- First seen
- Last seen
THREAT SIGNALHigh
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
d356ef60fbcb9b6903823a87ae6f146fc879f84813076a9ebd343b1ac3e35ea2- SHA1
757f108e36e755e6970552addefd6b6382c5f077- MD5
37def58ac393867bbf933d670c28f712- Filename
- d356ef60_lsuwssb2.exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 10748438
- Compile time
- 2026-10-14T13:12:17Z
- PE platform
- x64 64-bit
- PE sections
- 5
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 10. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 76%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections76%
VirusSign confidence100%
Relationship context10 visible
Threat classificationstealer
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
1shown
5%
low
zip
5168706 bytes
contains
Filename
65046c07_d356ef60fbcb9b6903823a87ae6f146fc879f84813076a9ebd343b1ac3e35ea2.zip.bin
Family
ndaof
Type
trojan
File type
zip
MIME
application/zip
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
png
4847 bytes
drops
Filename
72f066cd_0000000f.bin
File type
png
MIME
application/octet-stream
Size
4847
SHA1
28272e9c7f816a1ce8f2033fc00f489005332365
0%
png
4181 bytes
drops
Filename
6e54b502_0000000m.bin
File type
png
MIME
application/octet-stream
Size
4181
SHA1
44de7375375880acc24938d7e92a837e85c35321
0%
png
19235 bytes
drops
Filename
6e21222b_00000005.bin
File type
png
MIME
application/octet-stream
Size
19235
SHA1
d481df71c858baecfe33418002d368f2dcf68d4a
0%
png
7374 bytes
drops
Filename
58469ba9_0000009f.bin
File type
png
MIME
application/octet-stream
Size
7374
SHA1
30f46fac5e96470848c5a948162cc12455a05154
0%
png
3879 bytes
drops
Filename
4c264b2a_0000000j.bin
File type
png
MIME
application/octet-stream
Size
3879
SHA1
c040ba2f31342cbcbf597c96d4d6edb83d473b77
Related IPs
Network IPs associated with this indicator.
2shown
20%
medium
DE
communicates
CIDR
176.65.144.0/24
Network
176.65.144.0-176.65.144.255
First seen
2025-04-27T22:13:49Z
Last seen
2026-11-13T17:19:49Z
5%
low
US
communicates
CIDR
208.95.112.0/22
Network
208.95.112.0-208.95.115.255
First seen
2023-09-30T15:26:15Z
Last seen
2026-11-15T02:52:34Z
Related domains
Domains associated with this indicator.
1shown
5%
low
.com
communicates
Root
ip-api.com
TLD
com
First seen
2023-09-30T15:26:15Z
Last seen
2026-11-15T02:52:34Z
Related URLs
URLs associated with this indicator.
1shown
0%
communicates
TLD
com
HTTP status
200
Content length
20
Content SHA256
627012dbec1bb7e99026e91e0e06a814f17698fcf7af190c50deafab897f99be
First seen
2016-04-29T12:17:21Z
Analysis details
Severity: criticaltrojan64bitwmi-activityfile-overlaydebug-checkexeadapter-discoveryobfuscated
Freshness: Fresh · Last seen 1 day ago.
- Detection rate
- 76%
- Threat type
- trojan
- Family
- stealer
- Confidence
- 100%
- detection
- 76 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
d356ef60fbcb9b6903823a87ae6f146fc879f84813076a9ebd343b1ac3e35ea2- SHA1
757f108e36e755e6970552addefd6b6382c5f077- MD5
37def58ac393867bbf933d670c28f712- Filename
- d356ef60_lsuwssb2.exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 10748438
- Compile time
- 2026-10-14T13:12:17Z
- PE platform
- x64 64-bit
- PE sections
- 5
- Import libraries
- 17
- TLSH
T10BB65B02BA6B94ECD55BC47483068A239E2174DB0B36BAEF41C446393F6ABF05B3D754- SSDEEP
98304:NMUbUDIEbZahPaxsbfFWKXATuZezT+4XlB9JI/NWWWyx5tMG:fbUUEbUExM3XUri9- Imphash
1899314a77fbc7c693df1edbb9eb9a16- Richhash
4aeb95a9a9159016eef81d2e4e683ef4- First seen
- 2026-10-16T15:09:03Z
- Last seen
- 2026-11-13T17:19:50Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 10. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 76%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family stealer.
Relationship context
10 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
11 timestamped observations are arranged from 2016-04-29 to 2026-11-04. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
5 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family stealer.
Last seen 1 day ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- d356ef60_lsuwssb2.exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 10748438
- Compile time
- 2026-10-14T13:12:17Z
- PE platform
- x64 64-bit
- Entry point
- 1056512
- Sections
- 5
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- A process created a hidden window
- Attempts to connect to a dead IP:Port
- Authenticode signature is invalid
- Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1564.003 — A process created a hidden windowTactics: TA0005
- T1059 · T1202 — Apparent Internal Usage of CMD.EXETactics: TA0002 · TA0005
- T1036 · T1553.002 — Authenticode signature is invalidTactics: TA0005 · TA0112
- T1027.002 — Binary may include packed or crypted dataTactics: TA0005
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- Anti-Static AnalysisObjectives: OB0002
- C0026.001 — Base64Objectives: OC0004
- C0032.001 — CRC32Objectives: OC0004
- C0043 — Check MutexObjectives: OC0003
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity3
HTTP, TCPports 80
- 3 outbound connections observed
- 1 domains, 1 IPs, 1 URLs
- Common ports: 80
- Protocols: HTTP, TCP
View details · 2 shown
- Domain
- ip-api.com
- URL
- http://ip-api.com/json/?fields=countrycode
- Protocol
- HTTP
- IP
- 208.95.112.1
- Port
- 80
- Protocol
- TCP
DNS request activity1
A1 response IPs
- 1 DNS requests observed
- 1 unique queries
- 1 response IPs
- Query types: A
- Response codes: NOERROR
View details · 1 shown
- Query
- ip-api.com
- Type
- A
- Answers
- 208.95.112.1
- Response
- NOERROR
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x64 64-bit5 sections
- Platform: x64 64-bit
- Sections: 5
- Entry point: present
- Compile time: 2026-10-14T13:12:17Z
View details · 1 shown
- Platform
- x64 64-bit
- Entry point
- 1056512
- Sections
- 5
- Compile time
- 2026-10-14T13:12:17Z
PE sections5
5 sections
- 5 PE sections
- Common permissions: r, rw, rx
- 5 unique section names
View details · 5 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 1074644
- Raw size
- 1074688
- Permissions
- rx
- Entropy
- 6.36
- Name
- .rdata
- Virtual address
- 1081344
- Virtual size
- 2078778
- Raw size
- 2079232
- Permissions
- r
- Entropy
- 7.48
- Name
- .data
- Virtual address
- 3162112
- Virtual size
- 2360
- Raw size
- 1024
- Permissions
- rw
- Entropy
- 1.22
- Name
- .pdata
- Virtual address
- 3166208
- Virtual size
- 36480
- Raw size
- 36864
- Permissions
- r
- Entropy
- 5.99
- Name
- .reloc
- Virtual address
- 3203072
- Virtual size
- 15452
- Raw size
- 15872
- Permissions
- r
- Entropy
- 5.36
Imports5+
5+ DLL groups
- 5+ import DLL groups
- 5+ imported functions summarized
View details · 5 shown
- Library
- kernel32.dll
- Functions
- CancelIo, CancelIoEx, CloseHandle, CopyFileExW, CreateDirectoryW, CreateEventW, CreateFileW, CreateIoCompletionPort …
- Library
- advapi32.dll
- Functions
- RegCloseKey, RegOpenKeyExW, RegQueryValueExW, SystemFunction036
- Library
- ntdll.dll
- Functions
- NtCancelIoFileEx, NtCreateFile, NtCreateNamedPipeFile, NtDeviceIoControlFile, NtOpenFile, NtReadFile, NtWriteFile, RtlNtStatusToDosError
- Library
- bcrypt.dll
- Functions
- BCryptGenRandom
- Library
- api-ms-win-core-synch-l1-2-0.dll
- Functions
- WaitOnAddress, WakeByAddressAll, WakeByAddressSingle
5 shown