- First seen
- Last seen
THREAT SIGNALMedium-high
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
f280142c44c2dc458a3a5fa97bfeed8ffd2a49fe2e2f07a7af807e63de34850d- SHA1
ab9814f94857d25407479d5d8ba1a0a4558622ac- MD5
72afccb455faa4bc1e5f16ee67c6f915- Filename
- J6HG2ot.dot
- File type
- elf
- MIME
- application/x-elf
- File size
- 729816
- Filename variants
- 4 reported
- TLSH
T128F45C12B2E374ADC557C13007DBDFB2AE79F46902126E7B2190DA703962CE14B2AF57- SSDEEP
12288:H/rk+ovEILGl7wmoz1HBhEV+lDNHdBD7BJ58q+/Qf0jRXli:frCEILGlOdh7B8VVl
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 7. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 57%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections57%
VirusSign confidence100%
Relationship context7 visible
Threat classificationcinarek
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
4shown
0%
32 bytes
contains
Filename
VirusShare_2bfc02106293099b6e36e91a65c62a91
MIME
application/octet-stream
Size
32
SHA1
c2ca7d2977ad97203dbe637a2381b95ec92ee2c6
First seen
2018-03-16T06:47:15Z
0%
text
9 bytes
contains
Filename
.fini_14
File type
text
MIME
text/plain
Size
9
SHA1
fa7de3c1bbc31c0cfd7a16048b53b1bce8d2c590
0%
16 bytes
contains
Filename
.rodata.scr_dyn_number_coerce_js.hint
MIME
application/octet-stream
Size
16
SHA1
e129f27c5103bc5cc44bcdf0a15e160d445066ff
First seen
2009-02-20T20:34:59Z
0%
8 bytes
contains
Filename
.data.DotNETRuntimeRundownName
MIME
application/octet-stream
Size
8
SHA1
05fe405753166f125559e7c9ac558654f107c7e9
First seen
2009-02-15T21:51:13Z
Related IPs
Network IPs associated with this indicator.
1shown
6%
low
US
communicates
CIDR
8.8.8.0/24
Network
8.8.8.0-8.8.8.255
First seen
2023-09-29T05:20:58Z
Last seen
2026-11-11T07:22:53Z
Related domains
Domains associated with this indicator.
2shown
.me
communicates
Root
7ex.me
TLD
me
Subdomain
wt
First seen
2025-11-29T08:12:21Z
Last seen
2025-11-29T08:12:26Z
.in-addr.arpa
communicates
Root
216.in-addr.arpa
TLD
in-addr.arpa
Subdomain
46.203.58
First seen
2025-11-24T01:51:14Z
Last seen
2025-11-24T01:51:19Z
Analysis details
Severity: hightrojanelf64bitself-delete
Freshness: Historical · Last seen 694 days ago.
- Detection rate
- 57%
- Threat type
- trojan
- Family
- cinarek
- Confidence
- 100%
- detection
- 57 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
f280142c44c2dc458a3a5fa97bfeed8ffd2a49fe2e2f07a7af807e63de34850d- SHA1
ab9814f94857d25407479d5d8ba1a0a4558622ac- MD5
72afccb455faa4bc1e5f16ee67c6f915- Filename
- J6HG2ot.dot
- File type
- elf
- MIME
- application/x-elf
- File size
- 729816
- TLSH
T128F45C12B2E374ADC557C13007DBDFB2AE79F46902126E7B2190DA703962CE14B2AF57- SSDEEP
12288:H/rk+ovEILGl7wmoz1HBhEV+lDNHdBD7BJ58q+/Qf0jRXli:frCEILGlOdh7B8VVl- First seen
- 2015-05-31T14:05:06Z
- Last seen
- 2024-12-17T03:02:46Z
- Filename variants
- 4 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 7. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 57%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family cinarek.
Relationship context
7 related indicators are shown across 3 relationship group(s).
Observation timeline
8 timestamped observations are arranged from 2009-02-15 to 2025-11-29. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family cinarek.
Last seen 694 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- J6HG2ot.dot
- File type
- elf
- MIME
- application/x-elf
- Size
- 729816
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- encode data using Base64
- encrypt data using RC4 PRGA
- execute anti-debugging instructions
- execute syscall instruction
- hash data using djb2
View MITRE ATT&CK details · 1 shown
- T1027 — encode data using Base64Tactics: TA0005
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity1
UDPports 53
- 1 outbound connections observed
- 0 domains, 1 IPs, 0 URLs
- Common ports: 53
- Protocols: UDP
View details · 1 shown
- IP
- 8.8.8.8
- Port
- 53
- Protocol
- UDP
DNS request activity2
- 2 DNS requests observed
- 2 unique queries
- 0 response IPs
View details · 2 shown
- Query
- wt.7ex.me
- Query
- 46.203.58.216.in-addr.arpa