- First seen
- Last seen
THREAT SIGNALHigh
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70- SHA1
5ee2c81a6d3a69c760df9afea14f90f897186398- MD5
02ce0f50156c5f50b5126e1185c09f81- Filename
- 02ce0f50156c5f50b5126e1185c09f81.virus
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 1612288
- Compile time
- 2044-06-20T18:05:00Z
- PE platform
- x86 32-bit
- PE sections
- 3
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 17. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 79%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections79%
VirusSign confidence100%
Relationship context17 visible
Threat classificationmsil
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
2shown
0%
xml
490 bytes
contains
Filename
MANIFEST_1-x0.xml
File type
xml
MIME
application/xml
Size
490
SHA1
cac699787884fb993ced8d7dc47b7c522c7bc734
74%
high
peexe
524800 bytes
drops
Filename
Decoder.exe
Family
johnnie
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Related IPs
Network IPs associated with this indicator.
5shown
US
communicates
CIDR
54.242.0.0/15
Network
54.242.0.0-54.243.255.255
First seen
2023-10-31T07:46:04Z
Last seen
2026-10-12T01:46:30Z
US
communicates
CIDR
50.19.0.0/16
Network
50.19.0.0-50.19.255.255
First seen
2025-06-28T00:01:17Z
Last seen
2026-10-01T02:02:25Z
0%
US
communicates
CIDR
23.20.0.0/14
Network
23.20.0.0-23.23.255.255
First seen
2025-09-09T08:58:17Z
Last seen
2026-10-26T02:24:46Z
0%
US
communicates
CIDR
54.242.0.0/15
Network
54.242.0.0-54.243.255.255
First seen
2025-09-05T05:55:39Z
Last seen
2025-09-05T05:55:39Z
US
communicates
CIDR
54.242.0.0/15
Network
54.242.0.0-54.243.255.255
First seen
2023-12-17T13:28:57Z
Last seen
2026-10-01T02:02:25Z
Related domains
Domains associated with this indicator.
5shown
.ru
communicates
Root
xsph.ru
TLD
ru
Subdomain
f0583572
First seen
2025-03-13T20:40:16Z
Last seen
2025-03-13T20:40:16Z
19%
high
.ru
communicates
Root
xsph.ru
TLD
ru
Subdomain
f0521569
First seen
2026-08-10T08:40:48Z
Last seen
2026-08-10T08:40:48Z
19%
critical
.ru
communicates
Root
nominally.ru
TLD
ru
First seen
2023-08-03T18:47:54Z
Last seen
2026-10-01T00:52:59Z
10%
medium
.ru
communicates
Root
xsph.ru
TLD
ru
First seen
2026-10-11T23:04:07Z
Last seen
2026-11-09T21:57:55Z
15%
medium
.com
communicates
Root
herokussl.com
TLD
com
Subdomain
nagano-19599
First seen
2023-12-11T01:37:01Z
Last seen
2026-11-06T06:45:40Z
Related URLs
URLs associated with this indicator.
5shown
15%
high
communicates
TLD
ru
HTTP status
200
First seen
2021-10-03T09:56:14Z
Last seen
2025-12-25T02:05:08Z
4%
low
communicates
TLD
ru
HTTP status
200
Content length
12
Content SHA256
3a4763e9937609fbf3b8fd9746f66099114fe8218f2c493eb93b9585eecf1d93
First seen
2021-09-20T20:41:04Z
0%
communicates
TLD
org
HTTP status
200
Content length
13
Content SHA256
ecae028954cf254da80dce3c71bd2809d29cd0637e30052dd5c873a822b75070
First seen
2014-11-11T12:23:12Z
5%
low
communicates
TLD
com
HTTP status
200
Content length
453
Content SHA256
d73e2f581675f10382f37347b7edb6eeb03066af9255ca23c3b0e1b0ccba854e
First seen
2014-12-18T20:07:13Z
5%
medium
communicates
TLD
app
HTTP status
403
Content length
4911
Content SHA256
e7f03cc95a9ba7f696c8968c4a73bd862ff8f9b881693e35f4018c049ebf53bf
First seen
2020-05-23T16:23:02Z
Analysis details
Severity: criticaltrojanmalwareadapter-discoverywmi-activitydebug-checkdotnetcpu-clockexedynamic-loadingdownloaderchinoxydiscovery
Freshness: Historical · Last seen 607 days ago.
- Detection rate
- 79%
- Threat type
- trojan
- Family
- msil
- Confidence
- 100%
- detection
- 79 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70- SHA1
5ee2c81a6d3a69c760df9afea14f90f897186398- MD5
02ce0f50156c5f50b5126e1185c09f81- Filename
- 02ce0f50156c5f50b5126e1185c09f81.virus
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 1612288
- Compile time
- 2044-06-20T18:05:00Z
- PE platform
- x86 32-bit
- PE sections
- 3
- Import libraries
- 1
- TLSH
T1C475CF0437EC8B56E1FF5BB5E0B29190C3B1B466652EEB8F5D8464EE2D23350C911BA3- SSDEEP
24576:FHhoAjL7/hhUF54clNf7lhhUF54clNf766uHAW92zt/sWu2BSMCqD0RU:jLto54clRo54cl8LH+tkWJ0Xy- Imphash
f34d5f2d4577ed6d9ceec516c1f5a744- First seen
- 2021-10-04T05:32:17Z
- Last seen
- 2025-03-13T01:58:55Z
- Filename variants
- 3 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 17. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 79%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family msil.
Relationship context
17 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
18 timestamped observations are arranged from 2014-11-11 to 2044-06-20. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family msil.
Last seen 607 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 02ce0f50156c5f50b5126e1185c09f81.virus
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 1612288
- Compile time
- 2044-06-20T18:05:00Z
- PE platform
- x86 32-bit
- Entry point
- 1617710
- Sections
- 3
Observed behavior
summaryBehavioral indicators observed during analysis. More details and additional structured data are available through API and data access.
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
HTTP, TCPports 443, 80
- 5+ outbound connections observed
- 5 domains, 5+ IPs, 5+ URLs
- Common ports: 443, 80
- Protocols: HTTP, TCP
View details · 5 shown
- Domain
- nominally.ru
- URL
- https://nominally.ru:443/exostub.php?chatid=596031918
- Protocol
- HTTP
- Domain
- nominally.ru
- URL
- https://nominally.ru/exostub.php?chatid=596031918
- Protocol
- HTTP
- Domain
- f0583572.xsph.ru
- URL
- http://f0583572.xsph.ru/gate.php
- Protocol
- HTTP
- Domain
- freegeoip.app
- URL
- https://freegeoip.app/xml/
- Protocol
- HTTP
- IP
- 209.197.3.8
- Port
- 80
- Protocol
- TCP
5 shown
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- nominally.ru
- Type
- A
- Answers
- 104.21.1.182, 172.67.129.178
- Response
- NOERROR
- Query
- nagano-19599.herokussl.com
- Type
- A
- Answers
- 50.16.248.208, 54.243.45.255, 50.19.223.195, 54.243.117.237, 54.243.29.214, 50.17.226.156, 23.23.137.115, 54.243.252.28
- Response
- NOERROR
- Query
- ip-api.com
- Type
- A
- Answers
- 208.95.112.1
- Response
- NOERROR
- Query
- freegeoip.app
- Type
- A
- Answers
- 104.21.19.200, 172.67.188.154
- Response
- NOERROR
- Query
- f0583572.xsph.ru
- Type
- A
- Answers
- 141.8.192.151
- Response
- NOERROR
5 shown
C2 candidates1
HTTP
- 1 C2 candidate communications
- 1 domains, 0 IPs
- Protocols: HTTP
View details · 1 shown
- Domain
- f0583572.xsph.ru
- Protocol
- HTTP
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit3 sections
- Platform: x86 32-bit
- Sections: 3
- Entry point: present
- Compile time: 2044-06-20T18:05:00Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 1617710
- Sections
- 3
- Compile time
- 2044-06-20T18:05:00Z
PE sections3
3 sections
- 3 PE sections
- Common permissions: r, rx
- 3 unique section names
View details · 3 shown
- Name
- .text
- Virtual address
- 8192
- Virtual size
- 1609524
- Raw size
- 1609728
- Permissions
- rx
- Entropy
- 7.22
- Name
- .rsrc
- Virtual address
- 1622016
- Virtual size
- 1404
- Raw size
- 1536
- Permissions
- r
- Entropy
- 3.98
- Name
- .reloc
- Virtual address
- 1630208
- Virtual size
- 12
- Raw size
- 512
- Permissions
- r
- Entropy
- 0.1
Imports1
1 DLL groups
- 1 import DLL groups
- 1 imported functions summarized
View details · 1 shown
- Library
- mscoree.dll
- Functions
- _CorExeMain
Resources2
2 resources
- 2 resources
- Resource types: RT_MANIFEST, RT_VERSION
View details · 2 shown
- Type
- RT_VERSION
- Language
- NEUTRAL
- Type
- RT_MANIFEST
- Language
- NEUTRAL