Report - durian.fsck.my/xm2sg.zip

Report Overview

Submitted URL
durian.fsck.my/xm2sg.zip
IP
46.23.93.155
ASN
#60131 High5! B.V.
Submitted
2024-04-26 07:20:45
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
6

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
durian.fsck.my	unknown	unknown	2019-07-03	2024-04-04	478 B	262 kB	46.23.93.155

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
durian.fsck.my/xm2sg.zip
IP
46.23.93.155
ASN
#60131 High5! B.V.

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
262 kB (261697 bytes)
Hash
79ca78d1434a6c83c07a589ae8f18500
e1f7889d41d32b367646b8608075120cf1689ac3
301089a394cb8504f4198aec5c561c5c382d69caceee495966ba911d04b89db3

Archive (1)

Filename

Md5

File type

xm2sg

2774ef5f2535317cf5141495a28e1ed2

ELF 64-bit LSB executable, x86-64, version 1 (SYSV)

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects mining pool protocol string in Executable
Public Nextron YARA rules	malware	Detects command line parameters often used by crypto mining software
Public Nextron YARA rules	malware	Detects Monero mining software
Elastic Security YARA Rules	malware	Linux.Cryptominer.Malxmr
Elastic Security YARA Rules	malware	MacOS.Cryptominer.Generic

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

	URL	IP	Response	Size
	durian.fsck.my/xm2sg.zip	46.23.93.155	200 OK	262 kB
URL User Request GET HTTP/1.1 durian.fsck.my/xm2sg.zip IP 46.23.93.155:443 ASN #60131 High5! B.V. Certificate IssuerLet's Encrypt Subjectdurian.fsck.my Fingerprint48:A5:8A:D5:DA:98:D1:FD:48:AD:99:37:DC:52:E8:1A:5F:7C:F0:3C ValidityWed, 03 Apr 2024 13:00:15 GMT - Tue, 02 Jul 2024 13:00:14 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 262 kB (261697 bytes) Hash 79ca78d1434a6c83c07a589ae8f18500 e1f7889d41d32b367646b8608075120cf1689ac3 301089a394cb8504f4198aec5c561c5c382d69caceee495966ba911d04b89db3 HTTP Headers `GET /xm2sg.zip HTTP/1.1 Host: durian.fsck.my User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Connection: keep-alive Content-Length: 261697 Content-Type: application/zip Date: Fri, 26 Apr 2024 07:20:20 GMT Last-Modified: Fri, 26 Apr 2024 05:59:04 GMT Server: OpenBSD httpd`

durian.fsck.my/xm2sg.zip

46.23.93.155

200 OK

262 kB

URL User Request GET HTTP/1.1
durian.fsck.my/xm2sg.zip
IP
46.23.93.155:443
ASN
#60131 High5! B.V.

Certificate
IssuerLet's Encrypt
Subjectdurian.fsck.my
Fingerprint48:A5:8A:D5:DA:98:D1:FD:48:AD:99:37:DC:52:E8:1A:5F:7C:F0:3C
ValidityWed, 03 Apr 2024 13:00:15 GMT - Tue, 02 Jul 2024 13:00:14 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
262 kB (261697 bytes)
Hash
79ca78d1434a6c83c07a589ae8f18500
e1f7889d41d32b367646b8608075120cf1689ac3
301089a394cb8504f4198aec5c561c5c382d69caceee495966ba911d04b89db3

HTTP Headers

GET /xm2sg.zip HTTP/1.1
Host: durian.fsck.my
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 261697
Content-Type: application/zip
Date: Fri, 26 Apr 2024 07:20:20 GMT
Last-Modified: Fri, 26 Apr 2024 05:59:04 GMT
Server: OpenBSD httpd

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (1)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers