Report - 9afb54ce25c3…6cc6808a0e

Malicious HighFILE

Quota 30

First seen: 2022-12-26T20:07:30Z
Last seen: 2024-12-18T13:40:01Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYcerbutrojan

RELATED INDICATORS13Connections in this report

ANALYSISMaliciousHistorical

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 9afb54ce25c359bc00ec369d8f08c666d953ff95b8f252a361b8da6cc6808a0e
SHA1: 67abd07326e772637bd8ba0320c1a97a9b5ce863
MD5: 58f5d068943e7664ea6573be7a000518
Filename: RETURN_REALRPG.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 433568
Compile time: 2022-12-29T13:05:14Z
PE platform: x86 32-bit
PE sections: 3

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 13. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 48%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections48%

VirusSign confidence100%

Relationship context13 visible

Threat classificationcerbu

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

13 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

1shown

404e02d011bc669c67ead03b175f7eaab8a01e00c044f6aed26dc0fb1ffef4f5

0% ico 20 bytes contains

Filename MAINICON File type ico MIME application/octet-stream Size 20 SHA1 5ed1d3100502c999ae46a84582b2978c9a4b4802

Related IPs

Network IPs associated with this indicator.

5shown

172.64.155.188

0% US communicates

CIDR 172.64.144.0/20 Network 172.64.0.0-172.71.255.255 First seen 2023-10-03T17:52:18Z Last seen 2026-11-12T17:16:29Z

104.18.32.68

5% low US communicates

CIDR 104.16.0.0/14 Network 104.16.0.0-104.31.255.255 First seen 2023-09-30T13:34:10Z Last seen 2026-11-11T17:00:45Z

209.197.3.8

11% high US communicates

CIDR 209.197.0.0/19 Network 209.197.0.0-209.197.31.255 First seen 2023-09-30T21:27:37Z Last seen 2026-11-13T03:12:18Z

131.107.255.255

0% US communicates

CIDR 131.107.0.0/16 Network 131.107.0.0-131.107.255.255 First seen 2023-09-30T20:19:39Z Last seen 2026-11-13T02:31:46Z

23.195.81.16

0% US communicates

CIDR 23.195.80.0/20 Network 23.192.0.0-23.223.255.255 First seen 2023-09-29T16:34:21Z Last seen 2026-11-13T04:10:31Z

Related domains

Domains associated with this indicator.

3shown

dns.msftncsi.com

0% .com communicates

Root msftncsi.com TLD com Subdomain dns First seen 2023-09-30T20:19:39Z Last seen 2026-11-13T04:07:23Z

microsoft.com

0% .com communicates

Root microsoft.com TLD com First seen 2026-01-29T18:48:34Z Last seen 2026-11-13T04:13:38Z

crl.microsoft.com

0% .com communicates

Root microsoft.com TLD com Subdomain crl First seen 2023-09-30T22:38:44Z Last seen 2026-11-13T04:13:38Z

Related URLs

URLs associated with this indicator.

4shown

http://209.197.3.8/

10% critical communicates

First seen 2014-12-31T05:40:05Z Last seen 2026-10-07T15:43:17Z

http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl

0% communicates

TLD com HTTP status 200 Content length 767 Content SHA256 50795b027e2bc566d3b7acb89913f8efd23b70615c9db9bf5b23323ad3132a7d First seen 2011-10-22T01:16:18Z

http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl

0% communicates

TLD com HTTP status 200 Content length 519 Content SHA256 b19f80a5970542f71e1728cdeee5d4534598329ba22fabf5bbd2280ebd6ba629 First seen 2012-06-22T07:35:22Z

http://crl.microsoft.com/pki/crl/products/WinPCA.crl

0% communicates

TLD com HTTP status 200 Content length 530 Content SHA256 3b9b2f75b724fe5354d24a0ef729b8a2aaa8a9313166eafb1f73b07cf1a745ef First seen 2011-04-19T20:21:18Z

Analysis details

Severity: hightrojanexedotnetfile-overlaydynamic-loadingdebug-checkexec-delaycpu-clocksigned

Freshness: Historical · Last seen 694 days ago.

Detection rate: 48%
Threat type: trojan
Family: cerbu
Confidence: 100%
detection: 48 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 9afb54ce25c359bc00ec369d8f08c666d953ff95b8f252a361b8da6cc6808a0e
SHA1: 67abd07326e772637bd8ba0320c1a97a9b5ce863
MD5: 58f5d068943e7664ea6573be7a000518
Filename: RETURN_REALRPG.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 433568
Compile time: 2022-12-29T13:05:14Z
PE platform: x86 32-bit
PE sections: 3
Import libraries: 1
TLSH: T1B9942302279CBC1FE51655B654ECED511F386F318496C9C37369E0882C2B7AFCE815AB
SSDEEP: 12288:CzOacIoXNMLynLzrYu4OOHtzX6eEsMVTCH:c3cIodV7YROOHztMUH
Imphash: f34d5f2d4577ed6d9ceec516c1f5a744
First seen: 2022-12-26T20:07:30Z
Last seen: 2024-12-18T13:40:01Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 13. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 48%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family cerbu.

Relationship context

13 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

14 timestamped observations are arranged from 2011-04-19 to 2026-01-29. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 48%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 13 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification cerbu

Classification context: type trojan, family cerbu.

Intelligence freshness Historical

Last seen 694 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: RETURN_REALRPG.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 433568
Compile time: 2022-12-29T13:05:14Z
PE platform: x86 32-bit
Entry point: 425710
Sections: 3

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-checkcpu-clockexec-delaydynamic-loading

View details · 5 shown

This sample appears to be packed. Packed samples have often been obfuscated to hide their logic. capa cannot handle obfuscation well. This means the results may be misleading or incomplete. If possible, you should try to unpack this input file before analyzin…
compiled to the .NET platform
encode data using Base64
load .NET assembly
packed with Confuser

View MITRE ATT&CK details · 5 shown

T1027.002 — Binary may include packed or crypted data
Tactics: TA0005
T1497 — Contains long sleeps (>= 3 min)
Tactics: TA0005 · TA0007
T1036 — Creates files inside the user directory
Tactics: TA0005
T1562.001 — Creates guard pages, often used to prevent reverse engineering and debugging
Tactics: TA0005
T1082 — Queries the cryptographic machine GUID
Tactics: TA0007

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCPports 80, 443

5+ outbound connections observed
2 domains, 5 IPs, 4 URLs
Common ports: 80, 443
Protocols: HTTP, TCP

View details · 5 shown

Domain: 209.197.3.8
URL: http://209.197.3.8/
Protocol: HTTP

IP: 209.197.3.8
Port: 80
Protocol: TCP

IP: 104.18.32.68
Port: 80
Protocol: TCP

Domain: crl.microsoft.com
URL: http://crl.microsoft.com/pki/crl/products/winpca.crl
Protocol: HTTP

Domain: crl.microsoft.com
URL: http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl
Protocol: HTTP

5 shown

DNS request activity1

A1 response IPs

1 DNS requests observed
1 unique queries
1 response IPs
Query types: A
Response codes: NOERROR

View details · 1 shown

Query: dns.msftncsi.com
Type: A
Answers: 131.107.255.255
Response: NOERROR

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit3 sections

Platform: x86 32-bit
Sections: 3
Entry point: present
Compile time: 2022-12-29T13:05:14Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 425710
Sections: 3
Compile time: 2022-12-29T13:05:14Z

PE sections3

3 sections

3 PE sections
Common permissions: r, rx
3 unique section names

View details · 3 shown

Name: .text
Virtual address: 8192
Virtual size: 417524
Raw size: 417792
Permissions: rx
Entropy: 7.99

Name: .rsrc
Virtual address: 425984
Virtual size: 2240
Raw size: 2560
Permissions: r
Entropy: 3.47

Name: .reloc
Virtual address: 434176
Virtual size: 12
Raw size: 512
Permissions: r
Entropy: 0.1

Imports1

1 DLL groups

1 import DLL groups
1 imported functions summarized

View details · 1 shown

Library: mscoree.dll
Functions: _CorExeMain

Resources3

3 resources

3 resources
Resource types: RT_GROUP_ICON, RT_ICON, RT_VERSION

View details · 3 shown

Type: RT_ICON
Language: NEUTRAL

Type: RT_GROUP_ICON
Language: NEUTRAL

Type: RT_VERSION
Language: NEUTRAL

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5+

5+ issuers

Example subject: Raynaldo
Issued by: Sectigo Public Code Signing CA R36
Validity period (UTC): 2022-08-17 – 2024-08-16

View details · 5 shown

Subject: Raynaldo
Issuer: Sectigo Public Code Signing CA R36
Valid from: 1660694400.0
Valid to: 1723852740.0
Fingerprint: 4A7E218A6BCCC667A2DE02CF01C3BD28849BE314

Subject: Sectigo Public Code Signing CA R36
Issuer: Sectigo Public Code Signing Root R46
Valid from: 1616371200.0
Valid to: 2089756740.0
Fingerprint: 0BC5E76773D2E44FC9903D4DFEFE451553BBEC4A

Subject: Sectigo Public Code Signing Root R46
Issuer: AAA Certificate Services
Valid from: 1621900800.0
Valid to: 1861919940.0
Fingerprint: 329B78A5C9EBC2043242DE90CE1B7C6B1BA6C692

Subject: Sectigo (AAA)
Issuer: AAA Certificate Services
Valid from: 1072915200.0
Valid to: 1861919940.0
Fingerprint: D1EB23A46D17D68FD92564C2F1F1601764D8E349

Subject: AAA Certificate Services
Issuer: AAA Certificate Services
Fingerprint: D1EB23A46D17D68FD92564C2F1F1601764D8E349

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check