Report Overview
Visitedpublic
2024-11-28 00:14:28
Tags
Submit Tags
URL
80.76.51.231/Samarik
Finishing URL
about:privatebrowsing
IP / ASN
80.76.51.231
Title
about:privatebrowsing
Detections
urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
0
Host Summary
| Host | Rank | Registered | First Seen | Last Seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
80.76.51.231 3 alert(s) on this Host | unknown | unknown | 2022-12-10 | 2024-01-14 | 474 B | 454 kB |  80.76.51.231 |
Related reports
Threat Detection Systems
Public InfoSec YARA rules
| Scan Date | Severity | Indicator | Alert |
|---|---|---|---|
| 2024-11-28 | medium | 80.76.51.231/Samarik | Detects files containing embedded JavaScript; the JS executes a PowerShell command which either downloads IDATLoader in an archive, or an executable (not IDATLoader) which is loaded into memory. The modified PE will only run if it's executed as an HTML Application (.hta). |
OpenPhish
No alerts detected
PhishTank
No alerts detected
Mnemonic Secure DNS
No alerts detected
Quad9 DNS
| Scan Date | Severity | Indicator | Alert |
|---|---|---|---|
| 2024-11-28 | medium | 80.76.51.231 | Sinkholed |
ThreatFox
No alerts detected
File detected
URL
80.76.51.231/Samarik
IP / ASN
80.76.51.231
File Overview
File TypePE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
Size454 kB (453911 bytes)
MD5e8c68f1ef3006a3e728a61893e21c13c
SHA174e10b769e413d5387daa63cd263e01cd9ffde88
Detections
| Analyzer | Verdict | Alert |
|---|---|---|
| YARAhub by abuse.ch | malware | Detects files containing embedded JavaScript; the JS executes a PowerShell command which either downloads IDATLoader in an archive, or an executable (not IDATLoader) which is loaded into memory. The modified PE will only run if it's executed as an HTML Application (.hta). |
| VirusTotal | malicious |
JavaScript (0)
No JavaScripts
HTTP Transactions (1)
| URL | IP | Response | Size |
|---|