| 0-softs.ru/InstallPack.exe?preselecteditems=painttool-sai |  195.201.247.90 | 302 Moved Temporarily | 138 B |
URL User Request GET HTTP/1.10-softs.ru/InstallPack.exe?preselecteditems=painttool-sai IP195.201.247.90:443 ASN#24940 Hetzner Online GmbH
CertificateIssuerLet's Encrypt Subject0-softs.ru FingerprintE7:9B:5D:B6:46:5D:2A:B9:BE:8B:05:C3:E2:68:2B:17:4B:D9:7A:A0 ValidityMon, 04 Sep 2023 07:08:54 GMT - Sun, 03 Dec 2023 07:08:53 GMT
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Hashaff950cab4c0265e21d401db15f1026d f03e18461817f7a6546c8bf8fa8d686d7e30aca0 753e0dd54f28c4f7009b9c0b18a68aed175416bd8b7d134858264586eaac56f0
GET /InstallPack.exe?preselecteditems=painttool-sai HTTP/1.1
Host: 0-softs.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Sun, 24 Sep 2023 02:21:00 GMT
Content-Type: text/html
Content-Length: 138
Connection: keep-alive
Location: https://scdn.0-softs.ru/10.html?parameter=InstallPack.exe&preselecteditems=painttool-sai
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
|
|
| scdn.0-softs.ru/10.html?parameter=InstallPack.exe&preselecteditems=painttool-sai | 195.201.247.90 | 302 Moved Temporarily | 0 B |
URL User Request GET HTTP/1.1scdn.0-softs.ru/10.html?parameter=InstallPack.exe&preselecteditems=painttool-sai IP195.201.247.90:443 ASN#24940 Hetzner Online GmbH
CertificateIssuerLet's Encrypt Subject0-softs.ru FingerprintE7:9B:5D:B6:46:5D:2A:B9:BE:8B:05:C3:E2:68:2B:17:4B:D9:7A:A0 ValidityMon, 04 Sep 2023 07:08:54 GMT - Sun, 03 Dec 2023 07:08:53 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /10.html?parameter=InstallPack.exe&preselecteditems=painttool-sai HTTP/1.1
Host: scdn.0-softs.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Sun, 24 Sep 2023 02:21:01 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: mvwtl=aR8cADEwAAIAkgANnQ9l__8NnQ9lQAABAAAADZ0PZQA-; expires=Mon, 23-Sep-2024 02:21:01 GMT; path=/; domain=scdn.0-softs.ru
Location: https://ip.0-softs.ru/InstallPack.exe?preselecteditems=painttool-sai&cid=&uid=&type=ip&ga_ci=yanewpid&singleRename=1&sign=1&ga_an=&ga_cn=&ga_cs=&ga_cm=&ga_ck=&ga_cc=&utm_source=&utm_campaign=&utm_medium=&uagent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A109.0%29+Gecko%2F20100101+Firefox%2F111.0&abs=1
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
|
|
| 0-softs.ru/ | 195.201.247.90 | | 162 B |
IP195.201.247.90:0 ASN#24940 Hetzner Online GmbH
CertificateIssuerLet's Encrypt Subject0-softs.ru FingerprintE7:9B:5D:B6:46:5D:2A:B9:BE:8B:05:C3:E2:68:2B:17:4B:D9:7A:A0 ValidityMon, 04 Sep 2023 07:08:54 GMT - Sun, 03 Dec 2023 07:08:53 GMT
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Hash4f8e702cc244ec5d4de32740c0ecbd97 3adb1f02d5b6054de0046e367c1d687b6cdf7aff 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET / HTTP/1.1
Host: 0-softs.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sun, 24 Sep 2023 02:21:03 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://0-softs.ru/
|
|
| 0-softs.ru/ | 195.201.247.90 | | 107 B |
IP195.201.247.90:0 ASN#24940 Hetzner Online GmbH
CertificateIssuerLet's Encrypt Subject0-softs.ru FingerprintE7:9B:5D:B6:46:5D:2A:B9:BE:8B:05:C3:E2:68:2B:17:4B:D9:7A:A0 ValidityMon, 04 Sep 2023 07:08:54 GMT - Sun, 03 Dec 2023 07:08:53 GMT
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Hash8eec510e57f5f732fd2cce73df7b73ef 3c0af39ecb3753c5fee3b53d063c7286019eac3b 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
GET / HTTP/1.1
Host: 0-softs.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Sun, 24 Sep 2023 02:21:04 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
|
|
| ip.0-softs.ru/InstallPack.exe?preselecteditems=painttool-sai&cid=&uid=&type=ip&ga_ci=yanewpid&singleRename=1&sign=1&ga_an=&ga_cn=&ga_cs=&ga_cm=&ga_ck=&ga_cc=&utm_source=&utm_campaign=&utm_medium=&uagent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A109.0%29+Gecko%2F20100101+Firefox%2F111.0&abs=1 | 195.201.247.90 | 200 OK | 2.8 MB |
URL User Request GET HTTP/1.1ip.0-softs.ru/InstallPack.exe?preselecteditems=painttool-sai&cid=&uid=&type=ip&ga_ci=yanewpid&singleRename=1&sign=1&ga_an=&ga_cn=&ga_cs=&ga_cm=&ga_ck=&ga_cc=&utm_source=&utm_campaign=&utm_medium=&uagent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A109.0%29+Gecko%2F20100101+Firefox%2F111.0&abs=1 IP195.201.247.90:443 ASN#24940 Hetzner Online GmbH
CertificateIssuerLet's Encrypt Subject0-softs.ru FingerprintE7:9B:5D:B6:46:5D:2A:B9:BE:8B:05:C3:E2:68:2B:17:4B:D9:7A:A0 ValidityMon, 04 Sep 2023 07:08:54 GMT - Sun, 03 Dec 2023 07:08:53 GMT
File typePE32 executable (GUI) Intel 80386, for MS Windows\012- data Size2.8 MB (2799480 bytes) Hash5f9078498963ebf623ba49b80305e7d9 63d673cc10a9cb6e0e92598924171c0430d466a3 0a88c9a568f3b24eb6e3d8cb54c2df16f2ad125ab5f8da97892ce771ec5efc81
| Analyzer | Verdict | Alert |
|---|
| Public Nextron YARA rules | malware | Detects suspicious SFX as used by Gamaredon group | | VirusTotal | malicious | |
GET /InstallPack.exe?preselecteditems=painttool-sai&cid=&uid=&type=ip&ga_ci=yanewpid&singleRename=1&sign=1&ga_an=&ga_cn=&ga_cs=&ga_cm=&ga_ck=&ga_cc=&utm_source=&utm_campaign=&utm_medium=&uagent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A109.0%29+Gecko%2F20100101+Firefox%2F111.0&abs=1 HTTP/1.1
Host: ip.0-softs.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 24 Sep 2023 02:21:04 GMT
Content-Type: application/octet-stream
Content-Length: 2799480
Last-Modified: Fri, 19 May 2023 13:06:34 GMT
Connection: keep-alive
Content-Disposition: attachment; filename="Painttool-Sai_InstallPack_1a1ee5.exe"
ETag: "6467745a-2ab778"
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Methods: GET
Access-Control-Expose-Headers: Content-Disposition
Accept-Ranges: bytes
|
|