Report - static.updatestar.com/dl/combofix/ComboFix.exe

Report Overview

Visited public
2024-08-25 04:18:21
Tags
Submit Tags
URL
static.updatestar.com/dl/combofix/ComboFix.exe
Finishing URL
about:privatebrowsing
IP / ASN
5.35.253.150
#8972 Host Europe GmbH
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r11.o.lencr.org	unknown	2020-06-29	2024-06-07 07:43:57	2024-08-24 18:12:09	2.0 kB	5.3 kB	2.23.172.201
static.updatestar.com	unknown	2007-01-18	2012-11-01 00:42:42	2024-04-18 09:43:25	500 B	5.6 MB	5.35.253.150
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-08-24 18:12:06	981 B	2.7 kB	23.36.76.226

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (10)

URL IP Response Size

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
0116304cb4b20e1766015ee4e636662f
c2b93f53852c06a7a9648a817818c0d5a7011898
8d8503dca377a8430cd883acdec16a62201f61ff923847bb95cd00b4b5b76dee

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "8D8503DCA377A8430CD883ACDEC16A62201F61FF923847BB95CD00B4B5B76DEE"
Last-Modified: Fri, 23 Aug 2024 14:36:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3302
Expires: Sun, 25 Aug 2024 05:12:57 GMT
Date: Sun, 25 Aug 2024 04:17:55 GMT
Connection: keep-alive

r11.o.lencr.org/

2.23.172.201

504 B

URL
r11.o.lencr.org/
IP
2.23.172.201:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
a081f9755218e081db962afea1117844
fab4e95becdbacea971038e8f0ea80b4e1064e4b
db03b08d76424bb0dd34b51c11cf222b9126bd1f6017afd35cb1c2d0c3d1f86e

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "DB03B08D76424BB0DD34B51C11CF222B9126BD1F6017AFD35CB1C2D0C3D1F86E"
Last-Modified: Fri, 23 Aug 2024 14:33:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3178
Expires: Sun, 25 Aug 2024 05:10:53 GMT
Date: Sun, 25 Aug 2024 04:17:55 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
515f455d93caad6521481d99fc23e623
cb770c44b3e280f2151b3f5e887d61fbe0ef66fb
cf43d0127c72bf58a1799b4e7ce0e5c9e18ec12e978df6dac9c17920a20173d5

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "CF43D0127C72BF58A1799B4E7CE0E5C9E18EC12E978DF6DAC9C17920A20173D5"
Last-Modified: Fri, 23 Aug 2024 14:37:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3322
Expires: Sun, 25 Aug 2024 05:13:17 GMT
Date: Sun, 25 Aug 2024 04:17:55 GMT
Connection: keep-alive

GET static.updatestar.com/dl/combofix/ComboFix.exe

5.35.253.150

200 OK

5.6 MB

URL User Request GET HTTP/1.1
static.updatestar.com/dl/combofix/ComboFix.exe
IP
5.35.253.150:443
ASN
#8972 Host Europe GmbH

Certificate
IssuerGlobalSign nv-sa
Subject*.updatestar.com
Fingerprint25:56:0B:E2:AE:DB:5C:E1:D3:69:54:7A:84:C3:04:E4:E6:6E:03:6E
ValidityThu, 25 Jul 2024 12:08:21 GMT - Tue, 26 Aug 2025 12:08:20 GMT

File type
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, Nullsoft Installer self-extracting archive, 3 sections
Size
5.6 MB (5601243 bytes)
Hash
268fac2b646087dccb83ed9dccdf684c
ce1cd697e84b620448854333ff500cdc45a73f85
f8f1dbcbd3127642b1cc8a725536df91881430c0d81a9361b643ed38495c29dd

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 7/64

HTTP Headers

GET /dl/combofix/ComboFix.exe HTTP/1.1
Host: static.updatestar.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=31536000
Content-Type: application/octet-stream
Last-Modified: Tue, 09 Dec 2014 08:12:11 GMT
Accept-Ranges: bytes
ETag: "17dd9ed58713d01:0"
Date: Sun, 25 Aug 2024 04:17:21 GMT
Content-Length: 5601243

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
f04a331cae60388b5b3c547bcdd5a8e8
a74ba9ea1965e39a78db26c6568b3524156f0b5c
133a1fe03de9efd148f43efda3cd37d24e4f5cc936d1008a8ce7aacc6653afa3

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "133A1FE03DE9EFD148F43EFDA3CD37D24E4F5CC936D1008A8CE7AACC6653AFA3"
Last-Modified: Fri, 23 Aug 2024 14:38:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20730
Expires: Sun, 25 Aug 2024 10:03:26 GMT
Date: Sun, 25 Aug 2024 04:17:56 GMT
Connection: keep-alive

r11.o.lencr.org/

2.23.172.203

504 B

URL
r11.o.lencr.org/
IP
2.23.172.203:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
f3a7d4b907a16e7e82883be9ff3cc7a4
cb041fb7a99151a86d3449564d72737a53edefba
b9187d8fcc431cee0496985416a1d32f8b4f32f7f454230e012a80db9bd4de1e

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B9187D8FCC431CEE0496985416A1D32F8B4F32F7F454230E012A80DB9BD4DE1E"
Last-Modified: Fri, 23 Aug 2024 14:34:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3874
Expires: Sun, 25 Aug 2024 05:22:31 GMT
Date: Sun, 25 Aug 2024 04:17:57 GMT
Connection: keep-alive

r11.o.lencr.org/

2.23.172.203

504 B

URL
r11.o.lencr.org/
IP
2.23.172.203:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
f3a7d4b907a16e7e82883be9ff3cc7a4
cb041fb7a99151a86d3449564d72737a53edefba
b9187d8fcc431cee0496985416a1d32f8b4f32f7f454230e012a80db9bd4de1e

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B9187D8FCC431CEE0496985416A1D32F8B4F32F7F454230E012A80DB9BD4DE1E"
Last-Modified: Fri, 23 Aug 2024 14:34:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3874
Expires: Sun, 25 Aug 2024 05:22:31 GMT
Date: Sun, 25 Aug 2024 04:17:57 GMT
Connection: keep-alive

r11.o.lencr.org/

2.23.172.203

504 B

URL
r11.o.lencr.org/
IP
2.23.172.203:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
f3a7d4b907a16e7e82883be9ff3cc7a4
cb041fb7a99151a86d3449564d72737a53edefba
b9187d8fcc431cee0496985416a1d32f8b4f32f7f454230e012a80db9bd4de1e

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B9187D8FCC431CEE0496985416A1D32F8B4F32F7F454230E012A80DB9BD4DE1E"
Last-Modified: Fri, 23 Aug 2024 14:34:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3874
Expires: Sun, 25 Aug 2024 05:22:31 GMT
Date: Sun, 25 Aug 2024 04:17:57 GMT
Connection: keep-alive

r11.o.lencr.org/

2.23.172.203

504 B

URL
r11.o.lencr.org/
IP
2.23.172.203:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
f3a7d4b907a16e7e82883be9ff3cc7a4
cb041fb7a99151a86d3449564d72737a53edefba
b9187d8fcc431cee0496985416a1d32f8b4f32f7f454230e012a80db9bd4de1e

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B9187D8FCC431CEE0496985416A1D32F8B4F32F7F454230E012A80DB9BD4DE1E"
Last-Modified: Fri, 23 Aug 2024 14:34:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3874
Expires: Sun, 25 Aug 2024 05:22:31 GMT
Date: Sun, 25 Aug 2024 04:17:57 GMT
Connection: keep-alive

r11.o.lencr.org/

2.23.172.201

504 B

URL
r11.o.lencr.org/
IP
2.23.172.201:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
f3a7d4b907a16e7e82883be9ff3cc7a4
cb041fb7a99151a86d3449564d72737a53edefba
b9187d8fcc431cee0496985416a1d32f8b4f32f7f454230e012a80db9bd4de1e

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B9187D8FCC431CEE0496985416A1D32F8B4F32F7F454230E012A80DB9BD4DE1E"
Last-Modified: Fri, 23 Aug 2024 14:34:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3866
Expires: Sun, 25 Aug 2024 05:22:23 GMT
Date: Sun, 25 Aug 2024 04:17:57 GMT
Connection: keep-alive

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (10)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL