Report - 5f2090d0f635…b7ec88d192

Malicious HighFILE

Quota 42

First seen: 2026-08-06T20:46:36Z
Last seen: 2026-10-06T07:17:28Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYammyypua

RELATED INDICATORS18Connections in this report

ANALYSISMaliciousAging

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 5f2090d0f63559384866eb4c2a1c2e426b80e278879d1dfc9c4049b7ec88d192
SHA1: c8199b490629de51040e1309788881336bf2b120
MD5: 6b90649427c3790c5f170b9268568fde
Filename: 5f2090d0_hw00um2o.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 745168
Compile time: 2010-05-16T15:11:34Z
PE platform: x86 32-bit
PE sections: 4

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 18. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 75%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections75%

VirusSign confidence100%

Relationship context18 visible

Threat classificationammyy

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

18 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

3shown

3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e

0% 808 bytes drops

Filename 3dd5ea8a_aany0y.bin MIME application/octet-stream Size 808 SHA1 b11261559bbea40f1874448196e2934277a537e9 First seen 2026-05-15T19:46:08Z

108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6

0% 701 bytes drops

Filename 108dd342_adn.bin MIME application/octet-stream Size 701 SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b First seen 2026-06-10T12:08:51Z

7bc48188bbd0ad1b7ac10257e6a8fc5327f2ccfd56402a4353f6d8ef26eb0ff8

0% text 76 bytes drops

Filename 7bc48188_file-3332188_vir.bin File type text MIME text/plain Size 76 SHA1 0ce1d78aace04650b0c592665686a89412c1771c

Related IPs

Network IPs associated with this indicator.

5shown

89.169.30.62

6% low RU communicates

CIDR 89.169.28.0/22 Network 89.169.28.0-89.169.31.255 First seen 2026-05-08T12:23:33Z Last seen 2026-10-30T07:22:17Z

136.243.18.118

0% DE communicates

CIDR 136.243.0.0/16 Network 136.243.18.64-136.243.18.127 First seen 2023-09-30T22:29:18Z Last seen 2026-11-07T15:16:07Z

184.25.59.149

0% US communicates

CIDR 184.25.56.0/22 Network 184.24.0.0-184.31.255.255 First seen 2023-10-08T10:04:15Z Last seen 2026-11-09T07:10:32Z

184.25.59.136

0% US communicates

CIDR 184.25.56.0/22 Network 184.24.0.0-184.31.255.255 First seen 2023-10-01T09:26:12Z Last seen 2026-11-12T04:12:05Z

104.18.21.213

0% US communicates

CIDR 104.16.0.0/14 Network 104.16.0.0-104.31.255.255 First seen 2023-10-04T08:10:46Z Last seen 2026-11-14T17:06:44Z

Related domains

Domains associated with this indicator.

5shown

yr.c.lencr.org

0% .org communicates

Root lencr.org TLD org Subdomain yr.c First seen 2025-11-04T11:49:44Z Last seen 2026-11-14T16:58:03Z

yr1.c.lencr.org

0% .org communicates

Root lencr.org TLD org Subdomain yr1.c First seen 2026-01-07T04:56:35Z Last seen 2026-11-14T16:29:23Z

www.ammyy.com

0% .com communicates

Root ammyy.com TLD com Subdomain www First seen 2023-09-30T22:10:09Z Last seen 2026-11-09T13:45:25Z

rl.ammyy.com

5% low .com communicates

Root ammyy.com TLD com Subdomain rl First seen 2023-09-29T06:42:50Z Last seen 2026-11-14T13:45:30Z

ammyy.com

0% .com communicates

Root ammyy.com TLD com First seen 2023-10-01T00:25:19Z Last seen 2026-11-13T21:01:04Z

Related URLs

URLs associated with this indicator.

5shown

http://yr1.c.lencr.org/4.crl

0% communicates

TLD org HTTP status 200 Content length 44355 Content SHA256 cda7b5053d3faf66472034338861dc3c57c6a39fb631460b4537265822b37fc5 First seen 2026-06-19T00:43:32Z

http://yr.c.lencr.org/

0% communicates

TLD org HTTP status 200 Content length 701 Content SHA256 91b79e7eb875f3a0eecf676e8c38b189823f56078c808bce49bdc3de74693a54 First seen 2026-02-03T07:56:02Z

https://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe

0% communicates

TLD com HTTP status 404 Content length 313 Content SHA256 28c135cac7260f5c8c6fa735e7a6ee6e83e015f3af414bc4311fd8ff6685a537 First seen 2021-01-20T23:32:46Z

http://www.ammyy.com/admin_v3.9_20200220-182209/AA_v3.exe

0% communicates

TLD com HTTP status 404 Content length 313 Content SHA256 28c135cac7260f5c8c6fa735e7a6ee6e83e015f3af414bc4311fd8ff6685a537 First seen 2020-03-02T14:00:50Z

http://rl.ammyy.com/

5% low communicates

TLD com HTTP status 200 Content length 266 Content SHA256 550773e5606488dac8c528083bc20506e02b0c29d3d723175d7f88c42f7ae2a2 First seen 2012-02-21T15:09:25Z

Analysis details

Severity: highpuafile-overlayexeammyyadminobfuscatedsigned

Freshness: Aging · Last seen 39 days ago.

Detection rate: 75%
Threat type: pua
Family: ammyy
Confidence: 100%
detection: 75 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 5f2090d0f63559384866eb4c2a1c2e426b80e278879d1dfc9c4049b7ec88d192
SHA1: c8199b490629de51040e1309788881336bf2b120
MD5: 6b90649427c3790c5f170b9268568fde
Filename: 5f2090d0_hw00um2o.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 745168
Compile time: 2010-05-16T15:11:34Z
PE platform: x86 32-bit
PE sections: 4
Import libraries: 14
TLSH: T17FF4B0917DE582BED5750130996A5B35EAF1AE580E3BCA875388F96C1D30E30EF02379
SSDEEP: 12288:zaA9OKLSwaIN5U8xvFoRQMEoO2rx8ikfRtjIe9rtv8zl6mi/gQ:pkK+waI8JRQMEJ2rufRtse9rtv8zlBi3
Imphash: ffb5ae016ce323172126d82e6bfb166f
Richhash: 9fc73d520c48dd17682a7dbae5411b38
First seen: 2026-08-06T20:46:36Z
Last seen: 2026-10-06T07:17:28Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 18. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 75%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type pua and family ammyy.

Relationship context

18 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

19 timestamped observations are arranged from 2010-05-16 to 2026-06-19. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 75%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 18 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification ammyy

Classification context: type pua, family ammyy.

Intelligence freshness Aging

Last seen 39 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 5f2090d0_hw00um2o.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 745168
Compile time: 2010-05-16T15:11:34Z
PE platform: x86 32-bit
Entry point: 439960
Sections: 4

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

obfuscated

View details · 5 shown

Attempts to connect to a dead IP:Port
Checks available memory
Checks system language via registry key (possible geofencing)
Classification label
Creates a process in a suspended state, likely for injection

5 shown

View MITRE ATT&CK details · 5 shown

T1082 — Checks available memory
Tactics: TA0007
T1055 — Creates a process in a suspended state, likely for injection
Tactics: TA0004 · TA0005
T1036 — Creates files inside the system directory
Tactics: TA0005
T1490 · T1562.001 — Deletes keys which are related to windows safe boot (disables safe mode boot)
Tactics: TA0005 · TA0040
T1071 · T1095 · T1105 — Downloads files from webservers via HTTP
Tactics: TA0011

5 shown

View MBC details · 5 shown

E1010 — Application Window Discovery
Objectives: OB0007
C0026.001 — Base64
Objectives: OC0004
C0032.001 — CRC32
Objectives: OC0004
C0043 — Check Mutex
Objectives: OC0003
C0019 — Check String
Objectives: OC0004

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 80, 443, 53

5+ outbound connections observed
4 domains, 5 IPs, 5 URLs
Common ports: 80, 443, 53
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: rl.ammyy.com
URL: http://rl.ammyy.com/
Protocol: HTTP

IP: 89.169.30.62
Port: 80
Protocol: TCP

IP: 8.8.8.8
Port: 53
Protocol: UDP

Domain: www.ammyy.com
URL: https://www.ammyy.com/admin_v3.9_20200220-182209/aa_v3.exe
Protocol: HTTP

Domain: yr1.c.lencr.org
URL: http://yr1.c.lencr.org/4.crl
Protocol: HTTP

5 shown

DNS request activity5

A5+ response IPs

5 DNS requests observed
5 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: rl.ammyy.com
Type: A
Answers: 89.169.30.62
Response: NOERROR

Query: yr1.c.lencr.org
Type: A
Answers: 104.18.21.213, 104.18.20.213
Response: NOERROR

Query: yr.c.lencr.org
Type: A
Answers: 184.25.59.149, 184.25.59.136
Response: NOERROR

Query: x1.c.lencr.org

Query: www.ammyy.com
Type: A
Answers: 136.243.18.118
Response: NOERROR

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit4 sections

Platform: x86 32-bit
Sections: 4
Entry point: present
Compile time: 2010-05-16T15:11:34Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 439960
Sections: 4
Compile time: 2010-05-16T15:11:34Z

PE sections4

4 sections

4 PE sections
Common permissions: rw, rwx
4 unique section names

View details · 4 shown

Name: .text
Virtual address: 4096
Virtual size: 454570
Raw size: 454656
Permissions: rwx
Entropy: 6.68

Name: .rdata
Virtual address: 458752
Virtual size: 57210
Raw size: 57344
Permissions: rw
Entropy: 4.74

Name: .data
Virtual address: 516096
Virtual size: 77368
Raw size: 77824
Permissions: rw
Entropy: 5.73

Name: .rsrc
Virtual address: 593920
Virtual size: 147456
Raw size: 147456
Permissions: rwx
Entropy: 3.65

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: WS2_32.dll
Functions: __WSAFDIsSet, accept, bind, closesocket, connect, gethostbyaddr, gethostbyname, getservbyname …

Library: GDI32.dll
Functions: BitBlt, CombineRgn, CreateCompatibleBitmap, CreateCompatibleDC, CreateDIBSection, CreateFontIndirectA, CreatePalette, CreateRectRgn …

Library: USER32.dll
Functions: AdjustWindowRectEx, AppendMenuA, AttachThreadInput, BeginPaint, CallWindowProcA, CallWindowProcW, ChangeClipboardChain, CheckMenuItem …

Library: SHELL32.dll
Functions: Shell_NotifyIconA, ShellExecuteA, ShellExecuteExW, SHGetFileInfoW, SHGetFolderPathW, SHGetSpecialFolderPathW

Library: MSVCRT.dll
Functions: ??1type_info@@UAE@XZ, ??2@YAPAXI@Z, ?terminate@@YAXXZ, __CxxFrameHandler, __dllonexit, __getmainargs, __p__commode, __p__fmode …

5 shown

Resources5+

5+ resources

5+ resources
Resource types: RT_DIALOG, RT_BITMAP, RT_STRING, RT_CURSOR, RT_GROUP_CURSOR

View details · 5 shown

Type: BINARY
Language: NEUTRAL

Type: RT_CURSOR
Language: ENGLISH US

Type: RT_BITMAP
Language: RUSSIAN

Type: RT_BITMAP
Language: NEUTRAL

Type: RT_ICON
Language: NEUTRAL

5 shown

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates2

1 issuer

Example subject: COMODO Time Stamping Signer
Issued by: UTN-USERFirst-Object

View details · 2 shown

Subject: COMODO Time Stamping Signer
Issuer: UTN-USERFirst-Object
Fingerprint: 3DBB6DB5085C6DD5A1CA7F9CF84ECB1A3910CAC8

Subject: Ammyy Group
Issuer: UTN-USERFirst-Object
Fingerprint: 8D9536340217700BCAD5C669248A3F81AE72DF61

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check