- First seen
- Last seen
THREAT SIGNALMedium
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- IP address
- 94.26.0.53
- Version
- v4
- Country
- Bulgaria
- CIDR
- 94.26.0.0/24
- Network range
- 94.26.0.0-94.26.0.255
- ASN
- 211486
- AS owner
- RMP Protection Limited
- ISP
- Alferov Aleksey Aleksandrovich
- Organization
- ORG-RPL23-RIPE/RMP Protection Limited
- Open ports
- 443, 8080
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (15%).
Confidence signal
VirusSign confidence is elevated at 78%. Use it as supporting evidence together with detections, family and relationship context.
Analysis signals
OBSERVEDEngine detections15%
VirusSign confidence78%
Relationship context5 visible
Threat classificationmalware
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related files
Files observed communicating with, containing, or otherwise linked to this indicator.
3shown
30%
critical
peexe
291840 bytes
communicates
Filename
lune.exe
Family
stealer
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
74%
critical
peexe
283136 bytes
communicates
Filename
extinstaller.exe
Family
stealer
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
70%
critical
peexe
283136 bytes
communicates
Family
stealer
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
283136
Related URLs
URLs associated with this indicator.
2shown
0%
contains
HTTP status
404
Content length
18
Content SHA256
99eb12f2ab3c4866a353e098ffa3cb7a967e617c49b98480394ec5d8ea92b094
First seen
2026-10-04T04:23:02Z
Last seen
2026-11-05T21:45:15Z
11%
medium
contains
HTTP status
401
Content length
27
Content SHA256
f6fb0581cd4595cabec14507b030ccbfc9c91ed2bf1739259293e04b4d831855
First seen
2026-10-16T22:39:43Z
Last seen
2026-11-05T21:45:15Z
Analysis details
Severity: mediummalware
Freshness: Fresh · Last seen 5 days ago.
- Detection rate
- 15%
- Threat type
- malware
- Confidence
- 78%
- detection
- 15 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- IP address
- 94.26.0.53
- Version
- v4
- Country
- Bulgaria
- CIDR
- 94.26.0.0/24
- Network range
- 94.26.0.0-94.26.0.255
- ASN
- 211486
- AS owner
- RMP Protection Limited
- ISP
- Alferov Aleksey Aleksandrovich
- Organization
- ORG-RPL23-RIPE/RMP Protection Limited
- Open ports
- 443, 8080
- Protocols
- http, https, tcp, tls
- First seen
- 2026-09-04T14:38:54Z
- Last seen
- 2026-11-05T21:45:15Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (15%).
Confidence signal
VirusSign confidence is elevated at 78%. Use it as supporting evidence together with detections, family and relationship context.
Threat context
Classification includes type malware.
Relationship context
5 related indicators are shown across 2 relationship group(s).
Observation timeline
6 timestamped observations are arranged from 2026-09-04 to 2026-10-16. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
2 relationship group(s) provide pivot and infrastructure context.
Classification context: type malware.
Last seen 5 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
Network profile
summarySelected network intelligence summary.
- CIDR
- 94.26.0.0/24
- Network range
- 94.26.0.0-94.26.0.255
- ASN
- 211486
- AS owner
- RMP Protection Limited
- Organization
- ORG-RPL23-RIPE/RMP Protection Limited
- ISP
- Alferov Aleksey Aleksandrovich
- Country
- Bulgaria
Infrastructure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Service discovery1
- 1 service observations
TLS / certificates1
1 issuers1 subjects
- 1 certificates observed
- 1 issuers
- 1 subjects
View details · 1 shown
- Subject
- *.showfalle.online
- Issuer
- YE1