- First seen
- Last seen
THREAT SIGNALMedium-high
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
5d499667a7f9b9f295d7649db58b1312be28bf86575fcf8108b2eb072bb0afbf- SHA1
57b9d18124c627408c5b8a80fcbbbf6167e87940- MD5
8091cb0b2b86c65ea716ea277389c08b- Filename
- 5d499667_c1qz1nh2.dot.bin
- File type
- html
- MIME
- text/html
- File size
- 56789
- SSDEEP
192:16cXAyUheKyUExOaVRxVb6u+eOtYR9d1pAjU9GTyVOfqh5K0avXey2YFcZ0kaI4Y:1h+heKha3zWcJlvcfJuy20cZvapN9I- First seen
- 2013-01-18T01:11:17Z
- Last seen
- 2026-07-04T18:34:09Z
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 15. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 40%.
Confidence signal
VirusSign reports 97% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections40%
VirusSign confidence97%
Relationship context15 visible
Threat classificationtrojan
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related IPs
Network IPs associated with this indicator.
5shown
0%
GB
communicates
CIDR
2.22.44.0/22
Network
2.22.44.0-2.22.47.255
First seen
2024-06-10T16:23:17Z
Last seen
2026-11-04T09:53:28Z
FR
communicates
CIDR
51.15.0.0/16
Network
51.15.0.0-51.15.255.255
First seen
2026-06-12T04:10:02Z
Last seen
2026-07-09T02:00:37Z
0%
FR
communicates
CIDR
163.172.0.0/16
Network
163.172.0.0-163.172.255.255
First seen
2026-06-23T18:34:12Z
Last seen
2026-07-09T02:00:37Z
FR
communicates
CIDR
163.172.0.0/16
Network
163.172.0.0-163.172.255.255
First seen
2026-07-08T16:50:20Z
Last seen
2026-07-09T02:00:37Z
FR
communicates
CIDR
163.172.0.0/16
Network
163.172.0.0-163.172.255.255
First seen
2026-06-26T04:03:51Z
Last seen
2026-07-09T02:00:37Z
Related domains
Domains associated with this indicator.
5shown
.ru
communicates
Root
list.ru
TLD
ru
Subdomain
d6.c9.bf.a0.top
First seen
2026-07-03T21:50:10Z
Last seen
2026-07-04T18:34:11Z
.ru
communicates
Root
list.ru
TLD
ru
Subdomain
c9.bf.a0.top
First seen
2025-11-30T05:12:02Z
Last seen
2026-07-04T18:34:11Z
5%
low
.org
communicates
Root
privoxy.org
TLD
org
First seen
2026-01-29T08:55:44Z
Last seen
2026-08-02T21:16:17Z
0%
.org
communicates
Root
privoxy.org
TLD
org
Subdomain
config
First seen
2023-09-29T23:11:02Z
Last seen
2026-10-01T20:12:10Z
5%
low
.org
communicates
Root
privoxy.org
TLD
org
Subdomain
www
First seen
2023-09-29T04:30:08Z
Last seen
2026-10-06T13:36:25Z
Related URLs
URLs associated with this indicator.
5shown
0%
communicates
TLD
ru
HTTP status
200
Content length
43
Content SHA256
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
First seen
2026-07-04T12:30:47Z
0%
communicates
TLD
gr
HTTP status
200
Content length
727
Content SHA256
d0fff24ec08f0022b621cadda91a7117bc2f64930a0c418f938fd40c2fe7639e
First seen
2026-06-20T05:30:32Z
0%
communicates
TLD
org
HTTP status
200
Content length
60209
Content SHA256
45cb487d5546c4fc0bab4c41168f2489e5408258b7b0b2f9c9a1b077be51d1e3
First seen
2026-06-04T12:23:33Z
0%
communicates
TLD
org
HTTP status
200
Content length
10609
Content SHA256
1f214acf0dc94643147f96f8dd04152291625a4566f33c1611822985521cb4b1
First seen
2026-06-06T22:30:06Z
0%
communicates
TLD
org
HTTP status
200
Content length
284
Content SHA256
63f5865ca379cf463bd50ee4f7ea5458d711654041a98b0c5bec93d8b1875703
First seen
2026-03-08T10:05:29Z
Analysis details
Severity: criticaltrojanhtml
Freshness: Aging · Last seen 133 days ago.
- Detection rate
- 40%
- Threat type
- trojan
- Confidence
- 97%
- detection
- 40 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
5d499667a7f9b9f295d7649db58b1312be28bf86575fcf8108b2eb072bb0afbf- SHA1
57b9d18124c627408c5b8a80fcbbbf6167e87940- MD5
8091cb0b2b86c65ea716ea277389c08b- Filename
- 5d499667_c1qz1nh2.dot.bin
- File type
- html
- MIME
- text/html
- File size
- 56789
- SSDEEP
192:16cXAyUheKyUExOaVRxVb6u+eOtYR9d1pAjU9GTyVOfqh5K0avXey2YFcZ0kaI4Y:1h+heKha3zWcJlvcfJuy20cZvapN9I- First seen
- 2013-01-18T01:11:17Z
- Last seen
- 2026-07-04T18:34:09Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 15. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 40%.
Confidence signal
VirusSign reports 97% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan.
Relationship context
15 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
16 timestamped observations are arranged from 2013-01-18 to 2026-07-08. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan.
Last seen 133 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 5d499667_c1qz1nh2.dot.bin
- File type
- html
- MIME
- text/html
- Size
- 56789
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
HTTP, TCPports 80, 443
- 5+ outbound connections observed
- 5+ domains, 5+ IPs, 5+ URLs
- Common ports: 80, 443
- Protocols: HTTP, TCP
View details · 5 shown
- Domain
- global.menotepoer.com
- URL
- http://global.menotepoer.com/sl.php?v=2
- Protocol
- HTTP
- Domain
- config.privoxy.org
- URL
- http://config.privoxy.org/send-banner?type=auto
- Protocol
- HTTP
- IP
- 199.232.210.172
- Port
- 80
- Protocol
- TCP
- Domain
- ye2.c.lencr.org
- URL
- http://ye2.c.lencr.org/51.crl
- Protocol
- HTTP
- Domain
- ye2.c.lencr.org
- URL
- http://ye2.c.lencr.org/37.crl
- Protocol
- HTTP
5 shown
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- www.privoxy.org
- Type
- A
- Answers
- 46.165.244.215
- Response
- NOERROR
- Query
- top-fwz1.mail.ru
- Type
- A
- Answers
- 95.163.52.67
- Response
- NOERROR
- Query
- privoxy.org
- Query
- ye2.c.lencr.org
- Type
- A
- Answers
- 104.18.20.213, 104.18.21.213
- Response
- NOERROR
- Query
- ye.c.lencr.org
- Type
- A
- Answers
- 2.16.106.223, 2.16.106.216
- Response
- NOERROR
5 shown