- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
8f2e3739fc59a37623ea8ac1782f773ab6668e9108789fcb7cca9b3504a4e00a- SHA1
859b02d6ee1c3328b6e9bec49290427b029e9548- MD5
2e4eededd83f7aeb47ba963aa61a8ef6- Filename
- ey8ri2o.exe
- File type
- msi
- MIME
- application/x-msi
- File size
- 40960
- Filename variants
- 2 reported
- TLSH
T166037C0AB6448336D9450B32466F87D48F766C5CCFB321123AEE774D2D729A066F78E8- SSDEEP
768:U0SJfd7oirqd+XMDZlMM27xtLgWMbCkGWvBz/z/i:0lU4UjtaSbx1BS
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (5%).
Threat context
Classification includes type trojan and family ole2.
Analysis signals
OBSERVEDEngine detections5%
VirusSign confidence25%
Relationship context12 visible
Threat classificationole2
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
1shown
0%
vba
284 bytes
contains
Filename
C_oSiLYmp4Ql
File type
vba
MIME
text/plain
Size
284
SHA1
b3391171246c731eaf58ca801226b748c55e7c39
Related IPs
Network IPs associated with this indicator.
5shown
0%
DE
communicates
CIDR
88.99.0.0/16
Network
88.99.216.128-88.99.216.191
First seen
2024-06-13T18:41:44Z
Last seen
2026-11-11T21:45:50Z
0%
DE
communicates
CIDR
144.76.0.0/16
Network
144.76.237.32-144.76.237.63
First seen
2026-05-12T09:31:30Z
Last seen
2026-11-11T21:45:50Z
0%
US
communicates
CIDR
104.20.0.0/18
Network
104.16.0.0-104.31.255.255
First seen
2025-07-20T09:02:09Z
Last seen
2026-11-11T21:45:50Z
0%
US
communicates
CIDR
172.66.128.0/19
Network
172.64.0.0-172.71.255.255
First seen
2025-06-26T08:14:03Z
Last seen
2026-11-11T21:45:50Z
US
communicates
CIDR
3.16.0.0/13
Network
3.0.0.0-3.127.255.255
First seen
2024-03-06T12:29:28Z
Last seen
2026-11-11T21:45:50Z
Related domains
Domains associated with this indicator.
5shown
.com
communicates
Root
azure.com
TLD
com
Subdomain
dnsprxnov10build-zone.centralus.cloudapp
First seen
2026-09-25T06:28:30Z
Last seen
2026-11-11T21:45:51Z
0%
.network
communicates
Root
pocket.network
TLD
network
Subdomain
eth.api
First seen
2024-02-25T14:20:52Z
Last seen
2026-11-11T21:45:51Z
10%
medium
.io
communicates
Root
0xrpc.io
TLD
io
First seen
2025-01-17T05:13:59Z
Last seen
2026-11-11T21:45:51Z
5%
medium
.io
communicates
Root
mevblocker.io
TLD
io
Subdomain
rpc
First seen
2023-09-29T14:55:23Z
Last seen
2026-11-11T21:45:51Z
0%
.net
communicates
Root
flashbots.net
TLD
net
Subdomain
rpc
First seen
2023-10-01T12:03:38Z
Last seen
2026-11-11T21:45:51Z
Related URLs
URLs associated with this indicator.
1shown
5%
low
communicates
TLD
org
HTTP status
200
Content length
29430681
Content SHA256
06e30b4e70b18d794651ef132c39080e5eaaa1187f938721d57edae2824f4e96
First seen
2023-07-28T04:00:29Z
Analysis details
Severity: hightrojanusb-checkmsi
Freshness: Fresh · Last seen today.
- Detection rate
- 5%
- Threat type
- trojan
- Family
- ole2
- Confidence
- 25%
- detection
- 5 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
8f2e3739fc59a37623ea8ac1782f773ab6668e9108789fcb7cca9b3504a4e00a- SHA1
859b02d6ee1c3328b6e9bec49290427b029e9548- MD5
2e4eededd83f7aeb47ba963aa61a8ef6- Filename
- ey8ri2o.exe
- File type
- msi
- MIME
- application/x-msi
- File size
- 40960
- TLSH
T166037C0AB6448336D9450B32466F87D48F766C5CCFB321123AEE774D2D729A066F78E8- SSDEEP
768:U0SJfd7oirqd+XMDZlMM27xtLgWMbCkGWvBz/z/i:0lU4UjtaSbx1BS- First seen
- 2026-11-11T01:37:48Z
- Last seen
- 2026-11-11T21:45:48Z
- Filename variants
- 2 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (5%).
Threat context
Classification includes type trojan and family ole2.
Relationship context
12 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
13 timestamped observations are arranged from 2023-07-28 to 2026-11-11. These are observation or metadata times, not execution order.
Infrastructure geography
5 infrastructure/location point(s) are visible on the map. 2 point(s) are country-level approximate.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family ole2.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- ey8ri2o.exe
- File type
- msi
- MIME
- application/x-msi
- Size
- 40960
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- Attempts to make a network connection via suspicious process
- Checks available memory
- Checks for available system drives (often done to infect USB drives)
- Checks system language via registry key (possible geofencing)
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1059 — Apparent Internal Usage of CMD.EXETactics: TA0002
- T1082 — Checks available memoryTactics: TA0007
- T1091 · T1120 — Checks for available system drives (often done to infect USB drives)Tactics: TA0001 · TA0007 · TA0008
- T1055 — Creates a process in a suspended state, likely for injectionTactics: TA0004 · TA0005
5 shown
View MBC details · 5 shown
- CommunicationObjectives: OC0006
- C0016 — Create FileObjectives: OC0001
- Defense EvasionObjectives: OB0006
- DiscoveryObjectives: OB0007
- File SystemObjectives: OC0001
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCP, HTTPports 443
- 5+ outbound connections observed
- 1 domains, 5+ IPs, 1 URLs
- Common ports: 443
- Protocols: TCP, HTTP
View details · 5 shown
- Domain
- nodejs.org
- URL
- https://nodejs.org/dist/v18.17.0/node-v18.17.0-win-x64.zip
- Protocol
- HTTP
- IP
- 35.227.193.242
- Port
- 443
- Protocol
- TCP
- IP
- 146.19.24.104
- Port
- 443
- Protocol
- TCP
- IP
- 104.20.24.117
- Port
- 443
- Protocol
- TCP
- IP
- 3.13.168.143
- Port
- 443
- Protocol
- TCP
5 shown
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- rpc.mevblocker.io
- Type
- A
- Answers
- 104.18.11.61, 104.18.10.61
- Response
- NOERROR
- Query
- mainnet.gateway.tenderly.co
- Type
- A
- Answers
- 35.227.193.242
- Response
- NOERROR
- Query
- ethereum-rpc.publicnode.com
- Type
- A
- Answers
- 172.66.150.162, 104.20.24.117
- Response
- NOERROR
- Query
- 0xrpc.io
- Type
- A
- Answers
- 146.19.24.104
- Response
- NOERROR
- Query
- eth.merkle.io
- Type
- A
- Answers
- 104.20.32.209, 172.66.156.92
- Response
- NOERROR
5 shown