- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- IP address
- 114.114.114.114
- Version
- v4
- Country
- China
- CIDR
- 114.114.112.0/21
- Network range
- 114.114.0.0-114.114.255.255
- ASN
- 21859
- AS owner
- Zenlayer Inc
- ISP
- Zenlayer Inc
- Organization
- XFInfo
- Open ports
- 53, 80, 443, 3333, 7881, 8080
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (6%).
Confidence signal
VirusSign confidence is elevated at 50%. Use it as supporting evidence together with detections, family and relationship context.
Analysis signals
OBSERVEDEngine detections6%
VirusSign confidence50%
Relationship context10 visible
Intelligence freshnessFresh
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related files
Files observed communicating with, containing, or otherwise linked to this indicator.
5shown
0%
peexe
14085352 bytes
communicates
Filename
DBF15705EA110A3615F34475F3204A0D0CD4F3ED688F8FEBD2B8B50AA343BD50
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
14085352
Compile time
1992-06-19T22:22:17Z
88%
high
peexe
163840 bytes
communicates
Filename
5ec4094e_javaupdtr.exe.bin
Family
androm
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
79%
high
peexe
16076288 bytes
communicates
Filename
5b4dd6ad_[0.51][10]1fae61802874acb5a6e3dc105698f7d9.s.bin
Family
ccminer
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
46%
high
peexe
2463893 bytes
communicates
Filename
33019f71_syncersoft gangnam vocoder vst.exe.bin
Family
relevant
Type
adware
File type
peexe
MIME
application/vnd.microsoft.portable-executable
52%
high
peexe
2164736 bytes
communicates
Filename
ac20993a_s-bot.exe.bin
Family
autoit
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Related URLs
URLs associated with this indicator.
5shown
0%
contains
First seen
2022-05-23T09:25:12Z
Last seen
2026-08-21T17:16:22Z
4%
low
contains
First seen
2021-08-29T12:05:31Z
Last seen
2026-01-10T13:32:25Z
0%
contains
First seen
2019-05-09T07:54:32Z
Last seen
2026-01-09T20:43:31Z
0%
contains
First seen
2022-11-12T20:48:11Z
Last seen
2026-01-03T04:26:37Z
4%
low
contains
First seen
2022-11-12T20:48:11Z
Last seen
2026-01-03T04:26:37Z
Analysis details
Severity: medium
Freshness: Fresh · Last seen today.
- Detection rate
- 6%
- Confidence
- 50%
- detection
- 6 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- IP address
- 114.114.114.114
- Version
- v4
- Country
- China
- CIDR
- 114.114.112.0/21
- Network range
- 114.114.0.0-114.114.255.255
- ASN
- 21859
- AS owner
- Zenlayer Inc
- ISP
- Zenlayer Inc
- Organization
- XFInfo
- Open ports
- 53, 80, 443, 3333, 7881, 8080
- Protocols
- http, https, tcp, tls
- First seen
- 2023-09-28T17:09:26Z
- Last seen
- 2026-11-14T09:05:25Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (6%).
Confidence signal
VirusSign confidence is elevated at 50%. Use it as supporting evidence together with detections, family and relationship context.
Relationship context
10 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
11 timestamped observations are arranged from 1992-06-19 to 2023-09-28. These are observation or metadata times, not execution order.
Infrastructure geography
1 infrastructure/location point(s) are visible on the map.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
2 relationship group(s) provide pivot and infrastructure context.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
Network profile
summarySelected network intelligence summary.
- CIDR
- 114.114.112.0/21
- Network range
- 114.114.0.0-114.114.255.255
- ASN
- 21859
- AS owner
- Zenlayer Inc
- Organization
- XFInfo
- ISP
- Zenlayer Inc
- Country
- China
Infrastructure summary
summarySummary of related infrastructure. More details and additional structured data are available through API and data access.
Service discovery1
- 1 service observations