Report - ea854dd260e7…a1791a72ff

Malicious HighFILE

Quota 36

First seen: 2026-10-15T15:20:17Z
Last seen: 2026-10-16T21:01:56Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYexeheaderltrojan

RELATED INDICATORS14Connections in this report

ANALYSISMaliciousRecent

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: ea854dd260e7d4f4a03713d598df0c57c2c5bfc169953a9e8db232a1791a72ff
SHA1: e333dcaa2ab499c57959d1d983f41346df5f437d
MD5: 67df199167349545f99d1da73d5e8919
Filename: 9z7BGnRGpgs8cZv7.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 2897408
Compile time: 2022-01-30T09:08:09Z
PE platform: x64 64-bit
PE sections: 6

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 33%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections33%

VirusSign confidence100%

Relationship context16 visible

Threat classificationexeheaderl

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

16 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

1shown

ea854dd260e7d4f4a03713d598df0c57c2c5bfc169953a9e8db232a1791a72ff

33% high peexe 2897408 bytes drops

Filename 9z7BGnRGpgs8cZv7.exe Family exeheaderl Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

Dropped / child files

Files dropped, bundled, or created by the queried file.

2shown

ea854dd260e7d4f4a03713d598df0c57c2c5bfc169953a9e8db232a1791a72ff

33% high peexe 2897408 bytes drops

Filename 9z7BGnRGpgs8cZv7.exe Family exeheaderl Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

255a65d30841ab4082bd9d0eea79d49c5ee88f56136157d8d6156aef11c12309

0% ini 26 bytes drops

Filename turbotax 2025 installer.exe:Zone.Identifier File type ini MIME text/plain Size 26 SHA1 6693ba299ec1881249d59262276a0d2cb21f8e64

Related IPs

Network IPs associated with this indicator.

5shown

2606:4700:3037::ac43:cc02

US communicates

CIDR 2606:4700:3000::/42 Network 2606:4700::-2606:4700:ffff:ffff:ffff:ffff:ffff:ffff First seen 2026-06-30T12:56:55Z Last seen 2026-11-11T05:34:58Z

2606:4700:3031::6815:4d22

0% US communicates

CIDR 2606:4700:3000::/42 Network 2606:4700::-2606:4700:ffff:ffff:ffff:ffff:ffff:ffff First seen 2026-07-02T22:00:52Z Last seen 2026-11-11T05:34:58Z

172.67.204.2

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-10-01T13:01:56Z Last seen 2026-11-12T05:03:03Z

104.21.77.34

0% US communicates

CIDR 104.21.0.0/17 Network 104.16.0.0-104.31.255.255 First seen 2023-09-29T07:27:56Z Last seen 2026-11-12T05:03:03Z

172.67.189.119

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-09-30T01:59:27Z Last seen 2026-11-12T05:03:03Z

Related domains

Domains associated with this indicator.

5shown

queue.grovewest89.club

33% high .club communicates

Root grovewest89.club TLD club Subdomain queue First seen 2026-09-24T02:53:23Z Last seen 2026-11-12T05:03:27Z

grovewest89.club

26% high .club communicates

Root grovewest89.club TLD club First seen 2026-09-22T04:43:22Z Last seen 2026-11-09T15:00:40Z

matic.rpc.sentio.xyz

5% low .xyz communicates

Root sentio.xyz TLD xyz Subdomain matic.rpc First seen 2025-10-05T08:28:15Z Last seen 2026-11-11T16:52:38Z

public.1rpc.io

5% low .io communicates

Root 1rpc.io TLD io Subdomain public First seen 2026-05-29T00:35:20Z Last seen 2026-11-12T05:03:04Z

polygon.lava.build

19% medium .build communicates

Root lava.build TLD build Subdomain polygon First seen 2024-12-04T08:19:48Z Last seen 2026-11-12T09:45:40Z

Related URLs

URLs associated with this indicator.

3shown

https://api.telegra.ph/getPage/Grove-record-index-09-21

5% low communicates

TLD ph HTTP status 200 Content length 292 Content SHA256 9abc965ebc15e2f291c3fed1afb7fd4fccce5e9be879098bec24b406ea3b7534 First seen 2026-09-27T22:26:16Z

https://queue.grovewest89.club/gateway

5% medium communicates

TLD club HTTP status 404 Content length 520 Content SHA256 3ecd8677c17e7bd75f697f2ab3fb8ee834705d4a2c36e7640e2e2d0133bfa985 First seen 2026-09-24T08:38:07Z

https://public.1rpc.io/matic

0% communicates

TLD io HTTP status 200 Content length 144 Content SHA256 5fb9480e8f21925a902c3006422cdfc3daeea608681574b15fbf23273b8db489 First seen 2026-06-01T01:50:38Z

Analysis details

Severity: hightrojan64bitexeself-deleteobfuscated

Freshness: Recent · Last seen 26 days ago.

Detection rate: 33%
Threat type: trojan
Family: exeheaderl
Confidence: 100%
detection: 33 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: ea854dd260e7d4f4a03713d598df0c57c2c5bfc169953a9e8db232a1791a72ff
SHA1: e333dcaa2ab499c57959d1d983f41346df5f437d
MD5: 67df199167349545f99d1da73d5e8919
Filename: 9z7BGnRGpgs8cZv7.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 2897408
Compile time: 2022-01-30T09:08:09Z
PE platform: x64 64-bit
PE sections: 6
Import libraries: 5
TLSH: T1AED5239538FA28B0D417C7B28FD3E6BDB0287B854B658E47F78DA4244E13658243B376
SSDEEP: 49152:pI7dOuev7ZAVmMed00dj9L0Ja4O0OsjYb70m6SfrW1aRqgZdgz6:pI8ufcZdjMFOLsjogm6+r/Rqgg
Imphash: a6696f6a922ae4f043762842d701e341
First seen: 2026-10-15T15:20:17Z
Last seen: 2026-10-16T21:01:56Z
Filename variants: 3 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 33%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family exeheaderl.

Relationship context

16 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

15 timestamped observations are arranged from 2020-03-09 to 2026-09-27. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 33%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 16 visible

5 relationship group(s) provide pivot and infrastructure context.

Threat classification exeheaderl

Classification context: type trojan, family exeheaderl.

Intelligence freshness Recent

Last seen 26 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 9z7BGnRGpgs8cZv7.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 2897408
Compile time: 2022-01-30T09:08:09Z
PE platform: x64 64-bit
Entry point: 4176170
Sections: 6

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

obfuscatedself-delete

View details · 5 shown

A DLL was loaded from a suspicious directory
A process created a hidden window
Authenticode signature is invalid
Checks system language via registry key (possible geofencing)
Classification label

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1564.003 — A process created a hidden window
Tactics: TA0005
T1036 · T1553.002 — Authenticode signature is invalid
Tactics: TA0005 · TA0112
T1112 · T1547.001 — Creates an undocumented autostart registry key
Tactics: TA0003 · TA0004 · TA0112
T1564.004 — Creates files in alternative data streams (ADS)
Tactics: TA0005

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
Communication
Objectives: OC0006
B0002 — Debugger Evasion
Objectives: OB0001
Defense Evasion
Objectives: OB0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 53, 80

5+ outbound connections observed
3 domains, 5+ IPs, 4 URLs
Common ports: 443, 53, 80
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: queue.grovewest89.club
URL: https://queue.grovewest89.club:443/gateway
Protocol: HTTP

Domain: queue.grovewest89.club
URL: https://queue.grovewest89.club/gateway
Protocol: HTTP

Domain: public.1rpc.io
URL: https://public.1rpc.io/matic
Protocol: HTTP

Domain: api.telegra.ph
URL: https://api.telegra.ph/getpage/grove-record-index-09-21
Protocol: HTTP

IP: 8.8.8.8
Port: 53
Protocol: UDP

5 shown

DNS request activity5

A, A/AAAA5+ response IPs

5 DNS requests observed
5 unique queries
5+ response IPs
Query types: A, A/AAAA
Response codes: NOERROR

View details · 5 shown

Query: queue.grovewest89.club
Type: A
Answers: 172.67.189.119, 104.21.41.59
Response: NOERROR

Query: polygon.lava.build

Query: public.1rpc.io
Type: A/AAAA
Answers: 2606:4700:3037::ac43:cc02, 172.67.204.2, 2606:4700:3031::6815:4d22, 104.21.77.34
Response: NOERROR

Query: matic.rpc.sentio.xyz

Query: api.telegra.ph
Type: A
Answers: 149.154.164.13
Response: NOERROR

C2 candidates2

DNS, HTTPports 53

2 C2 candidate communications
1 domains, 1 IPs
Common ports: 53
Protocols: DNS, HTTP

View details · 2 shown

Domain: queue.grovewest89.club
Protocol: HTTP

IP: 172.67.189.119
Domain: queue.grovewest89.club
Port: 53
Protocol: DNS

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2022-01-30T09:08:09Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 4176170
Sections: 6
Compile time: 2022-01-30T09:08:09Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: rx, rw, r
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 46416
Raw size: 0
Permissions: rx
Entropy: 0.0

Name: .rdata
Virtual address: 53248
Virtual size: 4218
Raw size: 0
Permissions: r
Entropy: 0.0

Name: .data
Virtual address: 61440
Virtual size: 6432
Raw size: 0
Permissions: rw
Entropy: 0.0

Name: .V~+
Virtual address: 69632
Virtual size: 1759967
Raw size: 0
Permissions: rx
Entropy: 0.0

Name: .!H(
Virtual address: 1830912
Virtual size: 136
Raw size: 512
Permissions: rw
Entropy: 0.37

5 shown

Imports5

5 DLL groups

5 import DLL groups
5 imported functions summarized

View details · 5 shown

Library: KERNEL32.dll
Functions: CompareStringW

Library: USER32.dll
Functions: IsWindowEnabled

Library: SHELL32.dll
Functions: ExtractIconExW

Library: GDI32.dll
Functions: GetObjectW

Library: ole32.dll
Functions: CoCreateGuid

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check