- First seen
- Last seen
THREAT SIGNALMedium-high
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
fc8f8d20e71be857a744b3456d10e5d341cf60b3017e6d04896d713a09d02ee8- SHA1
a372948d801b26e5493da19787ea88c6385fe2b1- MD5
5963d6eac49b2d5a2c2700af23fb9122- Filename
- fc8f8d20_pogt45241112.msi.bin
- File type
- msi
- MIME
- application/x-msi
- File size
- 1048576
- TLSH
T1FC2533AD3E20A334CA5E0FB0D666E4EA7770BE6A47A22077176B374C2D31C4452676F4- SSDEEP
24576:MOGx0tnCuNPVr44VV1ubECopde9epHIpo4eRLSAVADpZSdDaF:MFx00uJVr422bECgGtppw
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 12. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 33%.
Confidence signal
VirusSign reports 99% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections33%
VirusSign confidence99%
Relationship context12 visible
Threat classificationloader
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
pedll
815616 bytes
contains
Filename
9f1f5116_3tgbrbae.exe.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
815616
Compile time
2025-11-19T05:53:23Z
0%
peexe
1012224 bytes
contains
Filename
ea3a3c8a_l62iw.exe.bin
Type
malware
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
1012224
0%
1187 bytes
drops
Filename
bfd60204_powershell_analysiscacheentry_e9ce57a7-0844-4b0f-81b1-0a6cb1ca23c5.bin
MIME
application/octet-stream
Size
1187
SHA1
54b856a180fb3723403f9aad24ca548de63dc376
First seen
2016-04-29T12:32:14Z
0%
powershell
11015 bytes
drops
Filename
72831bc6_powershell_analysiscacheentry_6d61c924-00f2-43fb-9266-131d0c53ab54.bin
File type
powershell
MIME
text/plain
Size
11015
SHA1
c9fa81aa57e7c32c4bcefd33788967cc3170fe91
0%
isoimage
512 bytes
drops
Filename
076a27c7_[25].bin
Type
malware
File type
isoimage
MIME
application/octet-stream
Size
512
Related IPs
Network IPs associated with this indicator.
5shown
TR
communicates
CIDR
45.141.148.0/24
Network
45.141.148.0-45.141.148.255
First seen
2023-10-16T22:56:09Z
Last seen
2026-11-14T19:07:24Z
0%
US
communicates
CIDR
52.123.0.0/16
Network
52.120.0.0-52.123.255.255
First seen
2023-10-01T05:47:45Z
Last seen
2026-11-15T04:32:13Z
0%
US
communicates
CIDR
52.123.0.0/16
Network
52.120.0.0-52.123.255.255
First seen
2023-09-29T10:44:59Z
Last seen
2026-11-15T04:33:39Z
0%
US
communicates
CIDR
52.123.0.0/16
Network
52.120.0.0-52.123.255.255
First seen
2023-10-05T15:33:51Z
Last seen
2026-11-15T04:31:08Z
0%
US
communicates
CIDR
52.123.0.0/16
Network
52.120.0.0-52.123.255.255
First seen
2023-10-01T02:12:25Z
Last seen
2026-11-15T04:33:20Z
Related domains
Domains associated with this indicator.
2shown
32%
high
.org
communicates
Root
duckdns.org
TLD
org
Subdomain
kingremcos2026
First seen
2026-08-12T22:16:42Z
Last seen
2026-11-14T19:07:25Z
0%
.microsoft
communicates
Root
cloud.microsoft
TLD
microsoft
Subdomain
atm.teams.mira.tm.svc
First seen
2024-08-26T16:41:58Z
Last seen
2026-11-15T04:33:56Z
Analysis details
Severity: hightrojanmalwareusb-checkmsi
Freshness: Fresh · Last seen 2 days ago.
- Detection rate
- 33%
- Threat type
- trojan
- Family
- loader
- Confidence
- 99%
- detection
- 33 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
fc8f8d20e71be857a744b3456d10e5d341cf60b3017e6d04896d713a09d02ee8- SHA1
a372948d801b26e5493da19787ea88c6385fe2b1- MD5
5963d6eac49b2d5a2c2700af23fb9122- Filename
- fc8f8d20_pogt45241112.msi.bin
- File type
- msi
- MIME
- application/x-msi
- File size
- 1048576
- TLSH
T1FC2533AD3E20A334CA5E0FB0D666E4EA7770BE6A47A22077176B374C2D31C4452676F4- SSDEEP
24576:MOGx0tnCuNPVr44VV1ubECopde9epHIpo4eRLSAVADpZSdDaF:MFx00uJVr422bECgGtppw- First seen
- 2026-11-12T10:34:14Z
- Last seen
- 2026-11-12T19:04:34Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 12. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 33%.
Confidence signal
VirusSign reports 99% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family loader.
Relationship context
12 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
13 timestamped observations are arranged from 2007-03-01 to 2026-11-12. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family loader.
Last seen 2 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- fc8f8d20_pogt45241112.msi.bin
- File type
- msi
- MIME
- application/x-msi
- Size
- 1048576
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- Attempts to make a network connection via suspicious process
- Captures clipboard data
- Checks available memory
- Checks for available system drives (often done to infect USB drives)
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1115 — Captures clipboard dataTactics: TA0009
- T1082 — Checks available memoryTactics: TA0007
- T1091 · T1120 — Checks for available system drives (often done to infect USB drives)Tactics: TA0001 · TA0007 · TA0008
- T1056 · T1119 — Combination of other detections shows multiple input capture behaviorsTactics: TA0006 · TA0009
5 shown
View MBC details · 5 shown
- CommunicationObjectives: OC0006
- C0016 — Create FileObjectives: OC0001
- Defense EvasionObjectives: OB0006
- DiscoveryObjectives: OB0007
- File SystemObjectives: OC0001
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity1
TCPports 2404
- 1 outbound connections observed
- 0 domains, 1 IPs, 0 URLs
- Common ports: 2404
- Protocols: TCP
View details · 1 shown
- IP
- 45.141.148.71
- Port
- 2404
- Protocol
- TCP
DNS request activity2
A5+ response IPs
- 2 DNS requests observed
- 2 unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 2 shown
- Query
- kingremcos2026.duckdns.org
- Type
- A
- Answers
- 45.141.148.71
- Response
- NOERROR
- Query
- atm.teams.mira.tm.svc.cloud.microsoft
- Type
- A
- Answers
- 52.123.250.53, 52.123.250.18, 52.123.250.27, 52.123.250.19, 52.123.250.29, 52.123.250.14, 52.123.250.8, 52.123.250.41
- Response
- NOERROR
C2 candidates1
DNSports 53
- 1 C2 candidate communications
- 1 domains, 1 IPs
- Common ports: 53
- Protocols: DNS
View details · 1 shown
- IP
- 45.141.148.71
- Domain
- kingremcos2026.duckdns.org
- Port
- 53
- Protocol
- DNS