Report - msteamslab.pp.ua/inv/lucas.exe

Report Overview

Visited public
2024-06-17 16:45:20
Tags
Submit Tags
URL
msteamslab.pp.ua/inv/lucas.exe
Finishing URL
about:privatebrowsing
IP / ASN
104.21.10.241
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

0

Network Intrusion Detection

0

Threat Detection Systems

0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-06-15 18:30:36	1.6 kB	4.4 kB	23.33.119.57
msteamslab.pp.ua	unknown	2023-12-14	2024-02-16 22:36:28	2024-04-16 02:32:40	484 B	181 kB	104.21.10.241

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (6)

	URL	IP	Response	Size
	r10.o.lencr.org/	23.33.119.57		504 B
URL r10.o.lencr.org/ IP 23.33.119.57:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 5c35a3180482afadf4e89f4cc249fa7b 8a088c184606fe3e4e0da8cd90b6eb5e6d30fb97 146fe131cf8436e3de4832a23b351400b4819dbd9b9716302248d3ab447f000c HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "146FE131CF8436E3DE4832A23B351400B4819DBD9B9716302248D3AB447F000C" Last-Modified: Sat, 15 Jun 2024 13:53:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=13550 Expires: Mon, 17 Jun 2024 20:30:44 GMT Date: Mon, 17 Jun 2024 16:44:54 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.33.119.57		504 B
URL r10.o.lencr.org/ IP 23.33.119.57:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 9d139a09a36fce99ece1fb963d49d2a9 a7d96d8755d02c7204c147daade1b1168a6ddb73 f9a59ebef1ee608c709b274e1c7be1320323232cdc79b17bdbf453a5a5aead09 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "F9A59EBEF1EE608C709B274E1C7BE1320323232CDC79B17BDBF453A5A5AEAD09" Last-Modified: Mon, 17 Jun 2024 11:47:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3798 Expires: Mon, 17 Jun 2024 17:48:13 GMT Date: Mon, 17 Jun 2024 16:44:55 GMT Connection: keep-alive`

	GET msteamslab.pp.ua/inv/lucas.exe	104.21.10.241	200 OK	180 kB
URL User Request GET HTTP/2 msteamslab.pp.ua/inv/lucas.exe IP 104.21.10.241:443 ASN #13335 CLOUDFLARENET Certificate IssuerGoogle Trust Services Subjectmsteamslab.pp.ua Fingerprint2F:B2:A6:26:86:1C:C4:EB:86:89:6C:A0:96:24:23:6E:23:DE:EA:1B ValidityFri, 14 Jun 2024 01:48:16 GMT - Thu, 12 Sep 2024 01:48:15 GMT File type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections Size 180 kB (180224 bytes) Hash 6ac7718e6b8ac2b54f6ad121b1589d99 a767c1ec4476d3b92838797fb2e1c60d3e889b82 2d05370ade59f10919d97bfc68016692ff296ccda239e810da7b86ef2cdfd968 HTTP Headers `GET /inv/lucas.exe HTTP/1.1 Host: msteamslab.pp.ua User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` HTTP/2 200 OK date: Mon, 17 Jun 2024 16:44:55 GMT content-type: application/x-msdownload content-length: 180224 last-modified: Fri, 14 Jun 2024 01:45:15 GMT etag: "2c000-61acfc466e777" cache-control: max-age=14400 cf-cache-status: MISS accept-ranges: bytes report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FIn%2Fq%2F3ZW1Q%2FUZeC%2BPEoCD44%2F6Cs5hPwCW3NyqA%2FBXE7qTtNCRDXEquN2%2BOBoVpFzygGwd6%2FR1d3AGOWRdxoXfP5%2BtskRPi%2FpOjumXj%2B%2FsFC1R%2BNphOxoSw9e1r3X1Z6uKxm"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary: Accept-Encoding server: cloudflare cf-ray: 895481cd8b63b50f-OSL alt-svc: h3=":443"; ma=86400 X-Firefox-Spdy: h2

	r10.o.lencr.org/	23.33.119.57		504 B
URL r10.o.lencr.org/ IP 23.33.119.57:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash ede0b27def700f18bb6d4eb4c1d97352 c802c366cb2eee6b9339349aa21677fdb1bd5fa5 18ffb58da62f40b37a43b0baaceefe8bc3ef83ccdf9ee19ff874ccb0d802c9f2 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "18FFB58DA62F40B37A43B0BAACEEFE8BC3EF83CCDF9EE19FF874CCB0D802C9F2" Last-Modified: Sat, 15 Jun 2024 17:32:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=7175 Expires: Mon, 17 Jun 2024 18:44:32 GMT Date: Mon, 17 Jun 2024 16:44:57 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.33.119.57		504 B
URL r10.o.lencr.org/ IP 23.33.119.57:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash ede0b27def700f18bb6d4eb4c1d97352 c802c366cb2eee6b9339349aa21677fdb1bd5fa5 18ffb58da62f40b37a43b0baaceefe8bc3ef83ccdf9ee19ff874ccb0d802c9f2 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "18FFB58DA62F40B37A43B0BAACEEFE8BC3EF83CCDF9EE19FF874CCB0D802C9F2" Last-Modified: Sat, 15 Jun 2024 17:32:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=7175 Expires: Mon, 17 Jun 2024 18:44:32 GMT Date: Mon, 17 Jun 2024 16:44:57 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.33.119.57		504 B
URL r10.o.lencr.org/ IP 23.33.119.57:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash ede0b27def700f18bb6d4eb4c1d97352 c802c366cb2eee6b9339349aa21677fdb1bd5fa5 18ffb58da62f40b37a43b0baaceefe8bc3ef83ccdf9ee19ff874ccb0d802c9f2 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "18FFB58DA62F40B37A43B0BAACEEFE8BC3EF83CCDF9EE19FF874CCB0D802C9F2" Last-Modified: Sat, 15 Jun 2024 17:32:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=7175 Expires: Mon, 17 Jun 2024 18:44:32 GMT Date: Mon, 17 Jun 2024 16:44:57 GMT Connection: keep-alive`