Report - 45.207.168.120:7744/c3p.exe

Report Overview

Visitedpublic

2024-06-21 19:36:22

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-06-20 18:12:07	2.0 kB	5.3 kB	23.36.77.32
45.207.168.120:7744	unknown	unknown	No data	No data	397 B	3.1 MB	45.207.168.120

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-06-21 19:35:58	medium	Client IP	45.207.168.120	ET INFO Executable Download from dotted-quad Host
2024-06-21 19:35:58	high	45.207.168.120	Client IP	ET HUNTING Rejetto HTTP File Sever Response
2024-06-21 19:35:58	medium	45.207.168.120	Client IP	ET HUNTING Terse Named Filename EXE Download - Possibly Hostile
2024-06-21 19:35:58	high	45.207.168.120	Client IP	ET POLICY PE EXE or DLL Windows file download HTTP
2024-06-21 19:35:58	high	45.207.168.120	Client IP	ET EXPLOIT_KIT DRIVEBY Likely Evil EXE with no referer from HFS webserver (used by Unknown EK)
2024-06-21 19:35:58	medium	45.207.168.120	Client IP	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2024-06-21 19:35:58	low	45.207.168.120	Client IP	ET INFO EXE - Served Attached HTTP

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-06-21	medium	45.207.168.120	Sinkholed

ThreatFox

No alerts detected

File detected

URL

45.207.168.120:7744/c3p.exe

IP / ASN

45.207.168.120

#21859 ZEN-ECN

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive, 4 sections

Size3.1 MB (3127301 bytes)

MD502aa02aee2a6bd93a4a8f4941a0e6310

SHA103287a15bfd67ff8c3340c0bae425ecaa37a929f

SHA25601a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 60/72

JavaScript (0)

HTTP Transactions (7)

URL IP Response Size

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-06-20

Last Seen2024-08-19

Times Seen30281

Size504 B (504 bytes)

MD56d997a3e4c838d12e34de2dd2d4208c3

SHA1386abb53e2df86f291b6a86765d9a6feb88ba30b

SHA25632e00abd54407308b80a14e2916a119d95d90b1e7842f8cf0e87df306287869c

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "32E00ABD54407308B80A14E2916A119D95D90B1E7842F8CF0E87DF306287869C"
Last-Modified: Thu, 20 Jun 2024 13:53:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8005
Expires: Fri, 21 Jun 2024 21:49:22 GMT
Date: Fri, 21 Jun 2024 19:35:57 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-06-20

Last Seen2024-08-19

Times Seen34040

Size504 B (504 bytes)

MD5c0fde0756f59aaa5fa85a62f5f528e74

SHA13c2d990e14054ee3b407cc37d77e255533d91ed6

SHA256ca44d6619deb0e020993a84c6bfbf1993bf096b13863b706dc8a826499348276

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "CA44D6619DEB0E020993A84C6BFBF1993BF096B13863B706DC8A826499348276"
Last-Modified: Wed, 19 Jun 2024 23:47:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17293
Expires: Sat, 22 Jun 2024 00:24:10 GMT
Date: Fri, 21 Jun 2024 19:35:57 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-06-19

Last Seen2024-08-19

Times Seen24005

Size504 B (504 bytes)

MD55a3268763aa8247d09e7b12f8a157bb5

SHA1fbddec6e9fb707501596ca331266c50e77e23f5b

SHA2566095004cca6c22ee09c33dc58574519973f162bb1ee183856ed65675281d551c

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "6095004CCA6C22EE09C33DC58574519973F162BB1EE183856ED65675281D551C"
Last-Modified: Wed, 19 Jun 2024 16:21:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7836
Expires: Fri, 21 Jun 2024 21:46:33 GMT
Date: Fri, 21 Jun 2024 19:35:57 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-06-21

Last Seen2024-08-19

Times Seen34714

Size504 B (504 bytes)

MD56720792332fb717894b4e5221fdc3d86

SHA1f79b1d3611fb53cea950acb15000473ae7174149

SHA25667dd6ffe107c77c5f8bea4a3d6771b6026efc51bd4a9b26c66c8791c1ef48965

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "67DD6FFE107C77C5F8BEA4A3D6771B6026EFC51BD4A9B26C66C8791C1EF48965"
Last-Modified: Thu, 20 Jun 2024 17:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2470
Expires: Fri, 21 Jun 2024 20:17:09 GMT
Date: Fri, 21 Jun 2024 19:35:59 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-06-21

Last Seen2024-08-19

Times Seen34714

Size504 B (504 bytes)

MD56720792332fb717894b4e5221fdc3d86

SHA1f79b1d3611fb53cea950acb15000473ae7174149

SHA25667dd6ffe107c77c5f8bea4a3d6771b6026efc51bd4a9b26c66c8791c1ef48965

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "67DD6FFE107C77C5F8BEA4A3D6771B6026EFC51BD4A9B26C66C8791C1EF48965"
Last-Modified: Thu, 20 Jun 2024 17:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2470
Expires: Fri, 21 Jun 2024 20:17:09 GMT
Date: Fri, 21 Jun 2024 19:35:59 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-06-21

Last Seen2024-08-19

Times Seen34714

Size504 B (504 bytes)

MD56720792332fb717894b4e5221fdc3d86

SHA1f79b1d3611fb53cea950acb15000473ae7174149

SHA25667dd6ffe107c77c5f8bea4a3d6771b6026efc51bd4a9b26c66c8791c1ef48965

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "67DD6FFE107C77C5F8BEA4A3D6771B6026EFC51BD4A9B26C66C8791C1EF48965"
Last-Modified: Thu, 20 Jun 2024 17:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2470
Expires: Fri, 21 Jun 2024 20:17:09 GMT
Date: Fri, 21 Jun 2024 19:35:59 GMT
Connection: keep-alive

GET 45.207.168.120:7744/c3p.exe

45.207.168.120

200 OK

3.1 MB

URL

45.207.168.120:7744/c3p.exe

IP / ASN

45.207.168.120

#21859 ZEN-ECN

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive, 4 sections

First Seen2024-06-18

Last Seen2024-08-19

Times Seen2

Size3.1 MB (3127301 bytes)

MD502aa02aee2a6bd93a4a8f4941a0e6310

SHA103287a15bfd67ff8c3340c0bae425ecaa37a929f

SHA25601a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed
VirusTotal	malicious	VirusTotal - Scan result 60/72

HTTP Headers

GET /c3p.exe HTTP/1.1
Host: 45.207.168.120:7744
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 3127301
Accept-Ranges: bytes
Server: HFS 2.3m
Set-Cookie: HFS_SID_=0.979885030770674; path=/; HttpOnly
ETag: 38C48E0964AC2B23A1882885EC1A8BFA
Last-Modified: Wed, 24 Apr 2024 14:35:11 GMT
Content-Disposition: attachment; filename="c3p.exe";