- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
a4ba39f62e5ea628c91617afebe099cdb323f18b79136ec22a672fba5ab72fb4- SHA1
a05ed9d960acb0e6ddc0701d73a78abd6f724811- MD5
370be24437cd3157c99be6a187702a3c- Filename
- a4ba39f62e5ea628.ps1.bin
- File type
- powershell
- MIME
- text/plain
- File size
- 14275
- TLSH
T105522320A794F7D7C62F427219BDD60EA76B0070D7CE18AC5401BACC692670BF65F8E5- SSDEEP
384:aAKO0js4JO0okXdPmdH7uSQZWAXVqWyVg+:aAKjvzoEv9Fgjr
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (5%).
Threat context
Classification includes type downloader and family gen446.
Analysis signals
OBSERVEDEngine detections5%
VirusSign confidence40%
Relationship context14 visible
Threat classificationgen446
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
35%
high
powershell
432 bytes
drops
Filename
ca11959f_runtimebroker93.ps1.bin
Family
alien
Type
downloader
File type
powershell
MIME
text/plain
0%
powershell
233 bytes
drops
Filename
56dedf9d_runner.ps1.bin
File type
powershell
MIME
text/plain
Size
233
SHA1
24edc16f934671b84eff746e8b84f2a5c07caa7c
0%
csv
3435 bytes
drops
Filename
8e7bdcd9_powershell.exe.log.bin
File type
csv
MIME
text/plain
Size
3435
SHA1
e0f51f63ec373eed32a725d666c2e6f0c389ab78
0%
64 bytes
drops
Filename
a7de5177_startupprofiledata-noninteractive.bin
MIME
application/octet-stream
Size
64
SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799
First seen
2014-08-19T15:29:21Z
0%
powershell
60 bytes
drops
Filename
96ad1146___psscriptpolicytest_iugzvutm.mi5.ps1.bin
File type
powershell
MIME
text/plain
Size
60
SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d
Related IPs
Network IPs associated with this indicator.
4shown
0%
US
communicates
CIDR
172.67.128.0/17
Network
172.64.0.0-172.71.255.255
First seen
2023-10-01T16:09:10Z
Last seen
2026-11-14T22:01:43Z
0%
US
communicates
CIDR
104.21.0.0/17
Network
104.16.0.0-104.31.255.255
First seen
2023-10-02T05:12:28Z
Last seen
2026-11-14T22:01:43Z
5%
low
US
communicates
CIDR
172.67.128.0/17
Network
172.64.0.0-172.71.255.255
First seen
2023-09-29T10:19:38Z
Last seen
2026-11-14T22:01:43Z
5%
low
US
communicates
CIDR
104.21.0.0/17
Network
104.16.0.0-104.31.255.255
First seen
2023-09-30T03:04:45Z
Last seen
2026-11-14T22:01:43Z
Related domains
Domains associated with this indicator.
2shown
11%
high
.com
communicates
Root
mailsdevcloud.com
TLD
com
First seen
2026-11-07T10:55:57Z
Last seen
2026-11-14T22:01:44Z
35%
high
.com
communicates
Root
t-trustrest.com
TLD
com
First seen
2026-10-17T10:53:24Z
Last seen
2026-11-14T22:01:44Z
Related URLs
URLs associated with this indicator.
3shown
33%
high
communicates
TLD
com
HTTP status
200
Content length
432
Content SHA256
ca11959fbc153287139828a788b9d15b51f674bb11e4a1b2c9d9d3f6ed0bda9c
First seen
2026-11-14T18:02:09Z
33%
high
communicates
TLD
com
HTTP status
200
Content length
28
Content SHA256
3c5fe423ed69959e83d7527c728b8256154b3ed6ffe89e63efc83fbe01388f86
First seen
2026-11-08T17:37:14Z
10%
high
communicates
TLD
com
HTTP status
200
Content length
146764166
Content SHA256
aaa3ca841ce454d2bc30fa09032cf2a6a651869c70208899c3d235d4fd06b8e5
First seen
2026-11-09T06:33:34Z
Analysis details
Severity: highdownloaderobfuscatedmacro-psdebug-checkadapter-discoverywmi-activitypowershell
Freshness: Fresh · Last seen today.
- Detection rate
- 5%
- Threat type
- downloader
- Family
- gen446
- Confidence
- 40%
- detection
- 5 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
a4ba39f62e5ea628c91617afebe099cdb323f18b79136ec22a672fba5ab72fb4- SHA1
a05ed9d960acb0e6ddc0701d73a78abd6f724811- MD5
370be24437cd3157c99be6a187702a3c- Filename
- a4ba39f62e5ea628.ps1.bin
- File type
- powershell
- MIME
- text/plain
- File size
- 14275
- TLSH
T105522320A794F7D7C62F427219BDD60EA76B0070D7CE18AC5401BACC692670BF65F8E5- SSDEEP
384:aAKO0js4JO0okXdPmdH7uSQZWAXVqWyVg+:aAKjvzoEv9Fgjr- First seen
- 2026-11-14T17:47:42Z
- Last seen
- 2026-11-14T22:01:42Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (5%).
Threat context
Classification includes type downloader and family gen446.
Relationship context
14 related indicators are shown across 4 relationship group(s).
Observation timeline
15 timestamped observations are arranged from 2014-08-19 to 2026-11-14. These are observation or metadata times, not execution order.
Infrastructure geography
4 infrastructure/location point(s) are visible on the map. 4 point(s) are country-level approximate.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type downloader, family gen446.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- a4ba39f62e5ea628.ps1.bin
- File type
- powershell
- MIME
- text/plain
- Size
- 14275
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- A document or script file initiated network communications indicative of a potential exploit or payload download
- A process created a hidden window
- A script or command line contains a long continuous string indicative of obfuscation
- A scripting utility was executed
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1071 — A document or script file initiated network communications indicative of a potential exploit or payload downloadTactics: TA0011
- T1564.003 — A process created a hidden windowTactics: TA0005
- T1059 — A script or command line contains a long continuous string indicative of obfuscationTactics: TA0002
- T1059 · T1064 — A scripting utility was executedTactics: TA0002 · TA0005
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- F0013 — BootkitObjectives: OB0006 · OB0012
- E1059 — Command and Scripting InterpreterObjectives: OB0009
- CommunicationObjectives: OC0006
- C0016 — Create FileObjectives: OC0001
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
HTTP, TCPports 443
- 5+ outbound connections observed
- 2 domains, 2 IPs, 3 URLs
- Common ports: 443
- Protocols: HTTP, TCP
View details · 5 shown
- Domain
- t-trustrest.com
- URL
- https://t-trustrest.com/ug/api?t=dbf26e6b862fd5d5d519ac665754c8254b905799&track=1&event=launch_ok
- Protocol
- HTTP
- Domain
- t-trustrest.com
- URL
- https://t-trustrest.com/p?t=88d810d2f51a
- Protocol
- HTTP
- Domain
- mailsdevcloud.com
- URL
- https://mailsdevcloud.com/flomoug.zip
- Protocol
- HTTP
- IP
- 172.67.188.99
- Port
- 443
- Protocol
- TCP
- IP
- 104.21.10.104
- Port
- 443
- Protocol
- TCP
DNS request activity2
A4 response IPs
- 2 DNS requests observed
- 2 unique queries
- 4 response IPs
- Query types: A
- Response codes: NOERROR
View details · 2 shown
- Query
- t-trustrest.com
- Type
- A
- Answers
- 104.21.40.214, 172.67.188.99
- Response
- NOERROR
- Query
- mailsdevcloud.com
- Type
- A
- Answers
- 104.21.10.104, 172.67.131.80
- Response
- NOERROR
C2 candidates4
DNS, HTTPports 53
- 4 C2 candidate communications
- 2 domains, 2 IPs
- Common ports: 53
- Protocols: DNS, HTTP
View details · 4 shown
- Domain
- t-trustrest.com
- Protocol
- HTTP
- IP
- 172.67.188.99
- Domain
- t-trustrest.com
- Port
- 53
- Protocol
- DNS
- Domain
- mailsdevcloud.com
- Protocol
- HTTP
- IP
- 104.21.10.104
- Domain
- mailsdevcloud.com
- Port
- 53
- Protocol
- DNS