Report - 6e8e30f07d7b…9c404fd9e7

Malicious CriticalFILE

Quota 30

First seen: 2026-11-07T17:01:02Z
Last seen: 2026-11-08T07:46:05Z

THREAT SIGNALMedium-low Read alongside the verdict

CONFIDENCE88%VirusSign analysis

FAMILYagentbtrojan

RELATED INDICATORS15Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.

SHA256: 6e8e30f07d7b320f716ca446d6121e90d0d5e77f3bb2da77de0f2a9c404fd9e7
SHA1: 958cad49266c825c9b0e7e80d907a67e1729b55e
MD5: 67451541adada3687b9a4846eaa1c19e
Filename: cmutil.dll.exe
File type: pedll
MIME: application/vnd.microsoft.portable-executable
File size: 1009640
Compile time: 2026-11-07T09:08:15Z
PE platform: x64 64-bit
PE sections: 13

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

High-confidence evidence. Related indicators in this report: 15. Review the supporting evidence before taking action.

Detection signal

Malicious. A limited set of engine detections is present (12%).

Confidence signal

VirusSign reports 88% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections12%

VirusSign confidence88%

Relationship context15 visible

Threat classificationagentb

Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.

RELATIONSHIP CONSTELLATION

SELECT A NODE TO EXPLORE

FILEDOMAINIPURL

Visible connections

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

15 shown

Related IPs

Network IPs associated with this indicator.

5shown

195.15.201.249

15% medium CH communicates

CIDR 195.15.192.0/18 Network 195.15.192.0-195.15.223.255 First seen 2023-11-26T12:52:13Z Last seen 2026-11-11T00:45:34Z

23.209.213.9

0% DE communicates

CIDR 23.209.208.0/21 Network 23.192.0.0-23.223.255.255 First seen 2025-12-05T11:31:03Z Last seen 2026-11-10T15:30:48Z

52.123.250.14

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-10-01T05:47:45Z Last seen 2026-11-11T04:58:30Z

52.123.250.43

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-10-03T20:36:33Z Last seen 2026-11-11T05:03:08Z

52.123.250.28

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-09-30T09:39:36Z Last seen 2026-11-11T05:02:51Z

Related domains

Domains associated with this indicator.

5shown

g.dak69.org

6% low .org communicates

Root dak69.org TLD org Subdomain g First seen 2026-08-12T06:43:50Z Last seen 2026-11-07T23:15:29Z

do.amanbet89.org

11% medium .org communicates

Root amanbet89.org TLD org Subdomain do First seen 2026-08-12T23:28:22Z Last seen 2026-11-07T21:00:58Z

dak69.org

10% medium .org communicates

Root dak69.org TLD org First seen 2025-03-09T03:56:00Z Last seen 2026-11-10T23:46:07Z

amanbet89.org

5% medium .org communicates

Root amanbet89.org TLD org First seen 2026-05-02T01:05:34Z Last seen 2026-11-07T23:15:29Z

atm.teams.mira.tm.svc.cloud.microsoft

0% .microsoft communicates

Root cloud.microsoft TLD microsoft Subdomain atm.teams.mira.tm.svc First seen 2024-08-26T16:41:58Z Last seen 2026-11-11T05:10:53Z

Related URLs

URLs associated with this indicator.

5shown

https://do.amanbet89.org/qr/gate

11% medium communicates

TLD org HTTP status 521 Content length 6993 Content SHA256 63e7ddaefb4f2f21da8a8939913f3ff0c392a0f7a936a8b69a3989234e0a85cb First seen 2026-11-07T19:15:43Z

https://steamcommunity.com/profiles/76561198610252751

5% low communicates

TLD com HTTP status 200 Content length 32295 Content SHA256 8cd7a30b35a40eeb894a4615fcfbcf95344cec8807abb2eeda641c087559e5ba First seen 2026-11-06T22:30:56Z

https://g.dak69.org/c/gate

11% medium communicates

TLD org HTTP status 521 Content length 6964 Content SHA256 8dbc5d86260c5e0c7d64a97c087e2668e3848289b3adf79c235b5f5ab5b087f8 First seen 2026-11-07T19:15:43Z

https://telegram.me/d33ttt

5% low communicates

TLD me HTTP status 200 Content length 12377 Content SHA256 bbbd4e63151d2b90e22ec027dfbbf82333b7e868dcd7e00ee5d9154fa21b0efa First seen 2026-11-06T22:30:56Z

https://195.15.201.249/gate

24% medium communicates

HTTP status 404 Content length 19 Content SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793 First seen 2026-11-07T07:21:02Z Last seen 2026-11-11T00:45:47Z

Analysis details

Severity: criticaltrojaninput-checkobfuscatedfile-overlaydll64bitdebug-checkvidarsigned

Freshness: Fresh · Last seen 2 days ago.

Detection rate: 12%
Threat type: trojan
Family: agentb
Confidence: 88%
confidence: 88 · VirusSign confidence; engine detections are reported separately.

Overview

SHA256: 6e8e30f07d7b320f716ca446d6121e90d0d5e77f3bb2da77de0f2a9c404fd9e7
SHA1: 958cad49266c825c9b0e7e80d907a67e1729b55e
MD5: 67451541adada3687b9a4846eaa1c19e
Filename: cmutil.dll.exe
File type: pedll
MIME: application/vnd.microsoft.portable-executable
File size: 1009640
Compile time: 2026-11-07T09:08:15Z
PE platform: x64 64-bit
PE sections: 13
Import libraries: 8
TLSH: T118253B23CEB5B55EDAEFACF0A6979C025549FE3A1B32357E314577500402AF0638AB1B
SSDEEP: 12288:PqztrhyBnEno/OnfVSxsnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnM:PeoB/W0wl0p73HTbZO/lLu
Imphash: e7116b8bd62123f2604d8859b4cb19c3
First seen: 2026-11-07T17:01:02Z
Last seen: 2026-11-08T07:46:05Z
Filename variants: 3 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

High-confidence evidence. Related indicators in this report: 15. Review the supporting evidence before taking action.

Detection signal

Malicious. A limited set of engine detections is present (12%).

Confidence signal

VirusSign reports 88% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family agentb.

Relationship context

15 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

16 timestamped observations are arranged from 2023-09-30 to 2026-11-07. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.

Engine detections 12%

Reported engine detection rate. A low rate alone does not establish that the indicator is benign.

VirusSign confidence 88%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 15 visible

3 relationship group(s) provide pivot and infrastructure context.

Threat classification agentb

Classification context: type trojan, family agentb.

Intelligence freshness Fresh

Last seen 2 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: cmutil.dll.exe
File type: pedll
MIME: application/vnd.microsoft.portable-executable
Size: 1009640
Compile time: 2026-11-07T09:08:15Z
PE platform: x64 64-bit
Entry point: 4754
Sections: 13

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

input-checkdebug-checkobfuscated

View details · 5 shown

A DLL was loaded from a suspicious directory
AV process strings found (often used to terminate AV products)
Authenticode signature is invalid
Binary contains paths to debug symbols
Checks if the current process is being debugged

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1036 · T1553.002 — Authenticode signature is invalid
Tactics: TA0005 · TA0112
T1497 · T1518.001 — Checks if the current process is being debugged
Tactics: TA0005 · TA0007
T1055 — Contains .tls (Thread Local Storage) section
Tactics: TA0004 · TA0005
T1045 — Creates a page with write and execute permissions
Tactics: TA0005

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
Communication
Objectives: OC0006
C0017 — Create Process
Objectives: OC0003
C0038 — Create Thread
Objectives: OC0003

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCPports 443

5+ outbound connections observed
5 domains, 5 IPs, 5 URLs
Common ports: 443
Protocols: HTTP, TCP

View details · 5 shown

Domain: 195.15.201.249
URL: https://195.15.201.249/gate
Protocol: HTTP

IP: 195.15.201.249
Port: 443
Protocol: TCP

Domain: g.dak69.org
URL: https://g.dak69.org/c/gate
Protocol: HTTP

Domain: do.amanbet89.org
URL: https://do.amanbet89.org/qr/gate
Protocol: HTTP

Domain: telegram.me
URL: https://telegram.me/d33ttt
Protocol: HTTP

5 shown

DNS request activity5

A5+ response IPs

5 DNS requests observed
5 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: do.amanbet89.org
Type: A
Answers: 172.67.216.110, 104.21.35.92
Response: NOERROR

Query: steamcommunity.com
Type: A
Answers: 23.209.213.9
Response: NOERROR

Query: g.dak69.org
Type: A
Answers: 172.67.172.60, 104.21.30.72
Response: NOERROR

Query: telegram.me
Type: A
Answers: 149.154.167.99
Response: NOERROR

Query: atm.teams.mira.tm.svc.cloud.microsoft
Type: A
Answers: 52.123.250.14, 52.123.250.30, 52.123.250.25, 52.123.250.28, 52.123.250.43, 52.123.250.13, 52.123.250.32, 52.123.250.53
Response: NOERROR

C2 candidates3

HTTP, TCPports 443

3 C2 candidate communications
2 domains, 1 IPs
Common ports: 443
Protocols: HTTP, TCP

View details · 3 shown

Domain: do.amanbet89.org
Protocol: HTTP

Domain: 195.15.201.249
Protocol: HTTP

IP: 195.15.201.249
Port: 443
Protocol: TCP

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2026-11-07T09:08:15Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 4754
Sections: 13
Compile time: 2026-11-07T09:08:15Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 27384
Raw size: 27648
Permissions: rx
Entropy: 6.18

Name: .data
Virtual address: 32768
Virtual size: 240
Raw size: 512
Permissions: rw
Entropy: 1.44

Name: .rdata
Virtual address: 36864
Virtual size: 962960
Raw size: 963072
Permissions: r
Entropy: 8.0

Name: .eh_fram
Virtual address: 1003520
Virtual size: 4
Raw size: 512
Permissions: rw
Entropy: 0.0

Name: .pdata
Virtual address: 1007616
Virtual size: 840
Raw size: 1024
Permissions: r
Entropy: 3.86

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: KERNEL32.DLL
Functions: CloseHandle, CreateEventW, CreateFileW, CreateProcessW, CreateThread, DeleteCriticalSection, DeleteProcThreadAttributeList, DisableThreadLibraryCalls …

Library: api-ms-win-crt-environment-l1-1-0.dll
Functions: __p__environ, __p__wenviron

Library: api-ms-win-crt-heap-l1-1-0.dll
Functions: _set_new_mode, calloc, free

Library: api-ms-win-crt-private-l1-1-0.dll
Functions: memcpy

Library: api-ms-win-crt-runtime-l1-1-0.dll
Functions: __p___argc, __p___argv, __p___wargv, _configure_narrow_argv, _configure_wide_argv, _crt_at_quick_exit, _crt_atexit, _execute_onexit_table …

5 shown

Exports5+

5+ exported items

5+ exported items

View details · 5 shown

Name: CmAtolA

Name: CmAtolW

Name: CmBuildFullPathFromRelativeA

Name: CmBuildFullPathFromRelativeW

Name: CmCompareStringA

5 shown

Resources1

1 resources

1 resources
Resource types: RT_VERSION

View details · 1 shown

Type: RT_VERSION
Language: ENGLISH US

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates4

4 issuers

Example subject: yCYrOmYjqTirgB
Issued by: yCYrOmYjqTirgB

View details · 4 shown

Subject: yCYrOmYjqTirgB
Issuer: yCYrOmYjqTirgB
Fingerprint: 7948F33AD17B2BCCFA6DBF3910A3685FFA1140E4

Subject: DigiCert Trusted Root G4
Issuer: DigiCert Assured ID Root CA
Fingerprint: A99D5B79E9F1CDA59CDAB6373169D5353F5874C6

Subject: DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1
Issuer: DigiCert Trusted Root G4
Fingerprint: 07894D00FC194A17DB273AEB5CF8FACEF14423A4

Subject: DigiCert SHA256 RSA4096 Timestamp Responder 2026 1
Issuer: DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1
Fingerprint: 51D9ABDA034973D84F4266ACA48248E6B369C439

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check