- First seen
- Last seen
THREAT SIGNALHigh
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
7c0f42a1829800eb09b1cf105eaeeb66156aa91a44c237c0d7d90f4e68e134bd- SHA1
91ba43f7f40bb8d7ecf81c5f55b0e8a9017265e8- MD5
49f1aecb804c765342a5f72f440da299- Filename
- fahik.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 26622
- Compile time
- 2011-11-26T16:47:00Z
- PE platform
- x86 32-bit
- PE sections
- 3
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 18. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 86%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections86%
VirusSign confidence100%
Relationship context18 visible
Threat classificationupatre
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
1shown
83%
critical
peexe
26554 bytes
drops
Filename
fahik.exe
Family
upatre
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
161595 bytes
drops
Filename
tara5f2.tmp
MIME
model/stl
Size
161595
SHA1
01491fd23c4813a602d48988531ea4abbcdf7ed9
First seen
2021-11-03T15:23:57Z
0%
crt
1391 bytes
drops
Filename
6C(
File type
crt
MIME
application/octet-stream
Size
1391
SHA1
cabd2a79a1076a31f21d253635cb039d4329a5e8
0%
140227 bytes
drops
Filename
tared5b.tmp
MIME
model/stl
Size
140227
SHA1
822b5b8cb9169c358c6bc2c92466d439c983cd87
First seen
2019-05-02T00:27:07Z
0%
cab
57523 bytes
drops
Filename
cab3858.tmp
File type
cab
MIME
application/vnd.ms-cab-compressed
Size
57523
SHA1
73a69b3ce43bf74d60af94c251d7cca64b206a44
0%
crt
1521 bytes
drops
Filename
manifestCounterSignRootCertificate.cer
File type
crt
MIME
application/pkix-cert
Size
1521
SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5
Related IPs
Network IPs associated with this indicator.
5shown
0%
CN
communicates
CIDR
61.147.221.0/24
First seen
2026-08-18T14:14:49Z
Last seen
2026-10-08T23:42:35Z
0%
US
communicates
CIDR
184.85.0.0/19
Network
184.84.0.0-184.87.255.255
First seen
2025-09-29T08:54:52Z
Last seen
2026-11-09T15:00:34Z
0%
US
communicates
CIDR
104.65.128.0/17
First seen
2026-05-14T18:04:10Z
Last seen
2026-11-04T14:45:45Z
0%
JP
communicates
CIDR
23.10.0.0/20
First seen
2021-08-28T16:17:56Z
Last seen
2026-08-21T17:18:26Z
0%
US
communicates
CIDR
23.73.224.0/19
Network
23.72.0.0-23.79.255.255
First seen
2026-09-03T23:22:31Z
Last seen
2026-11-02T21:44:43Z
Related domains
Domains associated with this indicator.
5shown
5%
low
.it
communicates
Root
pieveasalti.it
TLD
it
Subdomain
www
First seen
2023-09-29T17:18:18Z
Last seen
2026-11-11T02:41:18Z
10%
medium
.it
communicates
Root
pieveasalti.it
TLD
it
First seen
2023-09-29T17:18:18Z
Last seen
2026-11-11T06:58:38Z
0%
.org
communicates
Root
lencr.org
TLD
org
Subdomain
x1.i
First seen
2023-09-30T05:09:58Z
Last seen
2026-11-12T02:10:30Z
0%
.org
communicates
Root
lencr.org
TLD
org
Subdomain
i
First seen
2023-09-30T12:18:28Z
Last seen
2026-11-12T01:52:41Z
25%
high
.com
communicates
Root
allseasonsnursery.com
TLD
com
First seen
2023-10-01T08:59:24Z
Last seen
2026-11-11T17:25:21Z
Related URLs
URLs associated with this indicator.
2shown
10%
high
communicates
TLD
it
HTTP status
200
Content SHA256
60de8a67d44e4f587cdc53eda811bd19b9847d948851dbde3ca2cb376df07343
First seen
2014-03-22T12:45:51Z
Last seen
2026-11-11T06:58:38Z
0%
communicates
TLD
org
HTTP status
200
Content length
1391
Content SHA256
96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6
First seen
2020-12-05T10:22:33Z
Analysis details
Severity: criticaltrojanexefile-overlaycpu-clockadapter-discoverydynamic-loadingmalwareexec-delay
Freshness: Historical · Last seen 1763 days ago.
- Detection rate
- 86%
- Threat type
- trojan
- Family
- upatre
- Confidence
- 100%
- detection
- 86 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
7c0f42a1829800eb09b1cf105eaeeb66156aa91a44c237c0d7d90f4e68e134bd- SHA1
91ba43f7f40bb8d7ecf81c5f55b0e8a9017265e8- MD5
49f1aecb804c765342a5f72f440da299- Filename
- fahik.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 26622
- Compile time
- 2011-11-26T16:47:00Z
- PE platform
- x86 32-bit
- PE sections
- 3
- Import libraries
- 3
- TLSH
T1BFC20EE9E7D71AB2E27B8BF588F765B39460B01EEC561D0D44C633340C237569CACA4A- SSDEEP
384:7VG/EvX8tHEnD+rPkChwWtUIyipVyyCx2D1QjF+ym/tj:7I4DD+LzrnVKoQdm/J- Imphash
cd48d697fbee261c31a3b590f5e52ef1- Richhash
2c32751dc037b4f4fc7229eade14d88d- First seen
- 2022-01-08T08:32:32Z
- Last seen
- 2022-01-13T11:05:17Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 18. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 86%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family upatre.
Relationship context
18 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
19 timestamped observations are arranged from 2011-11-26 to 2026-09-03. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
5 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family upatre.
Last seen 1763 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- fahik.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 26622
- Compile time
- 2011-11-26T16:47:00Z
- PE platform
- x86 32-bit
- Entry point
- 5522
- Sections
- 3
Observed behavior
summaryBehavioral indicators observed during analysis. More details and additional structured data are available through API and data access.
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCP, HTTP, UDPports 80, 443, 137
- 5+ outbound connections observed
- 2 domains, 5+ IPs, 4 URLs
- Common ports: 80, 443, 137
- Protocols: TCP, HTTP, UDP
View details · 5 shown
- Domain
- pieveasalti.it
- URL
- http://pieveasalti.it/images/2003usp.tpl
- Protocol
- HTTP
- URL
- x1.i.lencr.org/
- Protocol
- HTTP
- URL
- pieveasalti.it/images/2003usp.tpl
- Protocol
- HTTP
- Domain
- x1.i.lencr.org
- URL
- http://x1.i.lencr.org/
- Protocol
- HTTP
- IP
- 8.249.243.254
- Port
- 80
- Protocol
- TCP
5 shown
DNS request activity5+
A5 response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5 response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- allseasonsnursery.com
- Query
- pieveasalti.it
- Type
- A
- Answers
- 185.81.4.121
- Response
- NOERROR
- Query
- www.pieveasalti.it
- Type
- A
- Answers
- 185.81.4.121
- Response
- NOERROR
- Query
- x1.i.lencr.org
- Type
- A
- Answers
- 104.65.174.220
- Response
- NOERROR
- Query
- x1.i.lencr.org
- Type
- A
- Answers
- 23.10.0.36
- Response
- NOERROR
5 shown
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit3 sections
- Platform: x86 32-bit
- Sections: 3
- Entry point: present
- Compile time: 2011-11-26T16:47:00Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 5522
- Sections
- 3
- Compile time
- 2011-11-26T16:47:00Z
PE sections3
3 sections
- 3 PE sections
- Common permissions: r, rw, rx
- 3 unique section names
View details · 3 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 3860
- Raw size
- 4096
- Permissions
- rx
- Entropy
- 5.08
- Name
- .data
- Virtual address
- 8192
- Virtual size
- 3676
- Raw size
- 4096
- Permissions
- rw
- Entropy
- 6.12
- Name
- .rsrc
- Virtual address
- 12288
- Virtual size
- 10184
- Raw size
- 10240
- Permissions
- r
- Entropy
- 4.41
Imports3
3 DLL groups
- 3 import DLL groups
- 5+ imported functions summarized
View details · 3 shown
- Library
- KERNEL32.dll
- Functions
- GetModuleHandleA, GetStartupInfoA, GetTickCount, CloseHandle, CreateDirectoryA
- Library
- USER32.dll
- Functions
- GetMessageA, CharLowerA, ShowCursor, SetWindowTextA, DispatchMessageA, EndDialog, ScrollWindow, PostMessageA …
- Library
- COMCTL32.dll
- Functions
- InitCommonControlsEx
Resources3
3 resources
- 3 resources
- Resource types: RT_DIALOG, RT_GROUP_ICON, RT_ICON
View details · 3 shown
- Type
- RT_ICON
- Language
- ENGLISH US
- Type
- RT_DIALOG
- Language
- ENGLISH US
- Type
- RT_GROUP_ICON
- Language
- ENGLISH US