Report - d7964f138ad2…a59e7d4277

Malicious CriticalFILE

Quota 28

First seen: 2026-07-31T07:12:16Z
Last seen: 2026-10-01T02:16:22Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYwingotrojan

RELATED INDICATORS13Connections in this report

ANALYSISMaliciousAging

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: d7964f138ad285a8b8a2a04f7a6c7b57b08e84314031de5e857577a59e7d4277
SHA1: 799731c8d6c7c9c298dc51c23608e66a7bf3c909
MD5: 206cf806890623efcb1a6c40807b7a47
Filename: Latest_v241.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 3422576
PE platform: x64 64-bit
PE sections: 8
Import libraries: 1

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 13. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 46%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections46%

VirusSign confidence100%

Relationship context13 visible

Threat classificationwingo

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

13 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b

0% text 20 bytes drops

Filename ~stg_4e02.tmp File type text MIME text/plain Size 20 SHA1 a5c60ee7d9227fcaba938dbb99521c03597fb908

c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

0% 118784 bytes drops

Filename History MIME application/octet-stream Size 118784 SHA1 d2db6b2759d9e650ae031eb62247d457ccaa57d2 First seen 2021-05-09T10:25:25Z

ba7eb45b7e9b6990bc63be63836b74fa2ccb64dcd0c199056b6ae37b1ae735f2

0% 98304 bytes drops

Filename fpzmdbktf.tmpdb MIME application/vnd.sqlite3 Size 98304 SHA1 cdccc11837cddb657eb0ef6a01202451ecdf4992 First seen 2022-01-18T14:24:35Z

aea6b8cbad4e4a5c1c86c631738b0f49c652c7e1c621f974a0742e7c97e0a678

0% 59392 bytes drops

Filename jbvmfve.tmpdb MIME application/octet-stream Size 59392 SHA1 7ae3ff47f25f084f967715f9625cedfab92f4543 First seen 2015-10-21T18:33:44Z

da0c10fd5819560fa89fdadefeb5447127bba68c784214248a295e3127babe09

0% sql 7168 bytes drops

Filename tmpa627.tmp.dat File type sql MIME application/octet-stream Size 7168 SHA1 da9e1764f9a4dde90aa25f23c7df23fd5c212549

Related IPs

Network IPs associated with this indicator.

5shown

2.26.252.48

29% high US communicates

CIDR 2.26.252.0/24 Network 2.26.252.0-2.26.252.255 First seen 2023-10-24T16:46:50Z Last seen 2026-11-03T23:51:14Z

8.6.112.0

0% US communicates

CIDR 8.6.112.0/24 Network 8.6.112.0-8.6.112.255 First seen 2024-03-06T08:09:44Z Last seen 2026-11-13T12:59:41Z

8.47.69.0

0% US communicates

CIDR 8.47.69.0/24 Network 8.47.69.0-8.47.69.255 First seen 2024-03-05T22:42:49Z Last seen 2026-11-13T12:59:41Z

172.67.74.152

0% US communicates

CIDR 172.67.64.0/18 Network 172.64.0.0-172.71.255.255 First seen 2023-09-30T13:06:48Z Last seen 2026-11-13T12:54:27Z

104.26.13.205

0% US communicates

CIDR 104.26.0.0/20 Network 104.16.0.0-104.31.255.255 First seen 2023-10-03T19:21:50Z Last seen 2026-11-13T12:54:26Z

Related domains

Domains associated with this indicator.

1shown

api.ipify.org

0% .org communicates

Root ipify.org TLD org Subdomain api First seen 2023-10-01T04:34:19Z Last seen 2026-11-13T13:09:31Z

Related URLs

URLs associated with this indicator.

2shown

http://2.26.252.48:8080/gate/handshake

29% medium communicates

HTTP status 200 Content length 3002 Content SHA256 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747 First seen 2026-07-31T06:48:56Z Last seen 2026-10-09T01:03:39Z

http://2.26.252.48:8080/gate/chunk

25% medium communicates

HTTP status 200 Content length 3002 Content SHA256 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747 First seen 2026-07-31T06:48:56Z Last seen 2026-10-09T01:03:39Z

Analysis details

Severity: criticaltrojanexepolymorphic64bitinvalid-signaturefile-overlaypersistenceobfuscatedsigned

Freshness: Aging · Last seen 43 days ago.

Detection rate: 46%
Threat type: trojan
Family: wingo
Confidence: 100%
detection: 46 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: d7964f138ad285a8b8a2a04f7a6c7b57b08e84314031de5e857577a59e7d4277
SHA1: 799731c8d6c7c9c298dc51c23608e66a7bf3c909
MD5: 206cf806890623efcb1a6c40807b7a47
Filename: Latest_v241.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 3422576
PE platform: x64 64-bit
PE sections: 8
Import libraries: 1
TLSH: T101F55A07BCE449E9D499933289B752927B34BC084F3263D72E90BA782F727D09D76B50
SSDEEP: 24576:YtdsUbvBvvDrox+iVVfXKvNXmJE0Ii0YcJldzBeletrKDX7jAwRD06a:Ybs+vFvAxvvfX4WJt0HL8Zba
Imphash: d42595b695fc008ef2c56aabd8efd68e
First seen: 2026-07-31T07:12:16Z
Last seen: 2026-10-01T02:16:22Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 13. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 46%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family wingo.

Relationship context

13 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

14 timestamped observations are arranged from 2015-07-18 to 2026-07-31. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 46%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 13 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification wingo

Classification context: type trojan, family wingo.

Intelligence freshness Aging

Last seen 43 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: Latest_v241.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 3422576
PE platform: x64 64-bit
Entry point: 474464
Sections: 8

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

obfuscatedpersistence

View details · 5 shown

AV process strings found (often used to terminate AV products)
Allocates memory in foreign processes
Classification label
Connects to IPs without corresponding DNS lookups
Contains modern PE file flags such as dynamic base (ASLR) or NX

5 shown

View MITRE ATT&CK details · 5 shown

T1055 — Allocates memory in foreign processes
Tactics: TA0004 · TA0005
T1571 — Detected TCP or UDP traffic on non-standard ports
Tactics: TA0011
T1548 — Found direct / indirect Syscall (likely to bypass EDR)
Tactics: TA0004
T1005 — Found many strings related to Crypto-Wallets (likely being stolen)
Tactics: TA0009
T1057 · T1082 — Is looking for software installed on the system
Tactics: TA0007

5 shown

View MBC details · 5 shown

C0027.001 — AES
Objectives: OC0005
C0040 — Allocate Thread Local Storage
Objectives: OC0003
Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
C0026.001 — Base64
Objectives: OC0004

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 53, 8080

5+ outbound connections observed
1 domains, 4 IPs, 2 URLs
Common ports: 443, 53, 8080
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: 2.26.252.48
URL: http://2.26.252.48:8080/gate/handshake
Protocol: HTTP

Domain: 2.26.252.48
URL: http://2.26.252.48:8080/gate/chunk
Protocol: HTTP

IP: 2.26.252.48
Port: 8080
Protocol: TCP

IP: 8.6.112.0
Port: 443
Protocol: TCP

IP: 172.67.74.152
Port: 443
Protocol: TCP

5 shown

DNS request activity2

A5 response IPs

2 DNS requests observed
1 unique queries
5 response IPs
Query types: A
Response codes: NOERROR

View details · 2 shown

Query: api.ipify.org
Type: A
Answers: 8.47.69.0, 8.6.112.0
Response: NOERROR

Query: api.ipify.org
Type: A
Answers: 104.26.12.205, 172.67.74.152, 104.26.13.205
Response: NOERROR

C2 candidates2

HTTP, TCPports 8080

2 C2 candidate communications
1 domains, 1 IPs
Common ports: 8080
Protocols: HTTP, TCP

View details · 2 shown

Domain: 2.26.252.48
Protocol: HTTP

IP: 2.26.252.48
Port: 8080
Protocol: TCP

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present

View details · 1 shown

Platform: x64 64-bit
Entry point: 474464
Sections: 8

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 1013553
Raw size: 1013760
Permissions: rx
Entropy: 6.24

Name: .rdata
Virtual address: 1019904
Virtual size: 1141992
Raw size: 1142272
Permissions: r
Entropy: 6.03

Name: .data
Virtual address: 2162688
Virtual size: 360488
Raw size: 60416
Permissions: rw
Entropy: 4.53

Name: .pdata
Virtual address: 2527232
Virtual size: 20364
Raw size: 20480
Permissions: r
Entropy: 5.22

Name: .xdata
Virtual address: 2547712
Virtual size: 180
Raw size: 512
Permissions: r
Entropy: 1.78

5 shown

Imports1

1 DLL groups

1 import DLL groups
5+ imported functions summarized

View details · 1 shown

Library: kernel32.dll
Functions: AddVectoredContinueHandler, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateIoCompletionPort, CreateThread, CreateWaitableTimerExW, DuplicateHandle …

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates1

1 issuer

Example subject: easports.gg
Issued by: easports.gg
Validity period (UTC): 2026-07-30 – 2027-07-30

View details · 1 shown

Subject: easports.gg
Issuer: easports.gg
Valid from: 1785418740.0
Valid to: 1816954740.0
Fingerprint: CB546ED309CDE256FADF187CA63312CFA4AD912C

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check