seen
2024-01-14T09:57:34Z
Last seen
2026-11-12T02:59:28Z
0%
US
communicates
CIDR
162.159.0.0/18
Network
162.158.0.0-162.159.255.255
First seen
2023-09-30T16:06:22Z
Last seen
2026-11-13T05:11:30Z
Analysis details
Severity: criticaltrojan64bitexeexec-delaypersistencepolymorphicdebug-check
Freshness: Aging · Last seen 57 days ago.
- Detection rate
- 52%
- Threat type
- trojan
- Family
- beug
- Confidence
- 100%
- detection
- 52 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
5573597932a8ab9f1e9b78d7a6754ac135f632c4a8d77dc819154f5a0dd9d77a- SHA1
fe0e980c9e3e889d6ebec95856bac290aa7e6bdd- MD5
9272ffa08cac1a2542ae48639ce7b247- Filename
- nffyzi.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 2459136
- Compile time
- 2026-06-30T10:40:28Z
- PE platform
- x64 64-bit
- PE sections
- 4
- TLSH
T10DB54959A168C1B8FE268031A5684B25E8F137ECC8F497F1615B4B3268467C2CFDB673- SSDEEP
24576:5PdEF4SbeDt7XMs7l3A/23DpNwVAXj0GWyV/qoeNEkmBSCGBJm2IBNTx+JDKlKHl:5PiF0xMsaew4LxbEYls5qaHUF8ywI- Richhash
90ed99230ef7ce7d2a33b207c37db055- First seen
- 2026-08-10T23:41:54Z
- Last seen
- 2026-09-17T00:28:47Z
- Filename variants
- 2 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 3. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 52%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family beug.
Relationship context
3 related indicators are shown across 2 relationship group(s).
Observation timeline
4 timestamped observations are arranged from 2023-09-30 to 2026-08-12. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
2 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family beug.
Last seen 57 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- nffyzi.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 2459136
- Compile time
- 2026-06-30T10:40:28Z
- PE platform
- x64 64-bit
- Entry point
- 1044181
- Sections
- 4
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- Attempts to connect to a dead IP:Port
- Classification label
- Connects to IPs without corresponding DNS lookups
- Contains modern PE file flags such as dynamic base (ASLR) or NX
- Creates an autostart registry key
5 shown
View MITRE ATT&CK details · 5 shown
- T1071 — Attempts to connect to a dead IP:PortTactics: TA0011
- T1547.001 — Creates an autostart registry keyTactics: TA0003 · TA0004
- T1571 — Detected TCP or UDP traffic on non-standard portsTactics: TA0011
- T1112 · T1547.001 — Installs itself for autorun at Windows startupTactics: TA0003 · TA0004 · TA0112
- T1497 — May sleep (evasive loops) to hinder dynamic analysisTactics: TA0005 · TA0007
5 shown
View MBC details · 5 shown
- C0027.001 — AESObjectives: OC0005
- C0026.001 — Base64Objectives: OC0004
- CommunicationObjectives: OC0006
- E1027.m02 — Encoding-Standard AlgorithmObjectives: OB0002 · OB0006
- E1027.m05 — Encryption-Standard AlgorithmObjectives: OB0002 · OB0006
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity2
TCP, UDPports 5050, 53
- 2 outbound connections observed
- 0 domains, 2 IPs, 0 URLs
- Common ports: 5050, 53
- Protocols: TCP, UDP
View details · 2 shown
- IP
- 45.142.182.137
- Port
- 5050
- Protocol
- TCP
- IP
- 162.159.36.2
- Port
- 53
- Protocol
- UDP
C2 candidates1
TCPports 5050
- 1 C2 candidate communications
- 0 domains, 1 IPs
- Common ports: 5050
- Protocols: TCP
View details · 1 shown
- IP
- 45.142.182.137
- Port
- 5050
- Protocol
- TCP
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x64 64-bit4 sections
- Platform: x64 64-bit
- Sections: 4
- Entry point: present
- Compile time: 2026-06-30T10:40:28Z
View details · 1 shown
- Platform
- x64 64-bit
- Entry point
- 1044181
- Sections
- 4
- Compile time
- 2026-06-30T10:40:28Z
PE sections4
4 sections
- 4 PE sections
- Common permissions: r, rw, rx
- 4 unique section names
View details · 4 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 2404924
- Raw size
- 2405376
- Permissions
- rx
- Entropy
- 6.5
- Name
- .rdata
- Virtual address
- 2412544
- Virtual size
- 44412
- Raw size
- 44544
- Permissions
- r
- Entropy
- 7.6
- Name
- .data
- Virtual address
- 2457600
- Virtual size
- 87415
- Raw size
- 5120
- Permissions
- rw
- Entropy
- 7.62
- Name
- .pdata
- Virtual address
- 2547712
- Virtual size
- 2688
- Raw size
- 3072
- Permissions
- r
- Entropy
- 5.31