Report - 8eb3d4e293fc…0c9311bc6f

Malicious CriticalFILE

Quota 38

First seen: 2026-11-14T03:40:23Z
Last seen: 2026-11-15T07:46:07Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYclipbankertrojan

RELATED INDICATORS22Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 8eb3d4e293fc6894afef2ee3d4056a473491b39fcd4dbe91a495e60c9311bc6f
SHA1: 24e6c3357c8a97a1c13aa950a3b199d31f9b21e1
MD5: 736439bb3ff646e805806b1ec1559396
Filename: 8eb3d4e2_windowsupdate.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 3322880
Compile time: 2024-12-30T05:57:42Z
PE platform: x64 64-bit
PE sections: 7

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 22. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 74%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections74%

VirusSign confidence100%

Relationship context22 visible

Threat classificationclipbanker

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

22 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

5shown

4ea5b8c8ca4d2ba13362f15831c1686f29532709daa567b3afc9840f36a743dc

64% high zip 1699199 bytes drops

Filename 4ea5b8c8_438783481.bin Family mikey Type trojan File type zip MIME application/zip

4d4e6e358de22c44d64781091c736cc9237e89c2d23cdb2d4c96a3fc5333aeee

64% high zip 1699199 bytes drops

Filename 4d4e6e35_438783481.bin Family mikey Type trojan File type zip MIME application/zip

398605b839814d896b03b985bf23ca77df2cf1b3a90d06da802d2ef30b39f637

64% high zip 1699199 bytes drops

Filename 398605b8_438783481.bin Family mikey Type trojan File type zip MIME application/zip

0fff37dc909e8597e30d98719980d2d70472c01f9e81e7bef25b979ec29cdb44

61% high zip 1699199 bytes drops

Filename 0fff37dc_438783481.bin Family clipbanker Type trojan File type zip MIME application/zip

fb0b6fd3b09d81bc9e73eea76c01f87093b6d8125cfe11f4c6a679f6ccb73932

64% high zip 1699199 bytes drops

Filename fb0b6fd3_sleestak_payload_1.zip.bin Family mikey Type trojan File type zip MIME application/zip

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

90fc5b1fa55555b8481d7069eea60867977dde6c1f94c1e8b0e9440566fd84f1

4% low peexe 43175 bytes drops

Filename 90fc5b1fa55555b8481d7069eea60867977dde6c1f94c1e8b0e9440566fd84f1-dropped.bin File type peexe MIME application/vnd.microsoft.portable-executable Size 43175 Compile time 2026-11-07T09:19:10Z

c1700b72350791ed089037128a4613259e796f0301aebda81b2d0f3e418e22ca

17% high peexe 128945152 bytes drops

Filename c1700b72_systemsettingsbroker.exe.bin Family generickdq Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

9e0d15d9a1de171e837c49ae26463cecaec3212f10c1cef3985456c474328b52

0% csv 4079 bytes drops

Filename 9e0d15d9_powershell.exe.log.bin File type csv MIME text/plain Size 4079 SHA1 78f01b1c1fab78ef2f9613b8ed7ee13678f183ae

96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

0% powershell 60 bytes drops

Filename 96ad1146___psscriptpolicytest_iugzvutm.mi5.ps1.bin File type powershell MIME text/plain Size 60 SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d

4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df

0% xml 381 bytes contains

Filename 4bb79dce_intermediate.manifest.bin Type malware File type xml MIME application/xml Size 381

Related IPs

Network IPs associated with this indicator.

5shown

172.67.173.197

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-09-30T13:21:11Z Last seen 2026-11-15T19:47:51Z

104.21.55.221

6% low US communicates

CIDR 104.21.0.0/17 Network 104.16.0.0-104.31.255.255 First seen 2023-09-30T08:39:41Z Last seen 2026-11-15T19:47:51Z

172.67.150.120

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-10-03T01:00:00Z Last seen 2026-11-15T19:47:51Z

104.21.30.35

0% US communicates

CIDR 104.20.0.0/15 Network 104.16.0.0-104.31.255.255 First seen 2023-09-30T16:34:38Z Last seen 2026-11-15T19:47:51Z

8.8.8.8

6% low US communicates

CIDR 8.8.8.0/24 Network 8.8.8.0-8.8.8.255 First seen 2023-09-29T05:20:58Z Last seen 2026-11-15T20:14:04Z

Related domains

Domains associated with this indicator.

2shown

irm.st

30% high .st communicates

Root irm.st TLD st First seen 2026-10-10T11:08:39Z Last seen 2026-11-15T19:47:52Z

doxbin.cy

38% high .cy communicates

Root doxbin.cy TLD cy First seen 2026-04-10T05:37:53Z Last seen 2026-11-15T19:47:52Z

Related URLs

URLs associated with this indicator.

5shown

http://irm.st/937617

33% high communicates

TLD st HTTP status 200 Content length 15880 Content SHA256 52af0d41b27ff5013908d1f893a438fb3266fd4448f50d3a40be5a2027b416ee First seen 2026-11-15T00:04:30Z

http://irm.st/926408

33% high communicates

TLD st HTTP status 200 Content length 15844 Content SHA256 57ccfa49ae91717ac164d2bcbe2f8de4fbda7f82168f05d0e85154530fe38ee6 First seen 2026-11-14T17:58:46Z

https://doxbin.cy:2083/240561?…

33% high communicates

TLD cy HTTP status 200 Content length 2 Content SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df First seen 2026-11-13T10:01:05Z

http://irm.st/0e2b12f180e6bf4b

32% high communicates

TLD st HTTP status 200 First seen 2026-11-13T10:01:05Z Last seen 2026-11-15T07:46:13Z

https://doxbin.cy:2083/356633?…

38% high communicates

TLD cy HTTP status 200 Content length 2 Content SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df First seen 2026-11-15T00:04:30Z

Analysis details

Severity: criticaltrojanobfuscateddebug-checkpersistenceadapter-discoveryexe64bitmalwarewmi-activityexec-delayenv-checkpolymorphic

Freshness: Fresh · Last seen today.

Detection rate: 74%
Threat type: trojan
Family: clipbanker
Confidence: 100%
detection: 74 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 8eb3d4e293fc6894afef2ee3d4056a473491b39fcd4dbe91a495e60c9311bc6f
SHA1: 24e6c3357c8a97a1c13aa950a3b199d31f9b21e1
MD5: 736439bb3ff646e805806b1ec1559396
Filename: 8eb3d4e2_windowsupdate.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 3322880
Compile time: 2024-12-30T05:57:42Z
PE platform: x64 64-bit
PE sections: 7
Import libraries: 2
TLSH: T1D9F58E2BA3E901ACC0B3C07D89475507EBB2344653A1EEDB56A085665FB7BE01F7A730
SSDEEP: 49152:yhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiV:yhVDdV0bHtRjCVjY
Imphash: 96c988111beae19d6f75f54b89a75585
Richhash: be63dc40a779f3d1d8f78dfd80dada6d
First seen: 2026-11-14T03:40:23Z
Last seen: 2026-11-15T07:46:07Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 22. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 74%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family clipbanker.

Relationship context

22 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

23 timestamped observations are arranged from 2009-02-21 to 2026-11-15. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 74%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 22 visible

5 relationship group(s) provide pivot and infrastructure context.

Threat classification clipbanker

Classification context: type trojan, family clipbanker.

Intelligence freshness Fresh

Last seen today.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 8eb3d4e2_windowsupdate.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 3322880
Compile time: 2024-12-30T05:57:42Z
PE platform: x64 64-bit
Entry point: 2118036
Sections: 7

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

wmi-activityenv-checkadapter-discoverydebug-checkexec-delaymacro-ps

View details · 5 shown

A DLL was loaded from a suspicious directory
A cryptomining command was executed
A document or script file initiated network communications indicative of a potential exploit or payload download
A document or script wrote an executable file to disk
A process created a hidden window

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1496 — A cryptomining command was executed
Tactics: TA0040
T1059 — A document or script wrote an executable file to disk
Tactics: TA0002
T1564.003 — A process created a hidden window
Tactics: TA0005
T1059 · T1064 — A scripting utility was executed
Tactics: TA0002 · TA0005

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
B0032.020 — Argument Obfuscation
Objectives: OB0002
C0026.001 — Base64
Objectives: OC0004
C0032.001 — CRC32
Objectives: OC0004

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 2083, 80, 53

5+ outbound connections observed
2 domains, 5 IPs, 5+ URLs
Common ports: 2083, 80, 53
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: doxbin.cy
URL: https://doxbin.cy:2083/356633?action=init
Protocol: HTTP

Domain: doxbin.cy
URL: https://doxbin.cy:2083/261603?action=init
Protocol: HTTP

Domain: doxbin.cy
URL: https://doxbin.cy:2083/240561?action=init
Protocol: HTTP

Domain: irm.st
URL: http://irm.st/937617
Protocol: HTTP

Domain: irm.st
URL: http://irm.st/929410
Protocol: HTTP

5 shown

DNS request activity2

A4 response IPs

2 DNS requests observed
2 unique queries
4 response IPs
Query types: A
Response codes: NOERROR

View details · 2 shown

Query: irm.st
Type: A
Answers: 104.21.30.35, 172.67.150.120
Response: NOERROR

Query: doxbin.cy
Type: A
Answers: 104.21.55.221, 172.67.173.197
Response: NOERROR

C2 candidates5+

DNS, HTTPports 53

5+ C2 candidate communications
2 domains, 4 IPs
Common ports: 53
Protocols: DNS, HTTP

View details · 5 shown

Domain: irm.st
Protocol: HTTP

Domain: doxbin.cy
Protocol: HTTP

IP: 172.67.150.120
Domain: irm.st
Port: 53
Protocol: DNS

IP: 172.67.173.197
Domain: doxbin.cy
Port: 53
Protocol: DNS

IP: 104.21.55.221
Domain: doxbin.cy
Port: 53
Protocol: DNS

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2024-12-30T05:57:42Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 2118036
Sections: 7
Compile time: 2024-12-30T05:57:42Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 2432792
Raw size: 2433024
Permissions: rx
Entropy: 6.53

Name: .rdata
Virtual address: 2437120
Virtual size: 774918
Raw size: 775168
Permissions: r
Entropy: 6.64

Name: .data
Virtual address: 3215360
Virtual size: 104264
Raw size: 26624
Permissions: rw
Entropy: 3.2

Name: .pdata
Virtual address: 3321856
Virtual size: 78096
Raw size: 78336
Permissions: r
Entropy: 6.28

Name: .fptable
Virtual address: 3403776
Virtual size: 256
Raw size: 512
Permissions: rw
Entropy: 0.0

5 shown

Imports2

2 DLL groups

2 import DLL groups
5+ imported functions summarized

View details · 2 shown

Library: ntdll.dll
Functions: RtlCaptureContext, RtlInitUnicodeString, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwind, RtlUnwindEx, RtlVirtualUnwind

Library: KERNEL32.dll
Functions: AcquireSRWLockExclusive, AreFileApisANSI, BeginUpdateResourceW, CloseHandle, CompareStringEx, CompareStringW, ConnectNamedPipe, CreateDirectoryW …

Resources2

2 resources

2 resources
Resource types: RT_MANIFEST, RT_VERSION

View details · 2 shown

Type: RT_VERSION
Language: ENGLISH US

Type: RT_MANIFEST
Language: ENGLISH US

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check