| 0-softs.ru/InstallPack.exe?preselecteditems=download-master | 195.201.247.90 | 302 Moved Temporarily | 138 B |
URL User Request GET HTTP/1.10-softs.ru/InstallPack.exe?preselecteditems=download-master IP195.201.247.90:443 ASN#24940 Hetzner Online GmbH
CertificateIssuerLet's Encrypt Subject0-softs.ru Fingerprint1B:20:9B:6E:A6:B4:60:6D:A8:82:F0:D5:62:30:2C:76:57:86:43:23 ValidityMon, 11 Mar 2024 08:52:38 GMT - Sun, 09 Jun 2024 08:52:37 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hashaff950cab4c0265e21d401db15f1026d f03e18461817f7a6546c8bf8fa8d686d7e30aca0 753e0dd54f28c4f7009b9c0b18a68aed175416bd8b7d134858264586eaac56f0
GET /InstallPack.exe?preselecteditems=download-master HTTP/1.1
Host: 0-softs.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Thu, 25 Apr 2024 00:26:50 GMT
Content-Type: text/html
Content-Length: 138
Connection: keep-alive
Location: https://scdn.0-softs.ru/10.html?parameter=InstallPack.exe&preselecteditems=download-master
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
|
| scdn.0-softs.ru/10.html?parameter=InstallPack.exe&preselecteditems=download-master | 195.201.247.90 | 302 Moved Temporarily | 0 B |
URL User Request GET HTTP/1.1scdn.0-softs.ru/10.html?parameter=InstallPack.exe&preselecteditems=download-master IP195.201.247.90:443 ASN#24940 Hetzner Online GmbH
CertificateIssuerLet's Encrypt Subject0-softs.ru Fingerprint1B:20:9B:6E:A6:B4:60:6D:A8:82:F0:D5:62:30:2C:76:57:86:43:23 ValidityMon, 11 Mar 2024 08:52:38 GMT - Sun, 09 Jun 2024 08:52:37 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /10.html?parameter=InstallPack.exe&preselecteditems=download-master HTTP/1.1
Host: scdn.0-softs.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Thu, 25 Apr 2024 00:26:51 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: mvwtl=cB8cADEwAAIAkgBLoylm__9LoylmQAABAAAAS6MpZgA-; expires=Fri, 25-Apr-2025 00:26:51 GMT; path=/; domain=scdn.0-softs.ru
Location: https://ip.apps-windows.com/InstallPack.exe?preselecteditems=download-master&cid=&uid=&type=ip&ga_ci=blknstl_ruopera&singleRename=1&sign=1&ga_an=&ga_cn=&ga_cs=&ga_cm=&ga_ck=&ga_cc=&utm_source=&utm_campaign=&utm_medium=&uagent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A96.0%29+Gecko%2F20100101+Firefox%2F96.0&abs=1&hash=a4d216ad85cd01da23732e4148b48b389ba24fd4
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
|
| ip.apps-windows.com/InstallPack.exe?preselecteditems=download-master&cid=&uid=&type=ip&ga_ci=blknstl_ruopera&singleRename=1&sign=1&ga_an=&ga_cn=&ga_cs=&ga_cm=&ga_ck=&ga_cc=&utm_source=&utm_campaign=&utm_medium=&uagent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A96.0%29+Gecko%2F20100101+Firefox%2F96.0&abs=1&hash=a4d216ad85cd01da23732e4148b48b389ba24fd4 | 195.201.247.90 | 200 OK | 2.8 MB |
URL User Request GET HTTP/1.1ip.apps-windows.com/InstallPack.exe?preselecteditems=download-master&cid=&uid=&type=ip&ga_ci=blknstl_ruopera&singleRename=1&sign=1&ga_an=&ga_cn=&ga_cs=&ga_cm=&ga_ck=&ga_cc=&utm_source=&utm_campaign=&utm_medium=&uagent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A96.0%29+Gecko%2F20100101+Firefox%2F96.0&abs=1&hash=a4d216ad85cd01da23732e4148b48b389ba24fd4 IP195.201.247.90:443 ASN#24940 Hetzner Online GmbH
CertificateIssuerLet's Encrypt Subjectapps-windows.com FingerprintA6:9F:49:B5:4C:B3:8A:6F:D9:72:B1:BE:12:8D:82:E4:35:DD:6D:4E ValidityMon, 11 Mar 2024 08:52:58 GMT - Sun, 09 Jun 2024 08:52:57 GMT
File typePE32 executable (GUI) Intel 80386, for MS Windows, 4 sections Size2.8 MB (2798952 bytes) Hashbaa78c13118af3017dafd36b97d1b89e 231662e6811d01bb2416b4a64d95546207d03529 c846848cfced033564a72405b36f1aa9e51df17280e177387b39127b8ae80627
Analyzer | Verdict | Alert | Public Nextron YARA rules | malware | Detects suspicious SFX as used by Gamaredon group | VirusTotal | malicious | |
GET /InstallPack.exe?preselecteditems=download-master&cid=&uid=&type=ip&ga_ci=blknstl_ruopera&singleRename=1&sign=1&ga_an=&ga_cn=&ga_cs=&ga_cm=&ga_ck=&ga_cc=&utm_source=&utm_campaign=&utm_medium=&uagent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A96.0%29+Gecko%2F20100101+Firefox%2F96.0&abs=1&hash=a4d216ad85cd01da23732e4148b48b389ba24fd4 HTTP/1.1
Host: ip.apps-windows.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 25 Apr 2024 00:26:51 GMT
Content-Type: application/octet-stream
Content-Length: 2798952
Last-Modified: Mon, 16 Jan 2023 08:24:30 GMT
Connection: keep-alive
Content-Disposition: attachment; filename="Download-Master_InstallPack_2ac9fd.exe"
ETag: "63c509be-2ab568"
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Methods: GET
Access-Control-Expose-Headers: Content-Disposition
Accept-Ranges: bytes
|
| aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml | 35.244.181.201 | | 444 B |
URL aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml IP35.244.181.201:0 ASN#396982 GOOGLE-CLOUD-PLATFORM
File typeXML 1.0 document, ASCII text, with very long lines (332) Hash3b324dec137a87ef7e24a30a65b13dd0 c0faa95b2f1018e264b3a14aaf50d1003e6c27b3 6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463
GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-06-09-11-51-10.chain; p384ecdsa=0wh9TPQDhA60PoEsBYy_5Vf0Z-CnkIaasDgVYzo1ZSkLqidxUia6DbhP1NPq64iSEgXbu9lEARWTnazDN2XbpK0DDy1H3YcM6EsygI58953XLb4YSwYBmyeZ4tI-NxrE
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
date: Thu, 25 Apr 2024 00:25:45 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 84
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2
|