Overview

URL csgobober.ru/loaderP939.exe
IP104.28.12.157
ASNAS13335 CloudFlare, Inc.
Location United States
Report completed2019-05-22 11:29:11 CEST
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2019-05-22 2 csgobober.ru/loaderP939.exe Malware
2019-05-22 2 csgobober.ru/loaderP939.exe Malware
DNS-BH  No alerts detected
mnemonic secure dns  No alerts detected


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 104.28.12.157

Date UQ / IDS / BL URL IP
2019-06-07 17:44:49 +0200
0 - 0 - 2 csgobober.ru/loaderp374.exe 104.28.12.157
2019-06-07 15:18:08 +0200
0 - 0 - 2 csgobober.ru/loaderp1249.exe 104.28.12.157
2019-06-07 14:29:50 +0200
0 - 0 - 2 csgobober.ru/loaderp412.exe 104.28.12.157
2019-06-07 13:34:09 +0200
0 - 0 - 2 csgobober.ru/loaderp377.exe 104.28.12.157
2019-06-07 10:41:04 +0200
0 - 0 - 2 csgobober.ru/loaderp683.exe 104.28.12.157
2019-06-06 21:44:21 +0200
0 - 0 - 2 csgobober.ru/loaderp1096.exe 104.28.12.157
2019-06-06 21:44:00 +0200
0 - 0 - 2 csgobober.ru/loaderp1115.exe 104.28.12.157
2019-06-06 21:41:14 +0200
0 - 0 - 2 csgobober.ru/loaderp989.exe 104.28.12.157
2019-06-06 21:37:25 +0200
0 - 0 - 2 csgobober.ru/loaderp1218.exe 104.28.12.157
2019-06-06 21:25:58 +0200
0 - 0 - 2 csgobober.ru/loaderp1233.exe 104.28.12.157

Last 10 reports on ASN: AS13335 CloudFlare, Inc.

Date UQ / IDS / BL URL IP
2019-06-25 10:44:19 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/good-trouble (...) 104.16.120.127
2019-06-25 10:44:11 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/putlocker-go (...) 104.16.122.127
2019-06-25 10:44:03 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/watch-good-t (...) 104.16.120.127
2019-06-25 10:43:55 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/full-episode (...) 104.16.121.127
2019-06-25 10:43:33 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/watch-good-t (...) 104.16.124.127
2019-06-25 10:43:24 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/good-trouble (...) 104.16.121.127
2019-06-25 10:43:20 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/watch-good-t (...) 104.16.124.127
2019-06-25 10:43:19 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/full-series- (...) 104.16.123.127
2019-06-25 10:43:12 +0200
0 - 0 - 0 https://medium.com/@bokuwakami01/good-trouble (...) 104.16.123.127
2019-06-25 10:26:22 +0200
0 - 0 - 0 https://www.rjavan.me 104.26.2.84

Last 10 reports on domain: csgobober.ru

Date UQ / IDS / BL URL IP
2019-06-07 17:44:49 +0200
0 - 0 - 2 csgobober.ru/loaderp374.exe 104.28.12.157
2019-06-07 15:59:55 +0200
0 - 0 - 2 csgobober.ru/loaderp377.exe 104.28.13.157
2019-06-07 15:58:46 +0200
0 - 0 - 2 csgobober.ru/loaderp1249.exe 104.28.13.157
2019-06-07 15:18:08 +0200
0 - 0 - 2 csgobober.ru/loaderp1249.exe 104.28.12.157
2019-06-07 14:29:57 +0200
0 - 0 - 2 csgobober.ru/loaderp374.exe 104.28.13.157
2019-06-07 14:29:50 +0200
0 - 0 - 2 csgobober.ru/loaderp412.exe 104.28.12.157
2019-06-07 13:34:09 +0200
0 - 0 - 2 csgobober.ru/loaderp377.exe 104.28.12.157
2019-06-07 10:41:04 +0200
0 - 0 - 2 csgobober.ru/loaderp683.exe 104.28.12.157
2019-06-07 10:40:11 +0200
0 - 0 - 2 csgobober.ru/loaderp403.exe 104.28.13.157
2019-06-06 22:05:04 +0200
0 - 0 - 2 csgobober.ru/loaderP939.exe 104.28.13.157


JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (4)


Request Response
                                        
                                            GET /loaderP939.exe HTTP/1.1 
Host: csgobober.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         104.28.12.157
HTTP/1.1 301 Moved Permanently
                                        
Date: Wed, 22 May 2019 09:28:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Wed, 22 May 2019 10:28:40 GMT
Location: https://csgobober.ru/loaderP939.exe
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 4dadc2e3fb89d10d-TXL


--- Additional Info ---

Alerts:
  Blacklists:
    - fortinet: Malware
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Cache-Control: max-age=141113
Date: Wed, 22 May 2019 09:28:40 GMT
Etag: "5ce49a81-118"
Expires: Fri, 24 May 2019 00:40:33 GMT
Last-Modified: Wed, 22 May 2019 00:40:33 GMT
Server: nginx
X-Cache: HIT
Content-Length: 280


--- Additional Info ---
Magic:  data
Size:   280
Md5:    a98c63b56997a915138aac1043428a8e
Sha1:   371cea3b695f178db5f806139f58f9e573490276
Sha256: 642110c91dc625e9f2403b402bfe84dd76004a126f69085355fb2bc14b5da210
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Cache-Control: max-age=166206
Date: Wed, 22 May 2019 09:28:40 GMT
Etag: "5ce4e597-5e3"
Expires: Fri, 24 May 2019 07:38:46 GMT
Last-Modified: Wed, 22 May 2019 06:00:55 GMT
Server: ECS (lcy/1D57)
X-Cache: HIT
Content-Length: 1507


--- Additional Info ---
Magic:  data
Size:   1507
Md5:    ea3a17f40615f96aa1f053af8a64a870
Sha1:   a054f28da9eda43d7332958e051f8509c58cb644
Sha256: a590d427f69de77aa3dc3794d9baeeefb5651e88ae11d8e723e1795502c87099
                                        
                                            GET /loaderP939.exe HTTP/1.1 
Host: csgobober.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         104.28.12.157
HTTP/1.1 200 OK
Content-Type: application/x-msdos-program
                                        
Date: Wed, 22 May 2019 09:28:40 GMT
Content-Length: 5934592
Connection: keep-alive
Set-Cookie: __cfduid=d6ef45c4b47fb2b2c9b2be1b5d8d087a71558517320; expires=Thu, 21-May-20 09:28:40 GMT; path=/; domain=.csgobober.ru; HttpOnly; Secure
Last-Modified: Sun, 12 May 2019 16:51:27 GMT
Etag: "5a8e00-588b39c56a1c0"
Accept-Ranges: bytes
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 4dadc2e79f1fd101-TXL


--- Additional Info ---
Magic:  PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Size:   5934592
Md5:    4aa897146e9c624c669ebd34a877dc32
Sha1:   1fb46be3a271e97b4219029a6b697573870d6494
Sha256: 8c416cd5a3cca049abe0831163fca0219a9fbb58425c2b10d11edd99bd0723bf

Alerts:
  Blacklists:
    - fortinet: Malware