- First seen
- Last seen
THREAT SIGNALMedium
Read alongside the verdict
Indicator overview
INDICATOR PROFILEVirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.
- SHA256
a6611a44c32bc8ba9194298db09c49f1914dffa5ae30a9acb60b2b0641dc802d- SHA1
f98fef150e0e0d720a33a252f2a9fbfbbcb3e95b- MD5
28858c557194d7d7d62ed5ffb1206889- Filename
- a6611a44_saret.msi.bin
- File type
- msi
- MIME
- application/x-msi
- File size
- 10670080
- TLSH
T17FB633FA749347F2CB09457A4B13BBC057593C7A629041828ABC7ADE5770EB07871EB2- SSDEEP
196608:hc5l64Wr2VzZiT+ghw6IMAcnpzDxYqIammTNep:h+64qcmgMAWHxYqQOw
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
High-confidence evidence. Related indicators in this report: 12. Review the supporting evidence before taking action.
Detection signal
Malicious. A limited set of engine detections is present (24%).
Confidence signal
VirusSign reports 93% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections24%
VirusSign confidence93%
Relationship context12 visible
Threat classificationmsil
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
xml
3526 bytes
contains
Filename
7c722b0b_fil4002c547c17f4ab8864d9ecb89d2ccc7.bin
File type
xml
MIME
application/xml
Size
3526
SHA1
fdcbb149743545ef3769ec6920caf072342a4b9c
0%
xml
24415920 bytes
contains
Filename
60c0df85_fil1ba8811cda044437a10099ea29a0e9bb.bin
File type
xml
MIME
application/xml
Size
24415920
SHA1
0a92e513412ee90bf4aded2a6638e5d60cb5354d
0%
xml
3310 bytes
contains
Filename
5f1c20ab_orderprocessor.csproj.user.bin
File type
xml
MIME
application/xml
Size
3310
SHA1
9c530d58bb09e1984085aa8279ff4247bf15f3df
0%
xml
3086 bytes
contains
Filename
3b4b1d64_fil612073f9192348019ff20d5aef492b3b.bin
File type
xml
MIME
application/xml
Size
3086
SHA1
9c93871013b2180c107a6fcf6467c0305674a4a4
0%
xml
3952 bytes
contains
Filename
29a0f73f_file9646c12933548199c8639ed9af10c9b.bin
File type
xml
MIME
application/xml
Size
3952
SHA1
4184c616e27ad311427c0c946c697a9af8f196aa
Related IPs
Network IPs associated with this indicator.
5shown
US
communicates
CIDR
23.1.104.0/23
Network
23.0.0.0-23.15.255.255
First seen
2023-10-27T01:27:50Z
Last seen
2026-11-14T04:27:23Z
US
communicates
CIDR
23.1.104.0/23
Network
23.0.0.0-23.15.255.255
First seen
2023-11-12T11:51:58Z
Last seen
2026-11-14T04:27:23Z
0%
US
communicates
CIDR
23.1.104.0/23
Network
23.0.0.0-23.15.255.255
First seen
2023-12-25T00:19:17Z
Last seen
2026-11-14T23:49:14Z
0%
US
communicates
CIDR
23.1.104.0/23
Network
23.0.0.0-23.15.255.255
First seen
2023-10-02T02:28:35Z
Last seen
2026-11-14T04:34:57Z
0%
US
communicates
CIDR
23.1.104.0/23
Network
23.0.0.0-23.15.255.255
First seen
2023-10-12T09:36:55Z
Last seen
2026-11-14T23:49:14Z
Related domains
Domains associated with this indicator.
2shown
0%
.net
communicates
Root
akamai.net
TLD
net
Subdomain
a1672.dscr
First seen
2025-05-29T12:07:07Z
Last seen
2026-11-15T01:03:23Z
0%
.com
communicates
Root
bing.com
TLD
com
Subdomain
www
First seen
2023-09-30T04:11:06Z
Last seen
2026-11-15T01:03:10Z
Analysis details
Severity: hightrojanmsidebug-checkusb-check
Freshness: Fresh · Last seen today.
- Detection rate
- 24%
- Threat type
- trojan
- Family
- msil
- Confidence
- 93%
- confidence
- 93 · VirusSign confidence; engine detections are reported separately.
Overview
- SHA256
a6611a44c32bc8ba9194298db09c49f1914dffa5ae30a9acb60b2b0641dc802d- SHA1
f98fef150e0e0d720a33a252f2a9fbfbbcb3e95b- MD5
28858c557194d7d7d62ed5ffb1206889- Filename
- a6611a44_saret.msi.bin
- File type
- msi
- MIME
- application/x-msi
- File size
- 10670080
- TLSH
T17FB633FA749347F2CB09457A4B13BBC057593C7A629041828ABC7ADE5770EB07871EB2- SSDEEP
196608:hc5l64Wr2VzZiT+ghw6IMAcnpzDxYqIammTNep:h+64qcmgMAWHxYqQOw- First seen
- 2026-11-14T00:03:35Z
- Last seen
- 2026-11-14T04:27:23Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
High-confidence evidence. Related indicators in this report: 12. Review the supporting evidence before taking action.
Detection signal
Malicious. A limited set of engine detections is present (24%).
Confidence signal
VirusSign reports 93% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family msil.
Relationship context
12 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
13 timestamped observations are arranged from 2023-09-30 to 2026-11-14. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family msil.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- a6611a44_saret.msi.bin
- File type
- msi
- MIME
- application/x-msi
- Size
- 10670080
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- Attempts to make a network connection via suspicious process
- Checks available memory
- Checks for available system drives (often done to infect USB drives)
- Checks system language via registry key (possible geofencing)
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1036 · T1055 — Attempts to make a network connection via suspicious processTactics: TA0004 · TA0005
- T1082 — Checks available memoryTactics: TA0007
- T1091 · T1120 — Checks for available system drives (often done to infect USB drives)Tactics: TA0001 · TA0007 · TA0008
- T1055 — Creates a process in a suspended state, likely for injectionTactics: TA0004 · TA0005
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- CommunicationObjectives: OC0006
- C0016 — Create FileObjectives: OC0001
- B0001 — Debugger DetectionObjectives: OB0001
- Defense EvasionObjectives: OB0006
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
DNS request activity2
A5+ response IPs
- 2 DNS requests observed
- 2 unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 2 shown
- Query
- www.bing.com
- Type
- A
- Answers
- 23.1.105.133, 23.1.105.148, 23.1.105.137, 23.1.105.152, 23.1.105.146, 23.1.105.141, 23.1.105.135, 23.1.105.147 …
- Response
- NOERROR
- Query
- a1672.dscr.akamai.net
- Type
- A
- Answers
- 173.223.239.14, 173.223.239.28
- Response
- NOERROR