{"report_id":"000648d8-8a9d-416a-8c89-7ca07080810d","version":6,"status":"done","tags":[],"date":"2024-04-03T01:02:47Z","url":{"schema":"http","addr":"ip.apps-windows.com/InstallPack.exe?preselecteditems=virtualdub\u0026cid=\u0026uid=\u0026type=ip\u0026ga_ci=blknstl_ruopera\u0026singleRename=1\u0026sign=1\u0026ga_an=\u0026ga_cn=\u0026ga_cs=\u0026ga_cm=\u0026ga_ck=\u0026ga_cc=\u0026utm_source=\u0026utm_campaign=\u0026utm_medium=\u0026uagent=Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/112.0.0.0+Safari/537.36+AppEngine-Google;+(+code.google.com/appengine;+appid:+s~virustotalcloud)\u0026abs=1","fqdn":"ip.apps-windows.com","domain":"apps-windows.com","tld":"com"},"ip":{"addr":"195.201.247.90","port":0,"asn":24940,"as":"Hetzner Online GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-25T20:46:03Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"ip.apps-windows.com","ip":{"addr":"195.201.247.90","port":0,"asn":24940,"as":"Hetzner Online GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2018-11-13","domain_rank":0,"first_seen":"2019-02-20 02:31:46","last_seen":"2024-03-28 11:42:16","alert_count":2,"request_count":1,"received_data":2799301,"sent_data":857,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":[{"md5":"7501d485f2602bb23f5bdd9e1c1ba45c","sha1":"65020b17ac53fc7bb4a8db723220f9a2bc11a547","sha256":"915deb6fb5559c5feaf1991f13ecda7f42c6fba8c1ceea99b701ed4ae95b8fd1","sha512":"ab7350fd53bfaa8fc05a2fde30e1a5b9950612b7b74a404db44a18a52c0709e86e428ff51938c096cc3b178f9ab8f4e77fa1825f3ba0cd07afd8622494079673","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","size":2798808,"url":{"schema":"http","addr":"ip.apps-windows.com/InstallPack.exe?preselecteditems=virtualdub\u0026cid=\u0026uid=\u0026type=ip\u0026ga_ci=blknstl_ruopera\u0026singleRename=1\u0026sign=1\u0026ga_an=\u0026ga_cn=\u0026ga_cs=\u0026ga_cm=\u0026ga_ck=\u0026ga_cc=\u0026utm_source=\u0026utm_campaign=\u0026utm_medium=\u0026uagent=Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/112.0.0.0+Safari/537.36+AppEngine-Google;+(+code.google.com/appengine;+appid:+s~virustotalcloud)\u0026abs=1","fqdn":"ip.apps-windows.com","domain":"apps-windows.com","tld":"com"},"ip":{"addr":"195.201.247.90","port":0,"asn":24940,"as":"Hetzner Online GmbH","country":"Germany","country_code":"DE"},"archive":null,"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Public Nextron YARA rules","scan_date":"2024-04-03","alert":"Detects suspicious SFX as used by Gamaredon group","trigger":"ip.apps-windows.com/InstallPack.exe?preselecteditems=virtualdub\u0026cid=\u0026uid=\u0026type=ip\u0026ga_ci=blknstl_ruopera\u0026singleRename=1\u0026sign=1\u0026ga_an=\u0026ga_cn=\u0026ga_cs=\u0026ga_cm=\u0026ga_ck=\u0026ga_cc=\u0026utm_source=\u0026utm_campaign=\u0026utm_medium=\u0026uagent=Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/112.0.0.0+Safari/537.36+AppEngine-Google;+(+code.google.com/appengine;+appid:+s~virustotalcloud)\u0026abs=1","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2018-09-27","description":"Detects suspicious SFX as used by Gamaredon group","hash1":"e3bb02c5985fc64759b9c2d3c5474d46237ce472b4a0101c6313dafa939de5a9","hash2":"0ecf88d4b32895b4819dec3acb62eaaa7035aa6292499d903f76af60fcec0d6a","hash3":"a7a48f5220bd1ebe04de258d71fdd001711c165d162bd45e8cfbe8964eddf01c","hash4":"b6fa4889d8a87d45706d92714d716025bf223c01929755321faac1ab0db94a88","hash5":"7117b39890659c7dd11e15092c5e5ea9495bec0ff2b6e25254f6e343ed6ca33d","hash6":"ec2afb63555986fa55b7f98ae57c57e1138acb404a0dd2fe4f3d315730b9898e","reference":"Internal Research","rule":"SUSP_SFX_RunProgram_WScript"}},{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-04-03","alert":"Scan result 26/71","trigger":"915deb6fb5559c5feaf1991f13ecda7f42c6fba8c1ceea99b701ed4ae95b8fd1","verdict":"malicious","severity":"","comment":"malicious - 26/71","link":"https://www.virustotal.com/gui/file/915deb6fb5559c5feaf1991f13ecda7f42c6fba8c1ceea99b701ed4ae95b8fd1","meta":null}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Public Nextron YARA rules","scan_date":"2024-04-03","alert":"Detects suspicious SFX as used by Gamaredon group","trigger":"ip.apps-windows.com/InstallPack.exe?preselecteditems=virtualdub\u0026cid=\u0026uid=\u0026type=ip\u0026ga_ci=blknstl_ruopera\u0026singleRename=1\u0026sign=1\u0026ga_an=\u0026ga_cn=\u0026ga_cs=\u0026ga_cm=\u0026ga_ck=\u0026ga_cc=\u0026utm_source=\u0026utm_campaign=\u0026utm_medium=\u0026uagent=Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/112.0.0.0+Safari/537.36+AppEngine-Google;+(+code.google.com/appengine;+appid:+s~virustotalcloud)\u0026abs=1","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2018-09-27","description":"Detects suspicious SFX as used by Gamaredon group","hash1":"e3bb02c5985fc64759b9c2d3c5474d46237ce472b4a0101c6313dafa939de5a9","hash2":"0ecf88d4b32895b4819dec3acb62eaaa7035aa6292499d903f76af60fcec0d6a","hash3":"a7a48f5220bd1ebe04de258d71fdd001711c165d162bd45e8cfbe8964eddf01c","hash4":"b6fa4889d8a87d45706d92714d716025bf223c01929755321faac1ab0db94a88","hash5":"7117b39890659c7dd11e15092c5e5ea9495bec0ff2b6e25254f6e343ed6ca33d","hash6":"ec2afb63555986fa55b7f98ae57c57e1138acb404a0dd2fe4f3d315730b9898e","reference":"Internal Research","rule":"SUSP_SFX_RunProgram_WScript"}}]},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"mnemonic_dns","type":"domain","description":"mnemonic secure dns","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"ip.apps-windows.com/InstallPack.exe?preselecteditems=virtualdub\u0026cid=\u0026uid=\u0026type=ip\u0026ga_ci=blknstl_ruopera\u0026singleRename=1\u0026sign=1\u0026ga_an=\u0026ga_cn=\u0026ga_cs=\u0026ga_cm=\u0026ga_ck=\u0026ga_cc=\u0026utm_source=\u0026utm_campaign=\u0026utm_medium=\u0026uagent=Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/112.0.0.0+Safari/537.36+AppEngine-Google;+(+code.google.com/appengine;+appid:+s~virustotalcloud)\u0026abs=1","fqdn":"ip.apps-windows.com","domain":"apps-windows.com","tld":"com"},"ip":{"addr":"195.201.247.90","port":0,"asn":24940,"as":"Hetzner Online GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"","requested_by":"","date":"2024-04-03T01:02:23.276026009Z","timestamp":1712106143276,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /InstallPack.exe?preselecteditems=virtualdub\u0026cid=\u0026uid=\u0026type=ip\u0026ga_ci=blknstl_ruopera\u0026singleRename=1\u0026sign=1\u0026ga_an=\u0026ga_cn=\u0026ga_cs=\u0026ga_cm=\u0026ga_ck=\u0026ga_cc=\u0026utm_source=\u0026utm_campaign=\u0026utm_medium=\u0026uagent=Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/112.0.0.0+Safari/537.36+AppEngine-Google;+(+code.google.com/appengine;+appid:+s~virustotalcloud)\u0026abs=1 HTTP/1.1\r\nHost: ip.apps-windows.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":""},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 03 Apr 2024 01:02:22 GMT\r\nContent-Type: application/octet-stream\r\nContent-Length: 2798808\r\nLast-Modified: Thu, 02 Mar 2023 00:10:56 GMT\r\nConnection: keep-alive\r\nContent-Disposition: attachment; filename=\"Virtualdub_InstallPack_1e0987.exe\"\r\nETag: \"63ffe990-2ab4d8\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: Content-Type\r\nAccess-Control-Allow-Methods: GET\r\nAccess-Control-Expose-Headers: Content-Disposition\r\nAccept-Ranges: bytes\r\n","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":2798808,"size_decoded":2798808,"mime_type":"application/octet-stream","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","md5":"7501d485f2602bb23f5bdd9e1c1ba45c","sha1":"65020b17ac53fc7bb4a8db723220f9a2bc11a547","sha256":"915deb6fb5559c5feaf1991f13ecda7f42c6fba8c1ceea99b701ed4ae95b8fd1","sha512":"ab7350fd53bfaa8fc05a2fde30e1a5b9950612b7b74a404db44a18a52c0709e86e428ff51938c096cc3b178f9ab8f4e77fa1825f3ba0cd07afd8622494079673","ssdeep":"49152:VdW6CPtO5e/dsjaYb/Yny94UD70nqZuzY20krYQEJxLM0sE5xFROnc1Czg:VdyP85e+jaYbwmXzZuWkgxLBencQzg","tlshash":"cfd53364bb8584f5d2d13a350c9d765e81eed30687004edba3e02e6f2a14ed8ee7d2d1","first_seen":"2023-04-06T19:38:04Z","last_seen":"2025-04-07T12:32:38.779391Z","times_seen":4470,"resource_available":false,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"Public Nextron YARA rules","scan_date":"2024-04-03","alert":"Detects suspicious SFX as used by Gamaredon group","trigger":"ip.apps-windows.com/InstallPack.exe?preselecteditems=virtualdub\u0026cid=\u0026uid=\u0026type=ip\u0026ga_ci=blknstl_ruopera\u0026singleRename=1\u0026sign=1\u0026ga_an=\u0026ga_cn=\u0026ga_cs=\u0026ga_cm=\u0026ga_ck=\u0026ga_cc=\u0026utm_source=\u0026utm_campaign=\u0026utm_medium=\u0026uagent=Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/112.0.0.0+Safari/537.36+AppEngine-Google;+(+code.google.com/appengine;+appid:+s~virustotalcloud)\u0026abs=1","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"Florian Roth (Nextron Systems)","date":"2018-09-27","description":"Detects suspicious SFX as used by Gamaredon group","hash1":"e3bb02c5985fc64759b9c2d3c5474d46237ce472b4a0101c6313dafa939de5a9","hash2":"0ecf88d4b32895b4819dec3acb62eaaa7035aa6292499d903f76af60fcec0d6a","hash3":"a7a48f5220bd1ebe04de258d71fdd001711c165d162bd45e8cfbe8964eddf01c","hash4":"b6fa4889d8a87d45706d92714d716025bf223c01929755321faac1ab0db94a88","hash5":"7117b39890659c7dd11e15092c5e5ea9495bec0ff2b6e25254f6e343ed6ca33d","hash6":"ec2afb63555986fa55b7f98ae57c57e1138acb404a0dd2fe4f3d315730b9898e","reference":"Internal Research","rule":"SUSP_SFX_RunProgram_WScript"}},{"sensor_name":"virustotal","sensor_type":"file","title":"","description":"VirusTotal","scan_date":"2024-04-03","alert":"Scan result 26/71","trigger":"915deb6fb5559c5feaf1991f13ecda7f42c6fba8c1ceea99b701ed4ae95b8fd1","verdict":"malicious","severity":"","comment":"malicious - 26/71","link":"https://www.virustotal.com/gui/file/915deb6fb5559c5feaf1991f13ecda7f42c6fba8c1ceea99b701ed4ae95b8fd1","meta":null}],"urlquery":null}}]}