Report - encrypthub.net/main/shell.bin

Report Overview

Visited public
2024-11-09 07:46:06
Tags
URL
encrypthub.net/main/shell.bin
Finishing URL
about:privatebrowsing
IP / ASN
185.106.92.91
#214927 Psb Hosting Ltd
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
encrypthub.net	unknown	2024-10-31	2024-11-09	2024-11-09	483 B	4.0 MB	185.106.92.91

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-11-09	medium	encrypthub.net/main/shell.bin	Windows.Trojan.Donutloader

OpenPhish

No alerts detected

PhishTank

No alerts detected

Mnemonic Secure DNS

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-11-09	medium	encrypthub.net	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

encrypthub.net/main/shell.bin

185.106.92.91

200 OK

4.0 MB

URL User Request GET HTTP/1.1
encrypthub.net/main/shell.bin
IP
185.106.92.91:443
ASN
#210281 WAIcore Hosting LTD.

Certificate
IssuerZeroSSL
Subjectencrypthub.net
FingerprintED:93:90:D7:4A:A9:F2:AD:0B:B2:4C:D3:3C:A4:CA:B4:6C:9A:D3:DA
ValidityThu, 31 Oct 2024 00:00:00 GMT - Wed, 29 Jan 2025 23:59:59 GMT

File type
data
Size
4.0 MB (4012327 bytes)
Hash
c904fd1e880549ee227dd442392a27cd
363799a17f77c8b6fa8df9c266301bf1f357a316
2bda4bc34eee61e27d1ef6a5f1af6b9f38496556a1bf23a76ad87d2b0656d470

Detections

Analyzer	Verdict	Alert
Elastic Security YARA Rules	malware	Windows.Trojan.Donutloader
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /main/shell.bin HTTP/1.1
Host: encrypthub.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 09 Nov 2024 07:45:40 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
Last-Modified: Sat, 27 Jul 2024 08:08:54 GMT
ETag: "3d3927-61e362393cced"
Accept-Ranges: bytes
Content-Length: 4012327
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/octet-stream

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Mnemonic Secure DNS

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers