Overview

URL103.133.104.112/244/IE_NETS.exe
IP 103.133.104.112 (Vietnam)
ASN#135905 VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access public lock_open
Report completed2023-05-24 03:21:34 UTC
StatusLoading report..
IDS alerts3
Blocklist alert2
urlquery alerts No alerts detected
Tags None

Domain Summary (1)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
103.133.104.112 (1) 0 No data No data 403 566600 103.133.104.112

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2023-05-24 03:21:19 UTC medium Client IP  103.133.104.112 ET INFO Executable Download from dotted-quad Host 
2023-05-24 03:21:20 UTC high  103.133.104.112 Client IP ET POLICY PE EXE or DLL Windows file download HTTP 
2023-05-24 03:21:20 UTC medium  103.133.104.112 Client IP ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response 

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-05-24 medium 103.133.104.112/244/IE_NETS.exe Malware

mnemonic secure dns
 No alerts detected

Quad9 DNS
Scan Date Severity Indicator Comment
2023-05-23 medium 103.133.104.112 Sinkholed

ThreatFox
 No alerts detected

Files

URL 103.133.104.112/244/IE_NETS.exe
IP  103.133.104.112
Magic PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\012- data
Size 566272
MD5 79d780139b9f4180292803011f674ab3
SHA1 e38348cf1f595a2bbf60d5d0a6410c78d22152c9
SHA256 0a7bc23b245613e96044305e0479d831b55204d5d52a92ea5e7967a312374c5d
Analyzer Scan Date Verdict Comment

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 103.133.104.112
Date UQ / IDS / BL URL IP
2023-06-06 01:06:52 UTC 0 - 0 - 20 103.133.104.112/dashboard/ 103.133.104.112
2023-06-05 22:08:13 UTC 0 - 3 - 2 103.133.104.112/877/hkcmd.exe 103.133.104.112
2023-06-05 22:08:09 UTC 0 - 1 - 2 103.133.104.112/ih/ihihihihihihihihihihihi%23 (...) 103.133.104.112
2023-06-04 23:01:02 UTC 0 - 4 - 2 103.133.104.112/732/hkcmd.exe 103.133.104.112
2023-06-04 23:00:47 UTC 0 - 1 - 2 103.133.104.112/ib/ibibibibibibibii%23%23%23% (...) 103.133.104.112


Last 5 reports on ASN: VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
Date UQ / IDS / BL URL IP
2023-06-06 01:06:52 UTC 0 - 0 - 20 103.133.104.112/dashboard/ 103.133.104.112
2023-06-05 22:08:13 UTC 0 - 3 - 2 103.133.104.112/877/hkcmd.exe 103.133.104.112
2023-06-05 22:08:09 UTC 0 - 1 - 2 103.133.104.112/ih/ihihihihihihihihihihihi%23 (...) 103.133.104.112
2023-06-05 16:42:56 UTC 0 - 1 - 1 14.225.254.203/ 14.225.254.203
2023-06-05 16:23:29 UTC 0 - 0 - 2 103.140.251.122/ 103.140.251.122


Last 5 reports on domain: 103.133.104.112
Date UQ / IDS / BL URL IP
2023-06-06 01:06:52 UTC 0 - 0 - 20 103.133.104.112/dashboard/ 103.133.104.112
2023-06-05 22:08:13 UTC 0 - 3 - 2 103.133.104.112/877/hkcmd.exe 103.133.104.112
2023-06-05 22:08:09 UTC 0 - 1 - 2 103.133.104.112/ih/ihihihihihihihihihihihi%23 (...) 103.133.104.112
2023-06-04 23:01:02 UTC 0 - 4 - 2 103.133.104.112/732/hkcmd.exe 103.133.104.112
2023-06-04 23:00:47 UTC 0 - 1 - 2 103.133.104.112/ib/ibibibibibibibii%23%23%23% (...) 103.133.104.112


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-06-06 05:41:01 UTC 0 - 1 - 0 www.prosoltecnologia.com.br/arquivos/aa_v3.exe 52.67.55.174
2023-06-06 04:22:39 UTC 0 - 1 - 0 minornotes.com/smitrem.exe 66.96.147.168
2023-06-06 04:22:05 UTC 2 - 1 - 1 42.239.254.227:47826/bin.sh 42.239.254.227
2023-06-06 04:15:11 UTC 0 - 5 - 1 107.151.204.57:9985/88999.exe 107.151.204.57
2023-06-06 02:26:30 UTC 0 - 2 - 0 download.suxiazai.com/for_down/2013/new/dlls/ (...) 101.226.27.239

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (1)


Request Response
 
                                        
                                            GET /244/IE_NETS.exe HTTP/1.1 

                                        
                                            
Host: 103.133.104.112 

                                        
                                    
                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
DNT: 1 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache 

                                        
                                            
 

                                        
                                    
                                        
                                             103.133.104.112

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/x-msdownload 

                                            
                                            
                                            

                                            
                                                
Date: Wed, 24 May 2023 03:21:22 GMT 

                                            
                                                
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28 

                                            
                                                
Last-Modified: Wed, 24 May 2023 01:49:43 GMT 

                                            
                                                
ETag: "8a400-5fc66b7bec267" 

                                            
                                                
Accept-Ranges: bytes 

                                            
                                                
Content-Length: 566272 

                                            
                                                
Keep-Alive: timeout=5, max=100 

                                            
                                                
Connection: Keep-Alive 

                                            
                                                
 

                                            
                                            

                                                

                                                --- Additional Info ---

                                                Magic:  PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\012- data

                                                Size:   566272

                                                Md5:    79d780139b9f4180292803011f674ab3

                                                Sha1:   e38348cf1f595a2bbf60d5d0a6410c78d22152c9

                                                Sha256: 0a7bc23b245613e96044305e0479d831b55204d5d52a92ea5e7967a312374c5d

                                        

                                        
                                            

                                            

                                            
                                                Blocklists:

                                                
                                                      - fortinet: Malware

                                                
                                                      - quad9: Sinkholed

                                                
                                            
                                            
                                            
                                                IDS:

                                                
                                                          - ET INFO Executable Download from dotted-quad Host

                                                
                                                          - ET POLICY PE EXE or DLL Windows file download HTTP

                                                
                                                          - ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response