Report - loader.oxy.st/get/1081acd5abd85692b970457f2ed96858/

Report Overview

Submitted URL
loader.oxy.st/get/1081acd5abd85692b970457f2ed96858/
IP
104.21.234.182
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-18 18:58:40
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
10

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
loader.oxy.st	unknown	2019-11-03	2022-10-19	2024-04-17	505 B	502 kB	104.21.234.183
aus5.mozilla.org	2548	1998-01-24	2015-10-27	2024-04-18	512 B	6.5 kB	35.244.181.201
s1.oxy.st	unknown	2019-11-03	2022-06-04	2024-04-15	754 B	501 kB	104.21.234.183

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	loader.oxy.st/get/1081acd5abd85692b970457f2ed96858/	Detects an SFX archive with automatic script execution
2024-04-18	medium	loader.oxy.st/get/1081acd5abd85692b970457f2ed96858/	Detects win.xorist.
2024-04-18	medium	s1.oxy.st/get.php?cg=czozMjoiNTBkZGQwODdiOGEwYTM0OWYyODg1MzFlMmEzNmZhYjUiOw%2C%2C&n=czoyOToi0J7RiNC40LHQutCwINCW0LXQveKArmducC5leGUiOw%2C%2C&c=czo2NDoiNTczMTE1N2ExZTg2YWJlOTc0ZTRjYWQ5NTZhNTNkZWUyNzk1ZDg3YWE3ZWUyMzIxNWY3ZDRiMjhkYzZiOWU2ZiI7&t=1713466694	Detects an SFX archive with automatic script execution
2024-04-18	medium	s1.oxy.st/get.php?cg=czozMjoiNTBkZGQwODdiOGEwYTM0OWYyODg1MzFlMmEzNmZhYjUiOw%2C%2C&n=czoyOToi0J7RiNC40LHQutCwINCW0LXQveKArmducC5leGUiOw%2C%2C&c=czo2NDoiNTczMTE1N2ExZTg2YWJlOTc0ZTRjYWQ5NTZhNTNkZWUyNzk1ZDg3YWE3ZWUyMzIxNWY3ZDRiMjhkYzZiOWU2ZiI7&t=1713466694	Detects win.xorist.

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
loader.oxy.st/get/1081acd5abd85692b970457f2ed96858/
IP
104.21.234.183
ASN
#13335 CLOUDFLARENET

File type
PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
Size
500 kB (500433 bytes)
Hash
0e33819a10f6d174189c8d71ffb671f1
d617a34a88c424ed60f93ce60f091dd235354ad0
5731157a1e86abe974e4cad956a53dee2795d87aa7ee23215f7d4b28dc6b9e6f

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detects an SFX archive with automatic script execution
Malpedia's yara-signator rules	malware	Detects win.xorist.
YARAhub by abuse.ch	malware	Detects an SFX archive with automatic script execution
Malpedia's yara-signator rules	malware	Detects win.xorist.
VirusTotal	malicious	VirusTotal - Scan result 53/68

URL
s1.oxy.st/get.php?cg=czozMjoiNTBkZGQwODdiOGEwYTM0OWYyODg1MzFlMmEzNmZhYjUiOw%2C%2C&n=czoyOToi0J7RiNC40LHQutCwINCW0LXQveKArmducC5leGUiOw%2C%2C&c=czo2NDoiNTczMTE1N2ExZTg2YWJlOTc0ZTRjYWQ5NTZhNTNkZWUyNzk1ZDg3YWE3ZWUyMzIxNWY3ZDRiMjhkYzZiOWU2ZiI7&t=1713466694
IP
104.21.234.183
ASN
#13335 CLOUDFLARENET

File type
PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
Size
500 kB (500433 bytes)
Hash
0e33819a10f6d174189c8d71ffb671f1
d617a34a88c424ed60f93ce60f091dd235354ad0
5731157a1e86abe974e4cad956a53dee2795d87aa7ee23215f7d4b28dc6b9e6f

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detects an SFX archive with automatic script execution
Malpedia's yara-signator rules	malware	Detects win.xorist.
YARAhub by abuse.ch	malware	Detects an SFX archive with automatic script execution
Malpedia's yara-signator rules	malware	Detects win.xorist.
VirusTotal	malicious	VirusTotal - Scan result 53/68

JavaScript (0)

HTTP Transactions (3)

URL IP Response Size

loader.oxy.st/get/1081acd5abd85692b970457f2ed96858/

104.21.234.183

302 Found

500 kB

URL User Request GET HTTP/2
loader.oxy.st/get/1081acd5abd85692b970457f2ed96858/
IP
104.21.234.183:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectoxy.st
Fingerprint74:0B:EB:CD:BF:37:F8:EE:59:6B:A4:9B:3C:52:2E:D0:AE:4D:83:63
ValidityWed, 03 Apr 2024 06:51:00 GMT - Tue, 02 Jul 2024 06:50:59 GMT

File type
PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
Size
500 kB (500433 bytes)
Hash
0e33819a10f6d174189c8d71ffb671f1
d617a34a88c424ed60f93ce60f091dd235354ad0
5731157a1e86abe974e4cad956a53dee2795d87aa7ee23215f7d4b28dc6b9e6f

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detects an SFX archive with automatic script execution
Malpedia's yara-signator rules	malware	Detects win.xorist.
VirusTotal	malicious	VirusTotal - Scan result 53/68

HTTP Headers

GET /get/1081acd5abd85692b970457f2ed96858/ HTTP/1.1
Host: loader.oxy.st
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Thu, 18 Apr 2024 18:58:14 GMT
content-type: text/html; charset=UTF-8
location: https://s1.oxy.st/get.php?cg=czozMjoiNTBkZGQwODdiOGEwYTM0OWYyODg1MzFlMmEzNmZhYjUiOw%2C%2C&n=czoyOToi0J7RiNC40LHQutCwINCW0LXQveKArmducC5leGUiOw%2C%2C&c=czo2NDoiNTczMTE1N2ExZTg2YWJlOTc0ZTRjYWQ5NTZhNTNkZWUyNzk1ZDg3YWE3ZWUyMzIxNWY3ZDRiMjhkYzZiOWU2ZiI7&t=1713466694
set-cookie: PHPSESSID=hcnlg8mq3v7053h4bu9jbidof4; path=/; domain=.oxy.st
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xuJ4KxwIgVzP7p%2FAn1sbfiAMYbrgS8343fNjykNQyJUJHdwMtuSyQjh0NsFZ%2BK%2Fsf3HnLHajfV14jwZHSFXqe7M5Rfv8gwKtAm0uJs6ryYFTVbOJh07hedBwIfJJx794"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8766e2992b118d71-HEL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

5.8 kB

URL
aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml
IP
35.244.181.201:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
gzip compressed data, max speed, from Unix
Size
5.8 kB (5759 bytes)
Hash
52a1e40d3746c76b0167007994950370
6c5838f16f22c0778bc428242b26ca65bf64683c
5ca94e7f36b9452fe67eeaf4a9898c2003278f9f9151c572b2cc6178afff781a

HTTP Headers

GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Thu, 18 Apr 2024 18:58:33 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-05-20-00-15-28.chain; p384ecdsa=bc-3Uxd1A6Dagt_Lsbz5dspKPxqb9G66CYuBYa-OYwG6NdAvrG-SN92iu8nhgCHPv0vrqJmdk3oemrpM_1WY7oNHKs78Zqz2vCd1vRhWDQvrA_5YPnhOZ8N0DqQ7ecCW
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: MISS
content-encoding: gzip
via: 1.1 google
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2

s1.oxy.st/get.php?cg=czozMjoiNTBkZGQwODdiOGEwYTM0OWYyODg1MzFlMmEzNmZhYjUiOw%2C%2C&n=czoyOToi0J7RiNC40LHQutCwINCW0LXQveKArmducC5leGUiOw%2C%2C&c=czo2NDoiNTczMTE1N2ExZTg2YWJlOTc0ZTRjYWQ5NTZhNTNkZWUyNzk1ZDg3YWE3ZWUyMzIxNWY3ZDRiMjhkYzZiOWU2ZiI7&t=1713466694

104.21.234.183

200 OK

500 kB

URL User Request GET HTTP/2
s1.oxy.st/get.php?cg=czozMjoiNTBkZGQwODdiOGEwYTM0OWYyODg1MzFlMmEzNmZhYjUiOw%2C%2C&n=czoyOToi0J7RiNC40LHQutCwINCW0LXQveKArmducC5leGUiOw%2C%2C&c=czo2NDoiNTczMTE1N2ExZTg2YWJlOTc0ZTRjYWQ5NTZhNTNkZWUyNzk1ZDg3YWE3ZWUyMzIxNWY3ZDRiMjhkYzZiOWU2ZiI7&t=1713466694
IP
104.21.234.183:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectoxy.st
Fingerprint74:0B:EB:CD:BF:37:F8:EE:59:6B:A4:9B:3C:52:2E:D0:AE:4D:83:63
ValidityWed, 03 Apr 2024 06:51:00 GMT - Tue, 02 Jul 2024 06:50:59 GMT

File type
PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
Size
500 kB (500433 bytes)
Hash
0e33819a10f6d174189c8d71ffb671f1
d617a34a88c424ed60f93ce60f091dd235354ad0
5731157a1e86abe974e4cad956a53dee2795d87aa7ee23215f7d4b28dc6b9e6f

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detects an SFX archive with automatic script execution
Malpedia's yara-signator rules	malware	Detects win.xorist.
VirusTotal	malicious	VirusTotal - Scan result 53/68

HTTP Headers

GET /get.php?cg=czozMjoiNTBkZGQwODdiOGEwYTM0OWYyODg1MzFlMmEzNmZhYjUiOw%2C%2C&n=czoyOToi0J7RiNC40LHQutCwINCW0LXQveKArmducC5leGUiOw%2C%2C&c=czo2NDoiNTczMTE1N2ExZTg2YWJlOTc0ZTRjYWQ5NTZhNTNkZWUyNzk1ZDg3YWE3ZWUyMzIxNWY3ZDRiMjhkYzZiOWU2ZiI7&t=1713466694 HTTP/1.1
Host: s1.oxy.st
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=hcnlg8mq3v7053h4bu9jbidof4
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 18 Apr 2024 18:58:14 GMT
content-type: application/octet-stream
content-length: 500433
content-description: File Transfer
content-disposition: attachment; filename=ÐÑÐ¸Ð±ÐºÐ° ÐÐµÐ½â®gnp.exe
content-transfer-encoding: binary
expires: 0
cache-control: must-revalidate, post-check=0, pre-check=0
pragma: public
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CKqz3gugMOFizG6QDMqPLY62U8%2FfIzFsqgTklNQlcJFIf72YMuCoKEj6GbI9ivRITmXdbmImsXyl%2BpWhJBl2rShO3tAMyMh2UtgBwjXG%2B7zUcwZcQvKOFvUA5B4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8766e29a2cf38d71-HEL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Detections

URL

IP

ASN

File type

Size

Hash

Detections

JavaScript (0)

HTTP Transactions (3)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers