- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
bb726c94552ef3df84efb4352acb7fc42a04116b43e55e613bc8ca6f398358ac- SHA1
dff50fc5256c8363cf1474b2ab25cb1e05e25d95- MD5
0288cc2affcbf6b1b77187fa153b6f42- Filename
- bb726c94_start.ps1.bin
- File type
- powershell
- MIME
- text/plain
- File size
- 639665
- TLSH
T1F7D46E347E461EFB4BB820C248CA811C563C32B9CA692CF56ACB4CA3391D77517B79B5- SSDEEP
6144:RtWM1msAXEiescuudjfD6oRyDWvnm4+pfeFVwdW8xa0+S7ljb4H:R7QXksYUDW/j+pf5Wtqm
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (10%).
Confidence signal
VirusSign confidence is elevated at 68%. Use it as supporting evidence together with detections, family and relationship context.
Analysis signals
OBSERVEDEngine detections10%
VirusSign confidence68%
Relationship context7 visible
Threat classificationpowershell
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
3shown
0%
peexe
43008 bytes
drops
Filename
599efd45_3284040427.exe.bin
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
43008
Compile time
2009-07-13T23:15:36Z
0%
64 bytes
drops
Filename
a7de5177_startupprofiledata-noninteractive.bin
MIME
application/octet-stream
Size
64
SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799
First seen
2014-08-19T15:29:21Z
0%
powershell
60 bytes
drops
Filename
96ad1146___psscriptpolicytest_iugzvutm.mi5.ps1.bin
File type
powershell
MIME
text/plain
Size
60
SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d
Related IPs
Network IPs associated with this indicator.
2shown
6%
low
PL
communicates
CIDR
194.147.34.0/23
Network
194.147.34.0-194.147.34.255
First seen
2025-06-07T05:23:30Z
Last seen
2026-10-26T22:18:15Z
6%
low
US
communicates
CIDR
8.8.8.0/24
Network
8.8.8.0-8.8.8.255
First seen
2023-09-29T05:20:58Z
Last seen
2026-11-14T13:09:38Z
Related domains
Domains associated with this indicator.
1shown
35%
high
.com
communicates
Root
kafeprog7.com
TLD
com
First seen
2026-05-18T21:45:47Z
Last seen
2026-11-14T12:10:46Z
Related URLs
URLs associated with this indicator.
1shown
35%
high
communicates
TLD
com
HTTP status
405
Content length
31
Content SHA256
83c09ba9a8daedb136f90b17a294caa90ad471a016e430df6e229acb5a81e100
First seen
2026-05-30T00:02:03Z
Analysis details
Severity: hightrojanpowershelldebug-checkloaderobfuscated
Freshness: Aging · Last seen 58 days ago.
- Detection rate
- 10%
- Threat type
- trojan
- Family
- powershell
- Confidence
- 68%
- detection
- 10 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
bb726c94552ef3df84efb4352acb7fc42a04116b43e55e613bc8ca6f398358ac- SHA1
dff50fc5256c8363cf1474b2ab25cb1e05e25d95- MD5
0288cc2affcbf6b1b77187fa153b6f42- Filename
- bb726c94_start.ps1.bin
- File type
- powershell
- MIME
- text/plain
- File size
- 639665
- TLSH
T1F7D46E347E461EFB4BB820C248CA811C563C32B9CA692CF56ACB4CA3391D77517B79B5- SSDEEP
6144:RtWM1msAXEiescuudjfD6oRyDWvnm4+pfeFVwdW8xa0+S7ljb4H:R7QXksYUDW/j+pf5Wtqm- First seen
- 2026-07-31T05:26:11Z
- Last seen
- 2026-09-17T00:39:32Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (10%).
Confidence signal
VirusSign confidence is elevated at 68%. Use it as supporting evidence together with detections, family and relationship context.
Threat context
Classification includes type trojan and family powershell.
Relationship context
7 related indicators are shown across 4 relationship group(s).
Observation timeline
8 timestamped observations are arranged from 2009-07-13 to 2026-07-31. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family powershell.
Last seen 58 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- bb726c94_start.ps1.bin
- File type
- powershell
- MIME
- text/plain
- Size
- 639665
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A named pipe was used for inter-process communication
- Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
- At least one IP Address, Domain, or File Name was found in a crypto call
- Attempted to open, duplicate, or impersonate an access token from dynamically allocated (unbacked) memory, indicative credential theft or lateral movement
- Attempted to spawn a new child process from dynamically allocated (unbacked) memory
5 shown
View MITRE ATT&CK details · 5 shown
- T1071 — A named pipe was used for inter-process communicationTactics: TA0011
- T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patchingTactics: TA0004 · TA0005
- T1055 · T1106 — Attempted to spawn a new child process from dynamically allocated (unbacked) memoryTactics: TA0002 · TA0004 · TA0005
- T1185 — CAPE detected injection into a browser process, likely for Man-In-Browser (MITB) infostealingTactics: TA0009
- T1082 — Checks available memoryTactics: TA0007
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- F0013 — BootkitObjectives: OB0006 · OB0012
- B0009.005 — Check Registry KeysObjectives: OB0001
- CommunicationObjectives: OC0006
- C0016 — Create FileObjectives: OC0001
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity4
HTTP, TCP, UDPports 443, 53
- 4 outbound connections observed
- 1 domains, 2 IPs, 1 URLs
- Common ports: 443, 53
- Protocols: HTTP, TCP, UDP
View details · 3 shown
- Domain
- kafeprog7.com
- URL
- https://kafeprog7.com/gate/init/eed8b732/574cbd14-d75b-425c-a623-6adf5a9d77b1
- Protocol
- HTTP
- IP
- 8.8.8.8
- Port
- 53
- Protocol
- UDP
- IP
- 194.147.34.224
- Port
- 443
- Protocol
- TCP
DNS request activity1
A1 response IPs
- 1 DNS requests observed
- 1 unique queries
- 1 response IPs
- Query types: A
- Response codes: NOERROR
View details · 1 shown
- Query
- kafeprog7.com
- Type
- A
- Answers
- 194.147.34.224
- Response
- NOERROR
C2 candidates1
HTTP
- 1 C2 candidate communications
- 1 domains, 0 IPs
- Protocols: HTTP
View details · 1 shown
- Domain
- kafeprog7.com
- Protocol
- HTTP