IP 36.248.38.100:0
ASN#4837 CHINA UNICOM China169 Backbone
Hash3b0f118545fbc14725c5674a4981aa04 8475c1f5460ef890929372f23bc8de77301254af 79fd17ed2f9257e359f28c85814524e1d7e44ef98e312effee745c933879a0d5
POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 599
Connection: keep-alive
ctl-cache-status: HIT from hk-xianggang4-ca03, HIT from fj-fuzhou4-ca27
expires: Wed, 03 Apr 2024 17:12:58 GMT
cache-control: max-age=3600
last-modified: Wed, 27 Mar 2024 17:12:59 GMT
age: 2465
x-frame-options: SAMEORIGIN
etag: "8475c1f5460ef890929372f23bc8de77301254af"
cf-cache-status: EXPIRED
accept-ranges: bytes
request-id: 66061ba2af60d13370747c1aa47aca3e
cf-ray: 86b12333a986853b-HKG
date: Fri, 29 Mar 2024 01:38:42 GMT
x-ccacdn-proxy-id: scdpinlb4
via: n172-013-214.fzmp.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 1711676322eb585828a14cf2a4154b8b7d8787dd68
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=7, edge;dur=0
|
IP36.248.38.100:0 ASN#4837 CHINA UNICOM China169 Backbone
Hash3b0f118545fbc14725c5674a4981aa04 8475c1f5460ef890929372f23bc8de77301254af 79fd17ed2f9257e359f28c85814524e1d7e44ef98e312effee745c933879a0d5
POST / HTTP/1.1
Host: ocsp.trust-provider.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: volc-dcdn
Content-Type: application/ocsp-response
Content-Length: 599
Connection: keep-alive
age: 667
ctl-cache-status: HIT from hk-xianggang4-ca03, HIT from he-baoding2-ca02
cache-control: max-age=3600
last-modified: Wed, 27 Mar 2024 17:12:59 GMT
x-ccacdn-proxy-id: scdpinlb4
etag: "8475c1f5460ef890929372f23bc8de77301254af"
x-frame-options: SAMEORIGIN
cf-ray: 86b1dfa688f185d3-HKG
cf-cache-status: REVALIDATED
accept-ranges: bytes
expires: Wed, 03 Apr 2024 17:12:58 GMT
request-id: 66061ba25f6f2d3e84a7ac0e0f582459
date: Fri, 29 Mar 2024 01:38:42 GMT
via: n172-013-213.fzmp.ToB
x-request-ip: 91.90.42.154
x-tt-trace-tag: id=5
x-dsa-trace-id: 171167632261a9ca6f17beb4ccd6661421c84904ad
X-Dsa-Origin-Status: 200
server-timing: cdn-cache;desc=MISS, origin;dur=53, edge;dur=0
|
| nouniversal.driver.160.com/universal/driver/DTLvcredist_2005_x86.exe | 61.240.220.104 | 200 OK | 2.7 MB |
URL User Request GET HTTP/1.1nouniversal.driver.160.com/universal/driver/DTLvcredist_2005_x86.exe IP61.240.220.104:443 ASN#4837 CHINA UNICOM China169 Backbone
CertificateIssuerTrustAsia Technologies, Inc. Subjectnouniversal.driver.160.com FingerprintFC:FB:08:56:B0:CF:22:75:7B:B9:9F:86:19:3B:E3:86:CD:95:E7:16 ValidityMon, 19 Feb 2024 00:00:00 GMT - Thu, 20 Mar 2025 23:59:59 GMT
File typePE32 executable (GUI) Intel 80386, for MS Windows, 3 sections Size2.7 MB (2682880 bytes) Hash1f8e9fec647700b21d45e6cda97c39b7 037288ee51553f84498ae4873c357d367d1a3667 9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161
| Analyzer | Verdict | Alert |
|---|
| YARAhub by abuse.ch | malware | detect_Redline_Stealer |
GET /universal/driver/DTLvcredist_2005_x86.exe HTTP/1.1
Host: nouniversal.driver.160.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Etag: "1f8e9fec647700b21d45e6cda97c39b7"
Content-Type: application/x-msdownload
Date: Wed, 27 Mar 2024 03:38:06 GMT
Server: tencent-cos
x-cos-meta-md5: 1f8e9fec647700b21d45e6cda97c39b7
x-cos-request-id: NjYwMzk0OWVfMzYzNTE2MGJfYmIwMV82NDI4NjRi
x-cos-version-id: null
X-Cache-Lookup: Cache Hit, Hit From Inner Cluster, Cache Miss
Last-Modified: Tue, 22 Oct 2019 02:02:50 GMT
Content-Length: 2682880
Accept-Ranges: bytes
X-NWS-LOG-UUID: 5562069051923727948
Connection: keep-alive
|