Report - af3dc2776843…cb619dc2bc

Suspicious FILE

Quota 12

First seen: 2024-10-07T11:01:45Z
Last seen: 2026-11-02T21:29:13Z

THREAT SIGNALMedium-low Read alongside the verdict

CONFIDENCENot providedVirusSign analysis

FAMILYNot identifiedmalware

RELATED INDICATORS20Connections in this report

ANALYSISSuspiciousFresh

Indicator overview

INDICATOR PROFILE

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

SHA256: af3dc2776843df0189b0336f878cd11484b6eb10c0c0157f02e3dbcb619dc2bc
SHA1: ee379ec10a255b6ee14f0d73de8f15eaf0949624
MD5: 3a0ed71fd9c900d81eaaf389489dafa1
Filename: download.zip
File type: zip
MIME: application/zip
File size: 290459165
TLSH: T1D2D833D35B54FCF260EC4517EAA51D3AFB02A1D37266E0CA1A05437E37874E20BC6D6A
SSDEEP: 6291456:EqovReKb0stAo73ekkYKFCNFwQPIJ8b4yJ+wNAEU4isBsv91W6mxTFT:WGsqq3eCNFPPIJu0wWEUdsSHWJxp

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (5%).

Threat context

Classification includes type malware.

Analysis signals

OBSERVED

Engine detections5%

Relationship context20 visible

Threat classificationmalware

Intelligence freshnessFresh

Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.

RELATIONSHIP CONSTELLATION

SELECT A NODE TO EXPLORE

FILEDOMAINIPURL

Visible connections

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

20 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

08ad0d6d23e32ef9d7d3345c49d96781c6429556ac6dfa791c245646e50a368a

0% pedll 140840 bytes drops

Filename libEGL File type pedll MIME application/vnd.microsoft.portable-executable Size 140840 Compile time 2019-03-10T05:00:00Z

3c7e2f14c47388a84f016408668834d9388c294c791296cae81da4581dd1fafc

0% peexe 1081896 bytes drops

Filename 951981005.exe File type peexe MIME application/vnd.microsoft.portable-executable Size 1081896 Compile time 2023-01-13T02:30:16Z

a4d1e1540f1e5862429e2e7f15c3335210bc5c26481cfc22f9352b9ae7174c43

0% peexe 5617192 bytes drops

Filename 1619050316.exe File type peexe MIME application/vnd.microsoft.portable-executable Size 5617192 Compile time 2024-01-12T07:44:53Z

7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

0% peexe 2380800 bytes contains

Filename SteamSetup(1).exe Type malware File type peexe MIME application/vnd.microsoft.portable-executable Size 2380800

2438b520ac961e38c5852779103734be373ee2b6d1e5a7a5d49248b52acc7c4d

0% pedll 4127224 bytes drops

Filename D3DCompiler_47_cor3.dll File type pedll MIME application/vnd.microsoft.portable-executable Size 4127224 Compile time 2077-11-02T02:54:07Z

Related IPs

Network IPs associated with this indicator.

5shown

2602:801:f00b:100::cdc4:6a8

US communicates

CIDR 2602:801:f008::/46 Network 2602:801:f000::-2602:801:f0ff:ffff:ffff:ffff:ffff:ffff First seen 2024-09-20T23:47:59Z Last seen 2026-10-30T11:36:37Z

2602:801:f00b:100::cdc4:6a5

US communicates

CIDR 2602:801:f008::/46 Network 2602:801:f000::-2602:801:f0ff:ffff:ffff:ffff:ffff:ffff First seen 2024-04-08T04:15:45Z Last seen 2026-10-30T11:36:37Z

2602:801:f00b:100::cdc4:693

US communicates

CIDR 2602:801:f008::/46 Network 2602:801:f000::-2602:801:f0ff:ffff:ffff:ffff:ffff:ffff First seen 2024-09-19T12:07:08Z Last seen 2026-11-02T10:37:01Z

34.126.226.51

0% US communicates

CIDR 34.120.0.0/13 Network 34.64.0.0-34.127.255.255 First seen 2024-06-16T10:50:32Z Last seen 2026-11-09T16:10:43Z

23.195.238.96

0% US communicates

CIDR 23.195.224.0/20 First seen 2024-11-24T17:04:28Z Last seen 2026-10-27T03:05:54Z

Related domains

Domains associated with this indicator.

5shown

ext4-tyo3.steamserver.net

0% .net communicates

Root steamserver.net TLD net Subdomain ext4-tyo3 First seen 2024-09-13T03:15:05Z Last seen 2026-05-07T03:19:25Z

ext1-atl3.steamserver.net

0% .net communicates

Root steamserver.net TLD net Subdomain ext1-atl3 First seen 2024-09-13T03:15:05Z Last seen 2026-05-05T05:31:11Z

ext3-sgp1.steamserver.net

0% .net communicates

Root steamserver.net TLD net Subdomain ext3-sgp1 First seen 2024-09-13T03:15:05Z Last seen 2026-05-15T03:17:41Z

ext2-sgp1.steamserver.net

0% .net communicates

Root steamserver.net TLD net Subdomain ext2-sgp1 First seen 2024-09-13T03:15:05Z Last seen 2026-05-05T20:15:53Z

cmp1-dfw1.steamserver.net

0% .net communicates

Root steamserver.net TLD net Subdomain cmp1-dfw1 First seen 2024-09-13T03:15:05Z Last seen 2026-06-06T08:52:10Z

Related URLs

URLs associated with this indicator.

5shown

http://e5.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQeEcDJrP2kU+9LL2pzI…

0% communicates

TLD org HTTP status 200 Content length 346 Content SHA256 9c58f1841e2bac9d0025d1473b5a6dffbb1ed0781fead54c96a8d692e48f9358 First seen 2024-10-05T10:00:50Z

http://e6.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTUejiAQejpjQc4fOz2t…

0% communicates

TLD org HTTP status 200 Content length 345 Content SHA256 ee134425a16497cb2826b807c7d6099fc58e5cea2f357178dd648856c7efa797 First seen 2024-10-05T13:32:21Z

http://e6.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTUejiAQejpjQc4fOz2t…

0% communicates

TLD org HTTP status 200 Content length 344 Content SHA256 849e0e2260051bc8fbbbb80c9fb5bd0b2a9b17fe62b5a260034289274ebae893 First seen 2024-10-08T08:29:11Z

http://e6.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTUejiAQejpjQc4fOz2t…

0% communicates

TLD org HTTP status 200 Content length 345 Content SHA256 3be4a59f72cfe505df3ec5262af8fc51e3416e5d2a8b9c840d2117bbdd08ba88 First seen 2024-10-08T08:29:11Z

http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD+QVZ+1vf7U0RGQGB…

0% communicates

TLD org HTTP status 200 Content length 504 Content SHA256 4ffed2e0e64ec0ac717dcda0cd9cd7ab8b93957d1aac900e8902e3e67b2b0759 First seen 2024-08-24T11:29:42Z

Analysis details

Severity: lowmalwarezipdebug-checkexec-delaypersistenceadapter-discoverycryptoqr-code

Freshness: Fresh · Last seen 7 days ago.

Detection rate: 5%
Threat type: malware
detection: 5 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: af3dc2776843df0189b0336f878cd11484b6eb10c0c0157f02e3dbcb619dc2bc
SHA1: ee379ec10a255b6ee14f0d73de8f15eaf0949624
MD5: 3a0ed71fd9c900d81eaaf389489dafa1
Filename: download.zip
File type: zip
MIME: application/zip
File size: 290459165
TLSH: T1D2D833D35B54FCF260EC4517EAA51D3AFB02A1D37266E0CA1A05437E37874E20BC6D6A
SSDEEP: 6291456:EqovReKb0stAo73ekkYKFCNFwQPIJ8b4yJ+wNAEU4isBsv91W6mxTFT:WGsqq3eCNFPPIJu0wWEUdsSHWJxp
First seen: 2024-10-07T11:01:45Z
Last seen: 2026-11-02T21:29:13Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (5%).

Threat context

Classification includes type malware.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 2016-07-25 to 2077-11-02. These are observation or metadata times, not execution order.

Infrastructure geography

5 infrastructure/location point(s) are visible on the map.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

Engine detections 5%

Reported engine detection rate. A low rate alone does not establish that the indicator is benign.

Relationship context 20 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification malware

Classification context: type malware.

Intelligence freshness Fresh

Last seen 7 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: download.zip
File type: zip
MIME: application/zip
Size: 290459165

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

adapter-discoverycryptodebug-checkexec-delaypersistenceqr-code

View details · 5 shown

A file was accessed within the Public folder.
A process created a hidden window
Allocates memory with a write watch (potentially for evading sandboxes)
Anomalous file deletion behavior detected (10+)
At least one IP Address, Domain, or File Name was found in a crypto call

5 shown

View MITRE ATT&CK details · 5 shown

T1202 — Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
Tactics: TA0005
T1547.001 — Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
Tactics: TA0003 · TA0004
T1057 — Adversaries may attempt to get information about running processes on a system.
Tactics: TA0007
T1564 — Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.
Tactics: TA0005
T1033 — Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.
Tactics: TA0007

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
C0008 — Change Memory Protection
Objectives: OC0002
Command and Control
Objectives: OB0004
Communication
Objectives: OC0006
E1485 — Data Destruction
Objectives: OB0008

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, HTTPports 443, 27022, 80

5+ outbound connections observed
4 domains, 5+ IPs, 5+ URLs
Common ports: 443, 27022, 80, 27019, 27028
Protocols: TCP, HTTP

View details · 5 shown

Domain: test.steampowered.com
URL: http://test.steampowered.com/204
Protocol: HTTP

Domain: r10.o.lencr.org
URL: http://r10.o.lencr.org/mfmwutbpme0wszajbgurdgmcgguabbrpd+qvz+1vf7u0rgqgbm8jzwdxcgqudkr2krcyviuxn75n5gzywlzfbxicegmmgkmfrityd1wly7mwdkozvg==
Protocol: HTTP

Domain: r10.o.lencr.org
URL: http://r10.o.lencr.org/mfmwutbpme0wszajbgurdgmcgguabbrpd%2bqvz%2b1vf7u0rgqgbm8jzwdxcgqudkr2krcyviuxn75n5gzywlzfbxicegmmgkmfrityd1wly7mwdkozvg%3d%3d
Protocol: HTTP

Domain: e6.o.lencr.org
URL: http://e6.o.lencr.org/mfmwutbpme0wszajbgurdgmcgguabbtuejiaqejpjqc4foz2ttjyd6vkmqqudcxm/zvufawhtdccpt5eisnycdicegtnicsic6pw6k1gorzur0e0+w==
Protocol: HTTP

Domain: e6.o.lencr.org
URL: http://e6.o.lencr.org/mfmwutbpme0wszajbgurdgmcgguabbtuejiaqejpjqc4foz2ttjyd6vkmqqudcxm/zvufawhtdccpt5eisnycdicegszbkn4qb6uqnh85a+81drhnw==
Protocol: HTTP

5 shown

DNS request activity5+

A, AAAA5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A, AAAA
Response codes: NOERROR

View details · 5 shown

Query: cloud.bluestacks.com
Type: A
Answers: 34.160.86.181
Response: NOERROR

Query: test.steampowered.com
Type: A
Answers: 23.32.75.133, 23.32.75.153
Response: NOERROR

Query: r10.o.lencr.org
Type: A
Answers: 23.44.175.6, 23.44.175.17
Response: NOERROR

Query: p2p-dfw1.discovery.steamserver.net
Type: A
Answers: 155.133.253.34, 155.133.253.50
Response: NOERROR

Query: ipv6check-udp.steamserver.net
Type: AAAA
Answers: 2602:801:f00b:100::cdc4:6a8, 2602:801:f00b:100::cdc4:6ab, 2602:801:f00b:100::cdc4:68f, 2602:801:f00b:100::cdc4:6a5, 2602:801:f00b:100::cdc4:693
Response: NOERROR

5 shown

C2 candidates2

TCPports 27019, 27031

2 C2 candidate communications
0 domains, 2 IPs
Common ports: 27019, 27031
Protocols: TCP

View details · 2 shown

IP: 45.121.184.23
Port: 27019
Protocol: TCP

IP: 45.121.184.21
Port: 27031
Protocol: TCP

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check