Report - 85.209.134.186/download/7z2401-x64.msix

Report Overview

Visited public
2024-10-31 16:24:07
Tags
URL
85.209.134.186/download/7z2401-x64.msix
Finishing URL
about:privatebrowsing
IP / ASN
85.209.134.186
#41745 Baykov Ilya Sergeevich
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
85.209.134.186	unknown	unknown	No data	No data	409 B	10 MB	85.209.134.186

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Mnemonic Secure DNS

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-10-31	medium	85.209.134.186	Sinkholed

ThreatFox

Scan Date	Severity	Indicator	Alert
2024-10-29	medium	85.209.134.186	NetSupportManager RAT

Files detected

URL
85.209.134.186/download/7z2401-x64.msix
IP
85.209.134.186
ASN
#44477 Stark Industries Solutions Ltd

File type
Zip archive data, at least v4.5 to extract, compression method=deflate
Size
10 MB (10330375 bytes)
Hash
dfaace3296fabb7f9652fb36756a4b51
65e87e3efdc905c49198ddb97110f54d0a306a8f
84f2d273623efb6cdd126a89c1f9567e8977d21ffe684758dd722a27d2d53aa9

Archive (44)

Filename

Md5

File type

Registry.dat

e12b8e929ac230dc00ae39d83a1293ef

MS Windows registry file, NT/2000 or above

User.dat

20c8f039fe8ec000083b0d0c76247332

MS Windows registry file, NT/2000 or above

logo.png

19fc1a72d1446a66b032e23b6d4af313

PNG image data, 225 x 225, 8-bit colormap, non-interlaced

config.json

09cf64c0f6b1ce234a337e9b1998ec8e

JSON text data

fedxrtdxt.ps1

3e390f3b3ca7d3716775f832c93fb1b1

ASCII text

PsfLauncher32.exe

e005414b82df848717581bd260725b02

PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

PsfLauncher64.exe

bfcb4275530e99a5e3fca4614a645fb5

PE32+ executable (GUI) x86-64, for MS Windows, 7 sections

PsfRunDll32.exe

96376177175a1b23a95c6498e9ffb2b5

PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

PsfRunDll64.exe

8466f69926a22670dcf6515a4fc3c054

PE32+ executable (GUI) x86-64, for MS Windows, 7 sections

PsfRuntime32.dll

a9f0eeb621dd5883258113cc4b490929

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 8 sections

PsfRuntime64.dll

61863b4c1aeefe10d69f54c03d373fd5

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 10 sections

Resources.pri

ce102c4b1736bf61f34e14f0173fee89

data

StartingScriptWrapper.ps1

da5bf3010154020db9db4cf8832b42ea

ASCII text, with CRLF line terminators

13.exe

e58073e04563ee374ac9d33d64292b12

PE32 executable (console) Intel 80386, for MS Windows, 6 sections

7za.dll

ef65428f79e120e5fc10e3eecb843d17

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

7zxa.dll

5c4408747f4bb3e3e65669004db8f8ec

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

7-ZipFar.dll

75e8535d87e708b53f20d0bb4707129f

PE32+ executable (DLL) (GUI) Aarch64, for MS Windows, 6 sections

7za.dll

ae6a4f422e16e45b5dd0ab6da1a82d8e

PE32+ executable (DLL) (GUI) Aarch64, for MS Windows, 6 sections

7za.exe

8f456c574478339fb77ad580b50998ad

PE32+ executable (console) Aarch64, for MS Windows, 6 sections

7zxa.dll

afbf2157c80490945745f6367abb5528

PE32+ executable (DLL) (GUI) Aarch64, for MS Windows, 6 sections

7-ZipEng.hlf

4d6f189cbb89bda3d202e72d3a6460ec

ASCII text, with CRLF line terminators

7-ZipEng.lng

3162638b475f8674db5ad3c2af15d2ed

ASCII text, with CRLF line terminators

7-ZipFar.dll

d04533fdbb455465721f437a2d849b8b

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 6 sections

7-ZipFar64.dll

f8c737ca365dbbae5e0010e75bd641b3

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

7-ZipRus.hlf

b3c605a5aebda78e12e39fc873470d04

Non-ISO extended-ASCII text, with CRLF line terminators

7-ZipRus.lng

8c389a621e0786a41c8619b02d70b005

Non-ISO extended-ASCII text, with CRLF, NEL line terminators

7zToFar.ini

a7656301a8349c626452ea76cac9fa33

Generic INItialization configuration [rpm]

far7z.reg

6f60a13b4574fcdc675d21054499b85d

Windows Registry text (Win95 or above)

far7z.txt

7b2d14f1cd85dcdf098cf909749c48a8

ASCII text, with CRLF line terminators

GoogleChrome2.7z

99732fb703c4d1e51ddabde2c96975e8

7-zip archive data, version 0.4

history.txt

adad8b0e892b4be1518445ddfa0fc8dc

ASCII text, with CRLF line terminators

License.txt

8cd6549be1b079383db37b8c1f0809bc

ASCII text, with CRLF line terminators

readme.txt

c46bfaa3cacec7aa8cf1725c95cecddf

ASCII text, with CRLF line terminators

7za.dll

967497e77171ac87ce0d9a306a7702b5

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

7za.exe

33aaf6621cc4b441c335327c1e02a952

PE32+ executable (console) x86-64, for MS Windows, 6 sections

7zxa.dll

5eab00f912824ebdc5aa47ebe863b63e

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

7z24083.7z

a10bbf6b0687ceeee2cc9782b79855bf

7-zip archive data, version 0.4

PsfRunDll64.exe

8466f69926a22670dcf6515a4fc3c054

PE32+ executable (GUI) x86-64, for MS Windows, 7 sections

ChromeSetup.exe

7f2273135df8865fa28d7d358a2693e0

PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

AppxManifest.xml

ad6e89d717ce4a333ed645ac34389b58

XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (454), with CRLF line terminators

AppxBlockMap.xml

9cb347ccc5e91962e22210daed8a13eb

XML 1.0 document, ASCII text, with very long lines (22744), with CRLF line terminators

[Content_Types].xml

70111c27f9e56191c52aec0b9f1bad19

XML 1.0 document, ASCII text, with very long lines (1140), with CRLF line terminators

CodeIntegrity.cat

0b6bad9c02b698aa7027fe06df8d3b31

DER Encoded PKCS#7 Signed Data

AppxSignature.p7x

f148423811b0952cacfade0948c48fda

data

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	pe_detect_tls_callbacks
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	pe_detect_tls_callbacks
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	TTP_Impersonating_Google_Updates_March2024
VirusTotal	malicious	VirusTotal - Scan result 11/57

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

85.209.134.186/download/7z2401-x64.msix

85.209.134.186

200 OK

10 MB

URL User Request GET HTTP/1.1
85.209.134.186/download/7z2401-x64.msix
IP
85.209.134.186:80
ASN
#44477 Stark Industries Solutions Ltd

File type
Zip archive data, at least v4.5 to extract, compression method=deflate
Size
10 MB (10330375 bytes)
Hash
dfaace3296fabb7f9652fb36756a4b51
65e87e3efdc905c49198ddb97110f54d0a306a8f
84f2d273623efb6cdd126a89c1f9567e8977d21ffe684758dd722a27d2d53aa9

Detections

Analyzer	Verdict	Alert
ThreatFox	malicious	NetSupportManager RAT
Quad9 DNS	malicious	Sinkholed
VirusTotal	malicious	VirusTotal - Scan result 11/57

HTTP Headers

GET /download/7z2401-x64.msix HTTP/1.1
Host: 85.209.134.186
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 31 Oct 2024 16:23:40 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Tue, 29 Oct 2024 09:43:55 GMT
ETag: "9da107-6259a6c740cc0"
Accept-Ranges: bytes
Content-Length: 10330375
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Mnemonic Secure DNS

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (44)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers