Report - fb09d0e5393e…44d07be51f

Malicious HighFILE

Quota 42

First seen: 2026-11-10T17:02:57Z
Last seen: 2026-11-10T21:46:43Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYclipbankertrojan

RELATED INDICATORS16Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: fb09d0e5393ebb9060ea26c2050d7ff3bd6efee340a7d1173be94a44d07be51f
SHA1: bed73d0190026994609f59b474814fac3da784e6
MD5: 7979fc77c11445b7d28554064c3bbec3
Filename: rename.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 3322880
Compile time: 2024-12-30T05:57:42Z
PE platform: x64 64-bit
PE sections: 7

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 71%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections71%

VirusSign confidence100%

Relationship context16 visible

Threat classificationclipbanker

Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.

RELATIONSHIP CONSTELLATION

SELECT A NODE TO EXPLORE

FILEDOMAINIPURL

Visible connections

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

16 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

bff972df82ef871cff56b4093f6953a526992555c2913ecd6fede0d642b7cc0a

0% text 8943 bytes drops

Filename powershell_analysiscacheentry_5f1707a8-301c-49c1-bfb8-ad5cc39045e2 File type text MIME text/plain Size 8943 SHA1 0ff4743454228ffabbad8cdacda16726baad110c

bfd60204585f1603ee9faac7c44adb9fcd6fa56b7748f03ecb1a9beaa7c56ea1

0% 1187 bytes drops

Filename powershell_analysiscacheentry_e9ce57a7-0844-4b0f-81b1-0a6cb1ca23c5 MIME application/octet-stream Size 1187 SHA1 54b856a180fb3723403f9aad24ca548de63dc376 First seen 2016-04-29T12:32:14Z

9214d80f84cede2f6a2b72f617e0c6a54c75f589b00ff17d2858041e541f30b0

0% 602 bytes drops

Filename powershell_analysiscacheentry_1698e8ee-9d12-40f9-bdbb-51d677145dab MIME application/octet-stream Size 602 SHA1 dbb7a768710941631e09c9baae697a95dd5b2004 First seen 2016-04-26T05:41:41Z

72831bc6962c8017ea71abc038a8f60e79976ebaf05d363c80f32c975a55d0d9

0% powershell 11015 bytes drops

Filename powershell_analysiscacheentry_6d61c924-00f2-43fb-9266-131d0c53ab54 File type powershell MIME text/plain Size 11015 SHA1 c9fa81aa57e7c32c4bcefd33788967cc3170fe91

12bd362291f72f2c2e7756742b7377549d13d5bf231455d23ef250c5bdf18121

0% 1815 bytes drops

Filename powershell_analysiscacheentry_e771c4d7-1972-4534-8d9d-d55496b0a380 MIME application/octet-stream Size 1815 SHA1 8b9029e83008d74b8c5414a2ef064629a340c9ae First seen 2016-04-28T13:52:41Z

Related IPs

Network IPs associated with this indicator.

4shown

172.67.173.197

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-09-30T13:21:11Z Last seen 2026-11-10T23:01:33Z

104.21.55.221

6% low US communicates

CIDR 104.21.0.0/17 Network 104.16.0.0-104.31.255.255 First seen 2023-09-30T08:39:41Z Last seen 2026-11-10T23:01:33Z

172.67.150.120

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-10-03T01:00:00Z Last seen 2026-11-10T23:01:33Z

104.21.30.35

0% US communicates

CIDR 104.20.0.0/15 Network 104.16.0.0-104.31.255.255 First seen 2023-09-30T16:34:38Z Last seen 2026-11-10T23:01:33Z

Related domains

Domains associated with this indicator.

2shown

irm.st

30% high .st communicates

Root irm.st TLD st First seen 2026-10-10T11:08:39Z Last seen 2026-11-10T23:01:35Z

doxbin.cy

35% medium .cy communicates

Root doxbin.cy TLD cy First seen 2026-04-10T05:37:53Z Last seen 2026-11-10T23:01:35Z

Related URLs

URLs associated with this indicator.

5shown

http://irm.st/958138

32% high communicates

TLD st HTTP status 200 Content length 15743 Content SHA256 fdc3a50ab92fa850702a69a96d3d51cffdcd42e26f2650ff9dac77afe004ce87 First seen 2026-11-10T20:11:51Z

https://doxbin.cy:2083/046435?…

33% medium communicates

TLD cy HTTP status 200 Content length 2 Content SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df First seen 2026-11-10T20:11:51Z

https://doxbin.cy:2083/346166?…

33% medium communicates

TLD cy HTTP status 200 Content length 2 Content SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df First seen 2026-11-10T20:11:51Z

http://irm.st/ff9f51c238217566

32% high communicates

TLD st HTTP status 200 Content length 128945152 Content SHA256 c1700b72350791ed089037128a4613259e796f0301aebda81b2d0f3e418e22ca First seen 2026-11-10T20:11:51Z

http://irm.st/969805

32% high communicates

TLD st HTTP status 200 Content length 15906 Content SHA256 e5f2c2fcd5a96423a6a2659335f543c6e3eba6bbd34a87070394f97ae537219e First seen 2026-11-10T17:10:57Z

Analysis details

Severity: hightrojanobfuscatedmalwarepolymorphic64bitadapter-discoverymacro-pspersistenceenv-checkexe

Freshness: Fresh · Last seen today.

Detection rate: 71%
Threat type: trojan
Family: clipbanker
Confidence: 100%
detection: 71 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: fb09d0e5393ebb9060ea26c2050d7ff3bd6efee340a7d1173be94a44d07be51f
SHA1: bed73d0190026994609f59b474814fac3da784e6
MD5: 7979fc77c11445b7d28554064c3bbec3
Filename: rename.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 3322880
Compile time: 2024-12-30T05:57:42Z
PE platform: x64 64-bit
PE sections: 7
Import libraries: 2
TLSH: T13AF58E2BA3E901ACC0B3C07D89475507EBB2344653A1EEDB56A085665FB7BE01F7A730
SSDEEP: 49152:yhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiV:yhVDdV0bHtRjCVjY
Imphash: 96c988111beae19d6f75f54b89a75585
Richhash: be63dc40a779f3d1d8f78dfd80dada6d
First seen: 2026-11-10T17:02:57Z
Last seen: 2026-11-10T21:46:43Z
Filename variants: 5 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 71%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family clipbanker.

Relationship context

16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

17 timestamped observations are arranged from 2016-04-26 to 2026-11-10. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 71%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 16 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification clipbanker

Classification context: type trojan, family clipbanker.

Intelligence freshness Fresh

Last seen today.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: rename.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 3322880
Compile time: 2024-12-30T05:57:42Z
PE platform: x64 64-bit
Entry point: 2118036
Sections: 7

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

env-checkadapter-discoverymacro-psobfuscatedpersistence

View details · 5 shown

A DLL was loaded from a suspicious directory
A document or script file initiated network communications indicative of a potential exploit or payload download
A document or script wrote an executable file to disk
A process created a hidden window
A script or command line contains a long continuous string indicative of obfuscation

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1059 — A document or script wrote an executable file to disk
Tactics: TA0002
T1564.003 — A process created a hidden window
Tactics: TA0005
T1059 · T1064 — A scripting utility was executed
Tactics: TA0002 · TA0005
T1006 — Accesses volumes directly
Tactics: TA0005

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
B0009.001 — Check File and Directory Artifacts
Objectives: OB0001
B0009.005 — Check Registry Keys
Objectives: OB0001
B0009.008 — Check Virtual Devices
Objectives: OB0001

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCPports 2083, 80

5+ outbound connections observed
2 domains, 4 IPs, 5+ URLs
Common ports: 2083, 80
Protocols: HTTP, TCP

View details · 5 shown

Domain: doxbin.cy
URL: https://doxbin.cy:2083/363524?action=init
Protocol: HTTP

Domain: doxbin.cy
URL: https://doxbin.cy:2083/346166?action=init
Protocol: HTTP

Domain: doxbin.cy
URL: https://doxbin.cy:2083/046435?action=init
Protocol: HTTP

Domain: irm.st
URL: http://irm.st/ff9f51c238217566
Protocol: HTTP

Domain: irm.st
URL: http://irm.st/9d1467912a63392b
Protocol: HTTP

5 shown

DNS request activity2

A4 response IPs

2 DNS requests observed
2 unique queries
4 response IPs
Query types: A
Response codes: NOERROR

View details · 2 shown

Query: irm.st
Type: A
Answers: 172.67.150.120, 104.21.30.35
Response: NOERROR

Query: doxbin.cy
Type: A
Answers: 104.21.55.221, 172.67.173.197
Response: NOERROR

C2 candidates5

DNS, HTTPports 53

5 C2 candidate communications
2 domains, 3 IPs
Common ports: 53
Protocols: DNS, HTTP

View details · 5 shown

Domain: irm.st
Protocol: HTTP

Domain: doxbin.cy
Protocol: HTTP

IP: 104.21.30.35
Domain: irm.st
Port: 53
Protocol: DNS

IP: 172.67.173.197
Domain: doxbin.cy
Port: 53
Protocol: DNS

IP: 104.21.55.221
Domain: doxbin.cy
Port: 53
Protocol: DNS

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2024-12-30T05:57:42Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 2118036
Sections: 7
Compile time: 2024-12-30T05:57:42Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 2432792
Raw size: 2433024
Permissions: rx
Entropy: 6.53

Name: .rdata
Virtual address: 2437120
Virtual size: 774918
Raw size: 775168
Permissions: r
Entropy: 6.64

Name: .data
Virtual address: 3215360
Virtual size: 104264
Raw size: 26624
Permissions: rw
Entropy: 3.2

Name: .pdata
Virtual address: 3321856
Virtual size: 78096
Raw size: 78336
Permissions: r
Entropy: 6.28

Name: .fptable
Virtual address: 3403776
Virtual size: 256
Raw size: 512
Permissions: rw
Entropy: 0.0

5 shown

Imports2

2 DLL groups

2 import DLL groups
5+ imported functions summarized

View details · 2 shown

Library: ntdll.dll
Functions: RtlCaptureContext, RtlInitUnicodeString, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwind, RtlUnwindEx, RtlVirtualUnwind

Library: KERNEL32.dll
Functions: AcquireSRWLockExclusive, AreFileApisANSI, BeginUpdateResourceW, CloseHandle, CompareStringEx, CompareStringW, ConnectNamedPipe, CreateDirectoryW …

Resources2

2 resources

2 resources
Resource types: RT_MANIFEST, RT_VERSION

View details · 2 shown

Type: RT_VERSION
Language: ENGLISH US

Type: RT_MANIFEST
Language: ENGLISH US

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check