- First seen
- Last seen
THREAT SIGNALMedium
Read alongside the verdict
Indicator overview
INDICATOR PROFILEVirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.
- IP address
- 1.94.176.236
- Version
- v4
- Country
- China
- City
- Shanghai
- Region
- Shanghai
- CIDR
- 1.94.0.0/15
- Network range
- 1.94.0.0-1.94.255.255
- ASN
- 55990
- AS owner
- Huawei Cloud Service data center
- ISP
- Huawei Cloud Service data center
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
High-confidence evidence. Related indicators in this report: 9. Review the supporting evidence before taking action.
Detection signal
Suspicious. A limited set of engine detections is present (15%).
Confidence signal
VirusSign reports 82% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections15%
VirusSign confidence82%
Relationship context9 visible
Threat classificationmalware
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related files
Files observed communicating with, containing, or otherwise linked to this indicator.
5shown
74%
critical
peexe
3584 bytes
communicates
Filename
windows_i386.exe
Family
fragtor
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
70%
critical
peexe
3584 bytes
communicates
Family
rozena
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
3584
48%
high
elf
9800 bytes
communicates
Filename
3e8ce1432a85b40e.elf
Family
vshell
Type
trojan
File type
elf
MIME
application/x-elf
43%
high
elf
9848 bytes
communicates
Filename
bca7a3e6fe57671d.elf
Family
vshell
Type
trojan
File type
elf
MIME
application/x-elf
33%
high
elf
6968 bytes
communicates
Filename
linux_i386
Family
downloader
Type
trojan
File type
elf
MIME
application/x-elf
Related URLs
URLs associated with this indicator.
4shown
14%
medium
contains
HTTP status
200
Content length
637
Content SHA256
af44db26be11baa7878941cc1d95ccf043170236d6610ad24828affb44c873a6
First seen
2026-07-30T01:54:36Z
Last seen
2026-11-08T22:00:42Z
14%
medium
contains
First seen
2026-11-08T08:26:21Z
Last seen
2026-11-08T22:00:42Z
15%
medium
contains
HTTP status
200
Content length
637
Content SHA256
af44db26be11baa7878941cc1d95ccf043170236d6610ad24828affb44c873a6
First seen
2026-07-30T19:26:27Z
Last seen
2026-11-05T09:04:44Z
14%
medium
contains
First seen
2026-11-04T17:05:07Z
Last seen
2026-11-05T09:04:44Z
Analysis details
Severity: mediummalware
Freshness: Fresh · Last seen today.
- Detection rate
- 15%
- Threat type
- malware
- Confidence
- 82%
- confidence
- 82 · VirusSign confidence; engine detections are reported separately.
Overview
- IP address
- 1.94.176.236
- Version
- v4
- Country
- China
- City
- Shanghai
- Region
- Shanghai
- CIDR
- 1.94.0.0/15
- Network range
- 1.94.0.0-1.94.255.255
- ASN
- 55990
- AS owner
- Huawei Cloud Service data center
- ISP
- Huawei Cloud Service data center
- Organization
- DXTNET
- Network type
- datacenter
- Open ports
- 443, 10000, 10001
- Protocols
- http, https, tcp, tls
- First seen
- 2025-10-06T23:31:47Z
- Last seen
- 2026-11-10T15:50:05Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
High-confidence evidence. Related indicators in this report: 9. Review the supporting evidence before taking action.
Detection signal
Suspicious. A limited set of engine detections is present (15%).
Confidence signal
VirusSign reports 82% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type malware.
Relationship context
9 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
10 timestamped observations are arranged from 2023-10-26 to 2026-11-08. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
2 relationship group(s) provide pivot and infrastructure context.
Classification context: type malware.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
Network profile
summarySelected network intelligence summary.
- CIDR
- 1.94.0.0/15
- Network range
- 1.94.0.0-1.94.255.255
- ASN
- 55990
- AS owner
- Huawei Cloud Service data center
- Organization
- DXTNET
- ISP
- Huawei Cloud Service data center
- Network type
- datacenter
- Country
- China
- City
- Shanghai
Infrastructure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Service discovery1
- 1 service observations
TLS / certificates1
1 issuers1 subjects
- 1 certificates observed
- 1 issuers
- 1 subjects
View details · 1 shown
- Subject
- apps.microsoft.com
- Issuer
- GeoTrust Global TLS RSA4096 SHA256 2022 CA1