Report - c03e1b034b2d…76707eec09

Malicious HighFILE

Quota 24

First seen: 2026-11-14T17:03:10Z
Last seen: 2026-11-14T18:00:53Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYyogitrojan

RELATED INDICATORS20Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: c03e1b034b2dc53b24a57dbe0bad2ff3d30c930f0b706edfa3ddb976707eec09
SHA1: 8cb290a8ae7664cba1fe171a3eba3ec57e5ed6b9
MD5: 2b7caf09c9179ee86882aea3313745be
Filename: c03e1b03_deepsk_x64.in.03.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 32320160
Compile time: 2025-08-25T16:59:01Z
PE platform: x64 64-bit
PE sections: 7

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 46%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections46%

VirusSign confidence100%

Relationship context20 visible

Threat classificationyogi

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

20 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

a1e68e7adc5597eae23a6590f1ac345f796abebceb91afcc0f2dd97cc0622740

65% high pedll 141824 bytes drops

Filename a1e68e7a_8dmun62v8.exe.bin Family dacic Type trojan File type pedll MIME application/vnd.microsoft.portable-executable

676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7

0% peexe 139088 bytes drops

Filename 676a2a7b_n2qfwk.exe.bin File type peexe MIME application/vnd.microsoft.portable-executable Size 139088 Compile time 2021-08-13T02:59:05Z

0829a75ff640d9b717af6a2c0efbe71ecba22dff5c5fa18d624d07e94cbace93

0% ico 67646 bytes contains

Filename 0829a75f_tencent_meeting.ico.bin File type ico MIME application/octet-stream Size 67646 SHA1 19798220d939e7db484aeea53b151053766491c5

1d8a782b70eaa4d474727b0c68e8dfb3105966bac2fd3ed0c23df96388957674

0% xml 642 bytes contains

Filename 1d8a782b_dt_doctor.dll.manifest.bin File type xml MIME application/xml Size 642 SHA1 d4e26a5bc1ae0f1b8c21554308ee5a20614e6a56

7e0f0247be58160b62bc19caa9c023c0e777286b0820c6db8a7c93d268deeed8

0% javascript 10 bytes contains

Filename 7e0f0247_2f4993d1d40570248faf2cc846027eef.bin File type javascript MIME application/javascript Size 10 SHA1 74db835d52d97a16a7c90b7e75c5a530cce41ec8

Related IPs

Network IPs associated with this indicator.

5shown

47.238.85.63

0% HK communicates

CIDR 47.238.64.0/18 Network 47.238.0.0-47.239.255.255 First seen 2026-07-17T11:51:47Z Last seen 2026-11-14T18:00:53Z

52.123.250.45

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-10-01T12:21:49Z Last seen 2026-11-15T00:16:18Z

52.123.250.34

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-10-01T05:47:45Z Last seen 2026-11-15T01:41:40Z

52.123.250.27

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-10-05T15:33:51Z Last seen 2026-11-15T01:01:01Z

52.123.250.15

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-09-29T18:01:45Z Last seen 2026-11-15T01:41:18Z

Related domains

Domains associated with this indicator.

5shown

3byy0j.oss-cn-beijing.aliyuncs.com

0% .com communicates

Root aliyuncs.com TLD com Subdomain 3byy0j.oss-cn-beijing First seen 2026-08-22T14:16:54Z Last seen 2026-11-14T21:27:24Z

zauxss.net

0% .net communicates

Root zauxss.net TLD net First seen 2026-10-23T10:15:20Z Last seen 2026-11-14T18:00:53Z

mm2027.oss-cn-hangzhou.aliyuncs.com

5% medium .com communicates

Root aliyuncs.com TLD com Subdomain mm2027.oss-cn-hangzhou First seen 2025-12-18T14:46:08Z Last seen 2026-11-14T21:27:24Z

atm.teams.mira.tm.svc.cloud.microsoft

0% .microsoft communicates

Root cloud.microsoft TLD microsoft Subdomain atm.teams.mira.tm.svc First seen 2024-08-26T16:41:58Z Last seen 2026-11-15T01:41:40Z

sc-2eo1.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com

.com communicates

Root alibabadns.com TLD com Subdomain sc-2eo1.cn-beijing.oss-adns.aliyuncs.com.gds First seen 2024-09-17T09:12:24Z Last seen 2026-11-14T21:27:24Z

Related URLs

URLs associated with this indicator.

5shown

https://3byy0j.oss-cn-beijing.aliyuncs.com/d.gif

0% communicates

TLD com HTTP status 200 Content length 4992890 Content SHA256 a72fc4309e4719ffb589dbd6945000c8ec7af7ad9b5dfd6edefe76c46dc2a5de First seen 2026-11-09T16:36:16Z

https://3byy0j.oss-cn-beijing.aliyuncs.com/a.gif

0% communicates

TLD com HTTP status 200 Content length 140021 Content SHA256 6349d18308f458ed290913068752471c453f1c9bbd472a73e9f92b444718bd4d First seen 2026-11-09T16:36:16Z

https://3byy0j.oss-cn-beijing.aliyuncs.com/b.gif

0% communicates

TLD com HTTP status 200 Content length 3256757 Content SHA256 ea41d3b33fcf4929823c1a054d92208bb6275c3281da3b77d8a3521b261b2646 First seen 2026-11-09T16:36:16Z

https://3byy0j.oss-cn-beijing.aliyuncs.com/s.dat

0% communicates

TLD com HTTP status 200 Content length 28272 Content SHA256 8f375d33f71ed7ede9f15e9a7aa3dce6e2a0399fa586dd75d1c636e27d615960 First seen 2026-11-09T16:36:16Z

https://3byy0j.oss-cn-beijing.aliyuncs.com/tad

0% communicates

TLD com HTTP status 200 Content length 768 Content SHA256 64a39782e5a29af3da42ef352ecc540c4170c83375fc281f19e0367a3a5b5766 First seen 2026-11-09T16:36:16Z

Analysis details

Severity: hightrojanfile-overlay64bitexedebug-checkobfuscateddns-nxdomainsigned

Freshness: Fresh · Last seen today.

Detection rate: 46%
Threat type: trojan
Family: yogi
Confidence: 100%
detection: 46 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: c03e1b034b2dc53b24a57dbe0bad2ff3d30c930f0b706edfa3ddb976707eec09
SHA1: 8cb290a8ae7664cba1fe171a3eba3ec57e5ed6b9
MD5: 2b7caf09c9179ee86882aea3313745be
Filename: c03e1b03_deepsk_x64.in.03.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 32320160
Compile time: 2025-08-25T16:59:01Z
PE platform: x64 64-bit
PE sections: 7
Import libraries: 4
TLSH: T1F86783067719D98BE062E23454E35F90E329EC714AB0972363B53B2C5FFB34C5EA2658
SSDEEP: 98304:tZQOX4CgBj4LW9JVmQG5elezL3v0tIn+Sn3l42Jlw09nP7moUnxAOQFKZ8xfesS+:tmOXlN5jTpCjPxXOIdSN
Imphash: 20abbe0f6ab059ea4a375bcb6b8a717b
Richhash: de5262536d8804bede298ae4fcb65f56
First seen: 2026-11-14T17:03:10Z
Last seen: 2026-11-14T18:00:53Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 46%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family yogi.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 2012-10-27 to 2026-11-09. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 46%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 20 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification yogi

Classification context: type trojan, family yogi.

Intelligence freshness Fresh

Last seen today.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: c03e1b03_deepsk_x64.in.03.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 32320160
Compile time: 2025-08-25T16:59:01Z
PE platform: x64 64-bit
Entry point: 39104
Sections: 7

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-checkobfuscated

View details · 5 shown

A DLL was loaded from a suspicious directory
A file was accessed within the Public folder.
A process created a hidden window
Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Attempted to enumerate running processes from dynamically allocated (unbacked) memory

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1036 · T1548 — A file was accessed within the Public folder.
Tactics: TA0004 · TA0005
T1564.003 — A process created a hidden window
Tactics: TA0005
T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Tactics: TA0004 · TA0005
T1057 — Attempted to enumerate running processes from dynamically allocated (unbacked) memory
Tactics: TA0007

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
C0026.001 — Base64
Objectives: OC0004
C0019 — Check String
Objectives: OC0004
E1059 — Command and Scripting Interpreter
Objectives: OB0009

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 53, 80

5+ outbound connections observed
2 domains, 5+ IPs, 5+ URLs
Common ports: 443, 53, 80, 7300
Protocols: HTTP, TCP, UDP

View details · 5 shown

IP: 92.38.145.145
Port: 80
Protocol: TCP

IP: 8.8.8.8
Port: 53
Protocol: UDP

IP: 39.103.20.72
Port: 443
Protocol: TCP

Domain: 3byy0j.oss-cn-beijing.aliyuncs.com
URL: https://3byy0j.oss-cn-beijing.aliyuncs.com/tad
Protocol: HTTP

Domain: 3byy0j.oss-cn-beijing.aliyuncs.com
URL: https://3byy0j.oss-cn-beijing.aliyuncs.com/s.jpg
Protocol: HTTP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: mm2027.oss-cn-hangzhou.aliyuncs.com
Type: A
Answers: 118.178.60.2
Response: NOERROR

Query: zauxss.net

Query: sc-2eo1.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com
Type: A
Answers: 39.103.20.72
Response: NOERROR

Query: sc-2eo1.cn-beijing.oss-adns.aliyuncs.com
Type: A
Answers: 39.103.20.72
Response: NOERROR

Query: sc-2eo1.cn-beijing.oss-adns.aliyuncs.com

5 shown

C2 candidates1

DNSports 53

1 C2 candidate communications
1 domains, 1 IPs
Common ports: 53
Protocols: DNS

View details · 1 shown

IP: 118.178.60.2
Domain: mm2027.oss-cn-hangzhou.aliyuncs.com
Port: 53
Protocol: DNS

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2025-08-25T16:59:01Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 39104
Sections: 7
Compile time: 2025-08-25T16:59:01Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 125364
Raw size: 125440
Permissions: rx
Entropy: 6.43

Name: .rdata
Virtual address: 131072
Virtual size: 59522
Raw size: 59904
Permissions: r
Entropy: 4.59

Name: .data
Virtual address: 192512
Virtual size: 31992604
Raw size: 31979520
Permissions: rw
Entropy: 4.11

Name: .pdata
Virtual address: 32186368
Virtual size: 7116
Raw size: 7168
Permissions: r
Entropy: 5.23

Name: _RDATA
Virtual address: 32194560
Virtual size: 500
Raw size: 512
Permissions: r
Entropy: 3.65

5 shown

Imports4

4 DLL groups

4 import DLL groups
5+ imported functions summarized

View details · 4 shown

Library: KERNEL32.dll
Functions: CloseHandle, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess …

Library: USER32.dll
Functions: PostThreadMessageW

Library: SHELL32.dll
Functions: ShellExecuteW

Library: ole32.dll
Functions: CoAddRefServerProcess, CoCreateInstance, CoInitialize, CoReleaseServerProcess, CoUninitialize

Resources5+

5+ resources

5+ resources
Resource types: RT_ICON, RT_GROUP_ICON, RT_MANIFEST, RT_VERSION

View details · 4 shown

Type: RT_ICON
Language: CHINESE SIMPLIFIED

Type: RT_GROUP_ICON
Language: CHINESE SIMPLIFIED

Type: RT_VERSION
Language: CHINESE SIMPLIFIED

Type: RT_MANIFEST
Language: ENGLISH US

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5

4 issuers

Example subject: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Issued by: DigiCert Trusted Root G4

View details · 5 shown

Subject: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Issuer: DigiCert Trusted Root G4
Fingerprint: 7B0F360B775F76C94A12CA48445AA2D2A875701C

Subject: Tencent Technology (Shenzhen) Company Limited
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Fingerprint: 617C4EDB4F205FCA0E5C07B9C52AA8D695FD122C

Subject: DigiCert SHA256 RSA4096 Timestamp Responder 2025 1
Issuer: DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1
Fingerprint: DD6230AC860A2D306BDA38B16879523007FB417E

Subject: DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1
Issuer: DigiCert Trusted Root G4
Fingerprint: 07894D00FC194A17DB273AEB5CF8FACEF14423A4

Subject: DigiCert Trusted Root G4
Issuer: DigiCert Assured ID Root CA
Fingerprint: A99D5B79E9F1CDA59CDAB6373169D5353F5874C6

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check