- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
a27568397d62fe4c514babc71eea5364b8a68c529d207ae7ca6b17fe16acc4cd- SHA1
0bc4c6b48487ec98b13babf950b0f3681f487959- MD5
46e6720e297b7a5a5fc6b26517636172- Filename
- crytest.msi
- File type
- msi
- MIME
- application/x-msi
- File size
- 3141632
- Filename variants
- 4 reported
- TLSH
T138E533B4B2888F37D7412238515A139646A1FC89862ED0FD5B83B35DBE3DC4D2335B9A- SSDEEP
49152:iVxAJsa/Shp5y2t3RExFhzFzEuRMXI6nwNRI5OzXJtz4XSZ:iVKp/SP5yg3REfVFwP46wNRUdi
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (5%).
Confidence signal
VirusSign confidence is elevated at 58%. Use it as supporting evidence together with detections, family and relationship context.
Analysis signals
OBSERVEDEngine detections5%
VirusSign confidence58%
Relationship context12 visible
Threat classificationmsil
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
png
62330 bytes
contains
Filename
install_bg.png
File type
png
MIME
application/octet-stream
Size
62330
SHA1
333fe58418330dfa4de77a9c77cf7b1aa6c884b3
0%
html
162753 bytes
contains
Filename
PrivacyPolicy_zh-TW.htm
File type
html
MIME
text/html
Size
162753
SHA1
b442c6a8956dda42374cc4896779f6fa9e87550f
0%
text
687 bytes
contains
Filename
FunctionalConsent_pl-PL.txt
File type
text
MIME
text/plain
Size
687
SHA1
d87824e3d7a9cd25db94f0e9afd5ee7288125555
0%
javascript
1470225 bytes
contains
Filename
137FC815368159E4BAD9A0DE3924CCF610072034A2FC677665EA11B6B2B29C853E01E18F06CDD5F0E5598BAD496CAE97BEDA2D332654C4765533B68…
File type
javascript
MIME
application/javascript
Size
1470225
SHA1
137fc815368159e4bad9a0de3924ccf610072034
0%
pedll
101024 bytes
contains
Filename
System.Collections.NonGeneric.dll (copy)
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
101024
Compile time
2088-09-26T14:51:43Z
Related IPs
Network IPs associated with this indicator.
5shown
0%
FI
communicates
CIDR
65.108.0.0/15
Network
65.108.0.0-65.109.255.255
First seen
2026-08-13T14:14:19Z
Last seen
2026-11-10T09:01:39Z
0%
US
communicates
CIDR
52.123.0.0/16
Network
52.120.0.0-52.123.255.255
First seen
2023-09-29T02:14:35Z
Last seen
2026-11-10T15:50:21Z
0%
US
communicates
CIDR
52.123.0.0/16
Network
52.120.0.0-52.123.255.255
First seen
2023-10-09T11:42:19Z
Last seen
2026-11-10T15:50:21Z
0%
US
communicates
CIDR
52.123.0.0/16
Network
52.120.0.0-52.123.255.255
First seen
2023-09-30T12:16:01Z
Last seen
2026-11-10T15:49:08Z
0%
US
communicates
CIDR
52.123.0.0/16
Network
52.120.0.0-52.123.255.255
First seen
2023-09-30T14:08:51Z
Last seen
2026-11-10T15:49:45Z
Related domains
Domains associated with this indicator.
2shown
.de
communicates
Root
your-server.de
TLD
de
Subdomain
static.85.133.108.65.clients
First seen
2026-11-10T02:03:20Z
Last seen
2026-11-10T09:01:39Z
0%
.microsoft
communicates
Root
cloud.microsoft
TLD
microsoft
Subdomain
atm.teams.mira.tm.svc
First seen
2024-08-26T16:41:58Z
Last seen
2026-11-10T15:50:22Z
Analysis details
Severity: criticaltrojanusb-checkmsipersistenceransomwareexecutionratdiscovery
Freshness: Fresh · Last seen today.
- Detection rate
- 5%
- Threat type
- trojan
- Family
- msil
- Confidence
- 58%
- detection
- 5 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
a27568397d62fe4c514babc71eea5364b8a68c529d207ae7ca6b17fe16acc4cd- SHA1
0bc4c6b48487ec98b13babf950b0f3681f487959- MD5
46e6720e297b7a5a5fc6b26517636172- Filename
- crytest.msi
- File type
- msi
- MIME
- application/x-msi
- File size
- 3141632
- TLSH
T138E533B4B2888F37D7412238515A139646A1FC89862ED0FD5B83B35DBE3DC4D2335B9A- SSDEEP
49152:iVxAJsa/Shp5y2t3RExFhzFzEuRMXI6nwNRI5OzXJtz4XSZ:iVKp/SP5yg3REfVFwP46wNRUdi- First seen
- 2026-11-10T01:57:20Z
- Last seen
- 2026-11-10T09:01:31Z
- Filename variants
- 4 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (5%).
Confidence signal
VirusSign confidence is elevated at 58%. Use it as supporting evidence together with detections, family and relationship context.
Threat context
Classification includes type trojan and family msil.
Relationship context
12 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
13 timestamped observations are arranged from 2014-03-31 to 2088-09-26. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family msil.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- crytest.msi
- File type
- msi
- MIME
- application/x-msi
- Size
- 3141632
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- ArechClient2 configuration was extracted
- Attempts to make a network connection via suspicious process
- Checks available memory
- Checks for available system drives (often done to infect USB drives)
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1059 — Apparent Internal Usage of CMD.EXETactics: TA0002
- T1082 — Checks available memoryTactics: TA0007
- T1091 · T1120 — Checks for available system drives (often done to infect USB drives)Tactics: TA0001 · TA0007 · TA0008
- T1055 — Creates a process in a suspended state, likely for injectionTactics: TA0004 · TA0005
5 shown
View MBC details · 5 shown
- CommunicationObjectives: OC0006
- C0016 — Create FileObjectives: OC0001
- Defense EvasionObjectives: OB0006
- DiscoveryObjectives: OB0007
- File SystemObjectives: OC0001
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity1
TCPports 443
- 1 outbound connections observed
- 0 domains, 1 IPs, 0 URLs
- Common ports: 443
- Protocols: TCP
View details · 1 shown
- IP
- 65.108.133.85
- Port
- 443
- Protocol
- TCP
DNS request activity2
A5+ response IPs
- 2 DNS requests observed
- 2 unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 2 shown
- Query
- static.85.133.108.65.clients.your-server.de
- Type
- A
- Answers
- 65.108.133.85
- Response
- NOERROR
- Query
- atm.teams.mira.tm.svc.cloud.microsoft
- Type
- A
- Answers
- 52.123.248.10, 52.123.248.38, 52.123.248.46, 52.123.248.55, 52.123.248.78, 52.123.248.3, 52.123.248.29, 52.123.248.42
- Response
- NOERROR