- First seen
- Last seen
THREAT SIGNALHigh
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
71bf60f674e031a7da962e3e641ebd10f3d1a5d81bd2e7611880b8abbf3e08bc- SHA1
d2f2cb6520b07cb69b63d6aa8f4bfb4a0364dd8a- MD5
7321add3fc5d83f92856c0bad223d360- Filename
- extinstaller.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 283136
- Compile time
- 2026-09-29T10:15:40Z
- PE platform
- x64 64-bit
- PE sections
- 11
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 8. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 74%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections74%
VirusSign confidence100%
Relationship context8 visible
Threat classificationstealer
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
crx
42496 bytes
contains
Filename
.embed
File type
crx
MIME
application/zip
Size
42496
SHA1
fdf42d09906283d8cd15d8289c22cbe2f3665134
0%
javascript
2119 bytes
drops
Filename
service-worker-loader.js
File type
javascript
MIME
application/javascript
Size
2119
SHA1
d10495f8d3c6a959be59b4b7fe363423d8c89969
0%
javascript
8143 bytes
drops
Filename
content.ts-B6XGI__y.js
File type
javascript
MIME
application/javascript
Size
8143
SHA1
5c9a2a7455a10c419e702da608381f1dccde6326
0%
javascript
68514 bytes
drops
Filename
background.ts-BL1Wig_s.js
File type
javascript
MIME
application/javascript
Size
68514
SHA1
4abf3f448b9e5a3116c4c05ba5d74899a54106c6
0%
crx
40026 bytes
drops
Filename
ext630A.tmp.zip
File type
crx
MIME
application/zip
Size
40026
SHA1
0857ee9ee41946363f5f5ce424515ce483d3ad3b
Related IPs
Network IPs associated with this indicator.
1shown
15%
medium
BG
communicates
CIDR
94.26.0.0/24
Network
94.26.0.0-94.26.0.255
First seen
2026-09-04T14:38:54Z
Last seen
2026-11-05T21:45:15Z
Related URLs
URLs associated with this indicator.
2shown
0%
communicates
HTTP status
404
Content length
18
Content SHA256
99eb12f2ab3c4866a353e098ffa3cb7a967e617c49b98480394ec5d8ea92b094
First seen
2026-10-04T04:23:02Z
Last seen
2026-11-05T21:45:15Z
11%
medium
communicates
HTTP status
401
Content length
27
Content SHA256
f6fb0581cd4595cabec14507b030ccbfc9c91ed2bf1739259293e04b4d831855
First seen
2026-10-16T22:39:43Z
Last seen
2026-11-05T21:45:15Z
Analysis details
Severity: criticaltrojanobfuscatedexeenv-check64bitwmi-activityadapter-discovery
Freshness: Recent · Last seen 8 days ago.
- Detection rate
- 74%
- Threat type
- trojan
- Family
- stealer
- Confidence
- 100%
- detection
- 74 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
71bf60f674e031a7da962e3e641ebd10f3d1a5d81bd2e7611880b8abbf3e08bc- SHA1
d2f2cb6520b07cb69b63d6aa8f4bfb4a0364dd8a- MD5
7321add3fc5d83f92856c0bad223d360- Filename
- extinstaller.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 283136
- Compile time
- 2026-09-29T10:15:40Z
- PE platform
- x64 64-bit
- PE sections
- 11
- Import libraries
- 11
- TLSH
T138545C17E19364ECC567D23886A7E632B532786201747E2A761CC7727F20E60E73EB58- SSDEEP
6144:i9A7exMTX8kUuyMUjcw8OB8+4Gq+KMYVp/:i9NeMCyMUjcw804Gq5V- Imphash
501ac40772c7219fe1d338307311fb29- First seen
- 2026-11-02T03:56:13Z
- Last seen
- 2026-11-03T00:00:46Z
- Filename variants
- 4 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 8. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 74%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family stealer.
Relationship context
8 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
9 timestamped observations are arranged from 2026-09-04 to 2026-11-01. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family stealer.
Last seen 8 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- extinstaller.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 283136
- Compile time
- 2026-09-29T10:15:40Z
- PE platform
- x64 64-bit
- Entry point
- 5328
- Sections
- 11
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- A process created a hidden window
- Anomalous file deletion behavior detected (10+)
- Attempts to access Bitcoin/ALTCoin wallets
- Attempts to connect to a dead IP:Port
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1564.003 — A process created a hidden windowTactics: TA0005
- T1485 — Anomalous file deletion behavior detected (10+)Tactics: TA0040
- T1005 — Attempts to access Bitcoin/ALTCoin walletsTactics: TA0009
- T1071 — Attempts to connect to a dead IP:PortTactics: TA0011
5 shown
View MBC details · 5 shown
- C0007 — Allocate MemoryObjectives: OC0002
- Anti-Behavioral AnalysisObjectives: OB0001
- Anti-Static AnalysisObjectives: OB0002
- B0032.020 — Argument ObfuscationObjectives: OB0002
- B0028.001 — BitcoinObjectives: OB0003 · OB0005
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5
HTTP, TCPports 8080
- 5 outbound connections observed
- 1 domains, 1 IPs, 2 URLs
- Common ports: 8080
- Protocols: HTTP, TCP
View details · 3 shown
- Domain
- 94.26.0.53
- URL
- http://94.26.0.53:8080/api/v1/agent/config
- Protocol
- HTTP
- IP
- 94.26.0.53
- Port
- 8080
- Protocol
- TCP
- Domain
- 94.26.0.53
- URL
- http://94.26.0.53:8080/api/v1/checkin
- Protocol
- HTTP
C2 candidates2
HTTP, TCPports 8080
- 2 C2 candidate communications
- 1 domains, 1 IPs
- Common ports: 8080
- Protocols: HTTP, TCP
View details · 2 shown
- Domain
- 94.26.0.53
- Protocol
- HTTP
- IP
- 94.26.0.53
- Port
- 8080
- Protocol
- TCP
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x64 64-bit5+ sections
- Platform: x64 64-bit
- Sections: 5+
- Entry point: present
- Compile time: 2026-09-29T10:15:40Z
View details · 1 shown
- Platform
- x64 64-bit
- Entry point
- 5328
- Sections
- 11
- Compile time
- 2026-09-29T10:15:40Z
PE sections5+
5+ sections
- 5+ PE sections
- Common permissions: r, rw, rx
- 5+ unique section names
View details · 5 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 151864
- Raw size
- 152064
- Permissions
- rx
- Entropy
- 6.19
- Name
- .data
- Virtual address
- 159744
- Virtual size
- 320
- Raw size
- 512
- Permissions
- rw
- Entropy
- 1.46
- Name
- .rdata
- Virtual address
- 163840
- Virtual size
- 69968
- Raw size
- 70144
- Permissions
- r
- Entropy
- 6.61
- Name
- .embed
- Virtual address
- 237568
- Virtual size
- 42176
- Raw size
- 42496
- Permissions
- r
- Entropy
- 7.91
- Name
- .pdata
- Virtual address
- 282624
- Virtual size
- 3564
- Raw size
- 3584
- Permissions
- r
- Entropy
- 5.25
5 shown
Imports5+
5+ DLL groups
- 5+ import DLL groups
- 5+ imported functions summarized
View details · 5 shown
- Library
- ADVAPI32.dll
- Functions
- ConvertSidToStringSidW, GetTokenInformation, GetUserNameA, GetUserNameW, LookupAccountNameW, OpenProcessToken, RegCloseKey, RegCreateKeyExW …
- Library
- bcrypt.dll
- Functions
- BCryptCloseAlgorithmProvider, BCryptCreateHash, BCryptDecrypt, BCryptDestroyHash, BCryptDestroyKey, BCryptFinishHash, BCryptGenerateSymmetricKey, BCryptGetProperty …
- Library
- CRYPT32.dll
- Functions
- CryptStringToBinaryA, CryptUnprotectData
- Library
- IPHLPAPI.DLL
- Functions
- GetAdaptersAddresses
- Library
- KERNEL32.dll
- Functions
- __C_specific_handler, CloseHandle, CopyFileW, CreateFileW, CreateMutexW, CreateProcessA, CreateProcessW, CreateToolhelp32Snapshot …
5 shown