{"report_id":"1cd1bdb9-72f4-43a2-86f3-42a79ad76168","version":6,"status":"done","tags":[],"date":"2024-11-15T02:43:58Z","url":{"schema":"http","addr":"download.passwordlastic.com/winlastic.zip","fqdn":"download.passwordlastic.com","domain":"passwordlastic.com","tld":"com"},"ip":{"addr":"188.114.96.1","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"about","addr":"about:privatebrowsing","fqdn":"","domain":"","tld":""},"title":"about:privatebrowsing"},"submit":{"url":{"schema":"","addr":"","fqdn":"","domain":"","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":""},"tags":null,"meta":null},"settings":{"access":"public","device_type":"","expires_at":"2027-01-24T02:43:57Z","useragent":"Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"download.passwordlastic.com","ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"The Netherlands","country_code":"NL"},"domain_registered":"2010-07-10","domain_rank":0,"first_seen":"2012-05-26T07:09:53Z","last_seen":"2024-11-14T01:10:22.492602Z","alert_count":0,"request_count":1,"received_data":12501419,"sent_data":495,"comment":"","tags":null,"fingerprints":null}],"files":[{"md5":"405964bcafbc193b4d7d1cdeaa00c6c1","sha1":"543ed096b1b57c6f09a8b0507e326840d833a319","sha256":"4551ea8d02fcb5f723c4dd98177d59144633bc4d4322fa11707256a834e67af8","sha512":"e629047d13d66aab7ee1e7673ea67a415a4566d8105c651c0bb7e2d276f81f0c3f4da257ab62303ded8c4d147a80a6647d2ff0059fc1c5d67443f3e2726fae69","magic":"Zip archive data, at least v2.0 to extract, compression method=deflate","size":12500377,"url":{"schema":"https","addr":"download.passwordlastic.com/winlastic.zip","fqdn":"download.passwordlastic.com","domain":"passwordlastic.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"The Netherlands","country_code":"NL"},"archive":[{"path":"WINLastic12.exe","filename":"WINLastic12.exe","modified":"","Modified":"2014-11-03T17:25:32Z","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections","size":12524495,"md5":"fcb00b724c37e8669a9b7a637a7a9b17","sha1":"2e3a008bd0719fd2ac9b6364962b9e9efe4a0937","sha256":"f9393b84c3774fb75ebfd37839ad089f946c986af868bfd75c1adbfffc69bcc6","sha512":"8525683d3db9a1202a4aeb8795afc58d99d9ead020690d10a864f2366e53e37beb4ec6a46fb54e775c83132007746dc05221466feb7221ac2af16a9188f1ba5d","alerts":{"urlquery":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"YARAhub by abuse.ch","scan_date":"2024-11-15","alert":"Scans presence of the found strings using the in-house brute force method","trigger":"WINLastic12.exe","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"Byambaa@pubcert.mn","date":"2024-10-01","description":"Scans presence of the found strings using the in-house brute force method","rule":"ScanStringsInsocks5systemz","yarahub_license":"CC0 1.0","yarahub_reference_md5":"73875E9DA68182B09BC6A7FAAFFF67D8","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"cd061b79-9264-480a-bda6-2242046143d5"}}]}},{"path":"ReadMe.txt","filename":"ReadMe.txt","modified":"","Modified":"2014-10-15T11:36:36Z","magic":"ASCII text, with CRLF line terminators","size":880,"md5":"3b98eff838e9580cc7e71638767914a4","sha1":"eaf22ac9a700cf9aea99c74ff02b082858a9f615","sha256":"f08f3f8b58c0bc7e5a71484132dc482e0783393712a1b3c609eae8dd6a329ab9","sha512":"5594a83f38e620584b2960f86d0732e8bec016c4a486525ce992a7be97741dc8ab2cd53f893f51532fc265fe5c49040fdc98a1cce058280f6be9dfe876b4231c","alerts":{"urlquery":null,"analyzer":null}}],"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"YARAhub by abuse.ch","scan_date":"2024-11-15","alert":"Scans presence of the found strings using the in-house brute force method","trigger":"WINLastic12.exe","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"Byambaa@pubcert.mn","date":"2024-10-01","description":"Scans presence of the found strings using the in-house brute force method","rule":"ScanStringsInsocks5systemz","yarahub_license":"CC0 1.0","yarahub_reference_md5":"73875E9DA68182B09BC6A7FAAFFF67D8","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"cd061b79-9264-480a-bda6-2242046143d5"}}]}}],"artifacts":{"windows_shortcuts":null,"files":[{"md5":"405964bcafbc193b4d7d1cdeaa00c6c1","sha1":"543ed096b1b57c6f09a8b0507e326840d833a319","sha256":"4551ea8d02fcb5f723c4dd98177d59144633bc4d4322fa11707256a834e67af8","sha512":"e629047d13d66aab7ee1e7673ea67a415a4566d8105c651c0bb7e2d276f81f0c3f4da257ab62303ded8c4d147a80a6647d2ff0059fc1c5d67443f3e2726fae69","magic":"Zip archive data, at least v2.0 to extract, compression method=deflate","size":12500377,"url":{"schema":"https","addr":"download.passwordlastic.com/winlastic.zip","fqdn":"download.passwordlastic.com","domain":"passwordlastic.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"The Netherlands","country_code":"NL"},"archive":[{"path":"WINLastic12.exe","filename":"WINLastic12.exe","modified":"","Modified":"2014-11-03T17:25:32Z","magic":"PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections","size":12524495,"md5":"fcb00b724c37e8669a9b7a637a7a9b17","sha1":"2e3a008bd0719fd2ac9b6364962b9e9efe4a0937","sha256":"f9393b84c3774fb75ebfd37839ad089f946c986af868bfd75c1adbfffc69bcc6","sha512":"8525683d3db9a1202a4aeb8795afc58d99d9ead020690d10a864f2366e53e37beb4ec6a46fb54e775c83132007746dc05221466feb7221ac2af16a9188f1ba5d","alerts":{"urlquery":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"YARAhub by abuse.ch","scan_date":"2024-11-15","alert":"Scans presence of the found strings using the in-house brute force method","trigger":"WINLastic12.exe","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"Byambaa@pubcert.mn","date":"2024-10-01","description":"Scans presence of the found strings using the in-house brute force method","rule":"ScanStringsInsocks5systemz","yarahub_license":"CC0 1.0","yarahub_reference_md5":"73875E9DA68182B09BC6A7FAAFFF67D8","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"cd061b79-9264-480a-bda6-2242046143d5"}}]}},{"path":"ReadMe.txt","filename":"ReadMe.txt","modified":"","Modified":"2014-10-15T11:36:36Z","magic":"ASCII text, with CRLF line terminators","size":880,"md5":"3b98eff838e9580cc7e71638767914a4","sha1":"eaf22ac9a700cf9aea99c74ff02b082858a9f615","sha256":"f08f3f8b58c0bc7e5a71484132dc482e0783393712a1b3c609eae8dd6a329ab9","sha512":"5594a83f38e620584b2960f86d0732e8bec016c4a486525ce992a7be97741dc8ab2cd53f893f51532fc265fe5c49040fdc98a1cce058280f6be9dfe876b4231c","alerts":{"urlquery":null,"analyzer":null}}],"alerts":{"urlquery":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"","description":"YARAhub by abuse.ch","scan_date":"2024-11-15","alert":"Scans presence of the found strings using the in-house brute force method","trigger":"WINLastic12.exe","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"Byambaa@pubcert.mn","date":"2024-10-01","description":"Scans presence of the found strings using the in-house brute force method","rule":"ScanStringsInsocks5systemz","yarahub_license":"CC0 1.0","yarahub_reference_md5":"73875E9DA68182B09BC6A7FAAFFF67D8","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"cd061b79-9264-480a-bda6-2242046143d5"}}]}}],"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":[{"sensor_name":"infosec_yara","type":"yara","description":"Public InfoSec YARA rules","link":"","alerts":null},{"sensor_name":"openphish","type":"url","description":"OpenPhish","link":"","alerts":null},{"sensor_name":"phishtank","type":"url","description":"PhishTank","link":"","alerts":null},{"sensor_name":"mnemonic_dns","type":"domain","description":"Mnemonic Secure DNS","link":"","alerts":null},{"sensor_name":"quad9","type":"domain","description":"Quad9 DNS","link":"","alerts":null},{"sensor_name":"threatfox","type":"url","description":"ThreatFox","link":"","alerts":null}],"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"download.passwordlastic.com/winlastic.zip","fqdn":"download.passwordlastic.com","domain":"passwordlastic.com","tld":"com"},"ip":{"addr":"188.114.97.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2024-11-15T02:43:31.021Z","timestamp":1731638611021,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"passwordlastic.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 08 Oct 2024 03:02:37 GMT","end":"Mon, 06 Jan 2025 03:02:36 GMT"},"fingerprint":{"sha1":"B8:D5:AF:55:90:D0:65:F6:B3:0E:B0:2B:0B:75:0D:85:34:91:17:95","sha256":"FD:4E:1F:20:7C:C3:D2:A0:CE:BF:1B:18:DB:B0:F5:BE:07:5C:33:1A:7D:A1:F7:02:0A:1B:C9:6B:E4:D0:50:61"}}},"request":{"raw":"GET /winlastic.zip HTTP/1.1\r\nHost: download.passwordlastic.com\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 15 Nov 2024 02:43:31 GMT\r\ncontent-type: application/zip\r\ncontent-length: 12500377\r\ncf-ray: 8e2be4e79af5569a-OSL\r\ncf-cache-status: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=691200\r\netag: \"bebd99-59eb607210483\"\r\nexpires: Fri, 22 Nov 2024 02:43:31 GMT\r\nlast-modified: Sun, 16 Feb 2020 18:58:44 GMT\r\nstrict-transport-security: max-age=31536000; preload\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=NZHJvA6DoQst3L%2F04oXqollWZzCuSCirpgRW11%2B9WYTOEBJYAou8MhP4xrDKswmB6QYNhco8tliyDkPgFe1gjYgiKpIAF0jmIjqzjWXDwBhdpFm%2FLNI7zxDsmeqlcTt64SUq0YKkjlEmv0pUI60%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=21953\u0026sent=7\u0026recv=11\u0026lost=0\u0026retrans=0\u0026sent_bytes=3216\u0026recv_bytes=1134\u0026delivery_rate=263320\u0026cwnd=254\u0026unsent_bytes=0\u0026cid=2eba9940fe8e32c2\u0026ts=639\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":12500377,"size_decoded":12500377,"mime_type":"application/zip","magic":"Zip archive data, at least v2.0 to extract, compression method=deflate","md5":"405964bcafbc193b4d7d1cdeaa00c6c1","sha1":"543ed096b1b57c6f09a8b0507e326840d833a319","sha256":"4551ea8d02fcb5f723c4dd98177d59144633bc4d4322fa11707256a834e67af8","sha512":"e629047d13d66aab7ee1e7673ea67a415a4566d8105c651c0bb7e2d276f81f0c3f4da257ab62303ded8c4d147a80a6647d2ff0059fc1c5d67443f3e2726fae69","ssdeep":"196608:ukCoiPBqQ0zSvdPQbeWo9HWeoks0vgZOXpQcd7oeWSoOFAqbl6HczKSpF6vZgE:ukUAQEsVJWoIv0YSd7RxFTl6HUFpF6Bt","tlshash":"ecc6336c75e92c2dadfa1f11979cbba6ebac70c04d474cb5f8c9247201ae33527d2a44","first_seen":"2024-11-15T02:44:00.409129Z","last_seen":"2024-11-15T02:44:00.409129Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2117,"timings":{"blocked":114,"dns":67,"connect":17,"send":0,"wait":626,"receive":1262,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}