Report - 668c733cdb9c…c46cddecbe

Suspicious CriticalFILE

Quota 32

First seen: 2026-11-15T08:35:05Z
Last seen: 2026-11-15T20:06:28Z

THREAT SIGNALMedium Read alongside the verdict

CONFIDENCE84%VirusSign analysis

FAMILYlotoktrojan

RELATED INDICATORS20Connections in this report

ANALYSISSuspiciousFresh

Indicator overview

INDICATOR PROFILE

VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.

SHA256: 668c733cdb9c46b3d8c55963b330c2678a15e247212a294e904074c46cddecbe
SHA1: 812d40011992ea71f6a5d9b327d9134c463f4f6e
MD5: ca269100d1aad3c0bd8aa01b7e1db8b0
Filename: 668c733c_faceit.msi.bin
File type: msi
MIME: application/x-msi
File size: 428544
TLSH: T137943A0773A310B9D1279134C6A79775B632B8560324AF6F369CC7222F72B648E39B35
SSDEEP: 6144:SheGOjzxVhbld0UkqgzsGZ7edUNg4ef9uEut1Zqz2MKR6pKnY2:S0XxVhblBgzsGZags9uEDz2MhpKnj

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

High-confidence evidence. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Suspicious. A limited set of engine detections is present (17%).

Confidence signal

VirusSign reports 84% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections17%

VirusSign confidence84%

Relationship context20 visible

Threat classificationlotok

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

20 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

711ff42783df244fe2dd2b30e9bdf207393d23693a5b1423716971984827df97

0% json 10 bytes drops

Filename 711ff427_sleestak_payload_1.bin File type json MIME application/json Size 10 SHA1 62de00fa33fa9d85ab4f9ce9daea2f5dfa3bfe64

d1f854cf034b453bde17d22ea47b3e2560bbfc2887ce83e5051830bd648ccd8a

22% high peexe 1827840 bytes drops

Filename d1f854cf_ail8i4w8b.exe.bin Family steam Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

7771cb6db5631b9b1a68d2e97ab6002f25d88e97a42cb2d82b1e508b8dff6091

71% critical peexe 2554880 bytes drops

Filename 7771cb6d_bpe2bzshn.exe.bin Family stealer Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

1194bd4526a1dd1da28281372ab8a4f541532e9e0e0a083c782116da52c9dab0

71% critical peexe 3544576 bytes drops

Filename 1194bd45_92a66599-a785-4cd1-8b48-3dddfa4e09ca.bin Family dacic Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

354df3537e672d0c4ed4f74147c04b8f78de70ba6eb34776dd65e8e1b0405fc3

74% high peexe 264192 bytes drops

Filename 354df353_sup.exe.bin Family yogi Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

Related IPs

Network IPs associated with this indicator.

5shown

93.152.211.27

0% US communicates

CIDR 93.152.211.0/24 First seen 2024-05-18T23:56:57Z Last seen 2026-11-15T20:06:31Z

192.69.210.253

6% high US communicates

CIDR 192.69.192.0/19 Network 192.69.192.0-192.69.223.255 First seen 2026-10-08T03:18:12Z Last seen 2026-11-15T20:06:31Z

138.16.152.26

11% medium US communicates

CIDR 138.16.152.0/22 Network 138.16.152.0-138.16.155.255 First seen 2026-06-19T19:45:05Z Last seen 2026-11-15T23:04:02Z

195.208.21.65

11% medium RU communicates

CIDR 195.208.20.0/23 Network 195.208.20.0-195.208.21.255 First seen 2026-02-24T15:42:01Z Last seen 2026-11-15T20:06:31Z

172.66.170.210

0% US communicates

CIDR 172.66.160.0/20 Network 172.64.0.0-172.71.255.255 First seen 2025-06-25T08:19:49Z Last seen 2026-11-15T21:35:11Z

Related domains

Domains associated with this indicator.

5shown

sa1atik.cn

35% high .cn communicates

Root sa1atik.cn TLD cn First seen 2026-03-15T00:05:21Z Last seen 2026-11-15T20:06:32Z

ton.access.orbs.network

5% low .network communicates

Root orbs.network TLD network Subdomain ton.access First seen 2023-10-07T15:19:39Z Last seen 2026-11-15T21:32:57Z

toncenter.com

0% .com communicates

Root toncenter.com TLD com First seen 2023-10-01T11:48:56Z Last seen 2026-11-15T20:06:32Z

tonapi.io

5% low .io communicates

Root tonapi.io TLD io First seen 2023-10-01T02:55:11Z Last seen 2026-11-15T22:40:38Z

assets.msn.com

0% .com communicates

Root msn.com TLD com Subdomain assets First seen 2023-09-29T01:39:51Z Last seen 2026-11-15T23:34:29Z

Related URLs

URLs associated with this indicator.

5shown

http://93.152.211.27/fl/vrs/131/Pianist.exe

5% low communicates

HTTP status 200 Content length 3544576 Content SHA256 1194bd4526a1dd1da28281372ab8a4f541532e9e0e0a083c782116da52c9dab0 First seen 2026-11-15T14:09:33Z Last seen 2026-11-15T20:06:32Z

http://93.152.211.27/fl/vrs/131/hs.exe

0% communicates

HTTP status 200 Content length 14336 Content SHA256 398a4418607dc1a3a3f91d44ad19096ea2382d95cf80985d17bc34e607b6533a First seen 2026-11-15T00:30:59Z Last seen 2026-11-15T20:06:33Z

http://93.152.211.27/fl/vrs/131/MR.exe

0% communicates

HTTP status 200 Content length 2554880 Content SHA256 7771cb6db5631b9b1a68d2e97ab6002f25d88e97a42cb2d82b1e508b8dff6091 First seen 2026-11-15T00:30:59Z Last seen 2026-11-15T20:06:32Z

http://93.152.211.27/fl/vrs/131/cl2.exe

11% medium communicates

HTTP status 200 Content length 22016 Content SHA256 30f650edd736f2385078f329697985f5c6cff7b28df930a1506148b110f70d22 First seen 2026-11-15T00:30:59Z Last seen 2026-11-15T20:06:32Z

http://93.152.211.27/fl/vrs/131/BERSERK.exe

5% low communicates

HTTP status 200 Content length 1827840 Content SHA256 d1f854cf034b453bde17d22ea47b3e2560bbfc2887ce83e5051830bd648ccd8a First seen 2026-11-15T00:30:59Z Last seen 2026-11-15T20:06:32Z

Analysis details

Severity: criticaltrojanpersistencemsidebug-checkusb-checkhosts-modifyevasionransomwarespywaredefense-evasionstealerexecution

Freshness: Fresh · Last seen today.

Detection rate: 17%
Threat type: trojan
Family: lotok
Confidence: 84%
confidence: 84 · VirusSign confidence; engine detections are reported separately.

Overview

SHA256: 668c733cdb9c46b3d8c55963b330c2678a15e247212a294e904074c46cddecbe
SHA1: 812d40011992ea71f6a5d9b327d9134c463f4f6e
MD5: ca269100d1aad3c0bd8aa01b7e1db8b0
Filename: 668c733c_faceit.msi.bin
File type: msi
MIME: application/x-msi
File size: 428544
TLSH: T137943A0773A310B9D1279134C6A79775B632B8560324AF6F369CC7222F72B648E39B35
SSDEEP: 6144:SheGOjzxVhbld0UkqgzsGZ7edUNg4ef9uEut1Zqz2MKR6pKnY2:S0XxVhblBgzsGZags9uEDz2MhpKnj
First seen: 2026-11-15T08:35:05Z
Last seen: 2026-11-15T20:06:28Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

High-confidence evidence. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Suspicious. A limited set of engine detections is present (17%).

Confidence signal

VirusSign reports 84% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family lotok.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 2023-09-29 to 2026-11-15. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.

Engine detections 17%

Reported engine detection rate. A low rate alone does not establish that the indicator is benign.

VirusSign confidence 84%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 20 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification lotok

Classification context: type trojan, family lotok.

Intelligence freshness Fresh

Last seen today.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 668c733c_faceit.msi.bin
File type: msi
MIME: application/x-msi
Size: 428544

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

usb-checkdebug-checkhosts-modifypersistence

View details · 5 shown

A DLL was loaded from a suspicious directory
A monitored process crashed
Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Attempted to interact with the Service Control Manager from dynamically allocated (unbacked) memory
Attempted to modify the Windows registry from dynamically allocated (unbacked) memory

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Tactics: TA0004 · TA0005
T1543 — Attempted to interact with the Service Control Manager from dynamically allocated (unbacked) memory
Tactics: TA0003 · TA0004
T1112 · T1547 — Attempted to modify the Windows registry from dynamically allocated (unbacked) memory
Tactics: TA0003 · TA0004 · TA0112
T1071 — Attempts to connect to a dead IP:Port
Tactics: TA0011

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Command and Control
Objectives: OB0004
Communication
Objectives: OC0006
C0016 — Create File
Objectives: OC0001
C0011 — DNS Communication
Objectives: OC0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 80

5+ outbound connections observed
2 domains, 5+ IPs, 5+ URLs
Common ports: 443, 80
Protocols: HTTP, TCP, UDP

View details · 5 shown

IP: 185.53.179.136
Port: 443
Protocol: UDP

Domain: 192.69.210.253
URL: https://192.69.210.253/client_report
Protocol: HTTP

Domain: 93.152.211.27
URL: http://93.152.211.27/fl/vrs/131/sup.exe
Protocol: HTTP

Domain: 93.152.211.27
URL: http://93.152.211.27/fl/vrs/131/cl2.exe
Protocol: HTTP

IP: 195.208.21.65
Port: 443
Protocol: UDP

5 shown

DNS request activity5

A5+ response IPs

5 DNS requests observed
5 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: sa1atik.cn

Query: tonapi.io
Type: A
Answers: 104.20.29.41, 172.66.170.210
Response: NOERROR

Query: ton.access.orbs.network
Type: A
Answers: 146.75.122.132
Response: NOERROR

Query: toncenter.com
Type: A
Answers: 104.26.1.179, 104.26.0.179, 172.67.73.244
Response: NOERROR

Query: assets.msn.com
Type: A
Answers: 23.195.81.90, 23.195.81.113
Response: NOERROR

C2 candidates5+

UDP, HTTP, TCPports 443, 53

5+ C2 candidate communications
3 domains, 3 IPs
Common ports: 443, 53
Protocols: UDP, HTTP, TCP, DNS

View details · 5 shown

Domain: sa1atik.cn
Port: 53
Protocol: DNS

IP: 185.53.179.136
Port: 443
Protocol: UDP

Domain: 192.69.210.253
Protocol: HTTP

Domain: 93.152.211.27
Protocol: HTTP

IP: 195.208.21.65
Port: 443
Protocol: UDP

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check