Overview

URL103.133.104.112/329/vbc.exe
IP 103.133.104.112 (Vietnam)
ASN#135905 VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access public lock_open
Report completed2023-05-25 00:47:48 UTC
StatusLoading report..
IDS alerts5
Blocklist alert2
urlquery alerts No alerts detected
Tags None

Domain Summary (1)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
103.133.104.112 (1) 0 No data No data 399 559944 103.133.104.112

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
Timestamp Severity Source IP Destination IP Alert
2023-05-25 00:47:32 UTC high Client IP  103.133.104.112 ETPRO HUNTING Observed Suspicious vbc.exe in URI - Possible Payload Execution  
2023-05-25 00:47:32 UTC medium Client IP  103.133.104.112 ET INFO Executable Download from dotted-quad Host 
2023-05-25 00:47:32 UTC medium Client IP  103.133.104.112 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile 
2023-05-25 00:47:33 UTC high  103.133.104.112 Client IP ET POLICY PE EXE or DLL Windows file download HTTP 
2023-05-25 00:47:33 UTC medium  103.133.104.112 Client IP ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response 

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-05-25 medium 103.133.104.112/329/vbc.exe Malware

mnemonic secure dns
 No alerts detected

Quad9 DNS
Scan Date Severity Indicator Comment
2023-05-25 medium 103.133.104.112 Sinkholed

ThreatFox
 No alerts detected

Files

URL 103.133.104.112/329/vbc.exe
IP  103.133.104.112
Magic PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\012- data
Size 559616
MD5 cad19e2ce89c85ce3e697c78bca5a7e1
SHA1 2f86c3fe745444dd8342cf27c8a3b098f8d7e79e
SHA256 6c68dc2e7ba6c70b48925d1fde1c23d872fd9d5cca7144be2243180f19028984
Analyzer Scan Date Verdict Comment
VirusTotal 2023-05-24 39/71  VirusTotal Report

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 103.133.104.112
Date UQ / IDS / BL URL IP
2023-06-06 01:06:52 UTC 0 - 0 - 20 103.133.104.112/dashboard/ 103.133.104.112
2023-06-05 22:08:13 UTC 0 - 3 - 2 103.133.104.112/877/hkcmd.exe 103.133.104.112
2023-06-05 22:08:09 UTC 0 - 1 - 2 103.133.104.112/ih/ihihihihihihihihihihihi%23 (...) 103.133.104.112
2023-06-04 23:01:02 UTC 0 - 4 - 2 103.133.104.112/732/hkcmd.exe 103.133.104.112
2023-06-04 23:00:47 UTC 0 - 1 - 2 103.133.104.112/ib/ibibibibibibibii%23%23%23% (...) 103.133.104.112


Last 5 reports on ASN: VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
Date UQ / IDS / BL URL IP
2023-06-06 01:06:52 UTC 0 - 0 - 20 103.133.104.112/dashboard/ 103.133.104.112
2023-06-05 22:08:13 UTC 0 - 3 - 2 103.133.104.112/877/hkcmd.exe 103.133.104.112
2023-06-05 22:08:09 UTC 0 - 1 - 2 103.133.104.112/ih/ihihihihihihihihihihihi%23 (...) 103.133.104.112
2023-06-05 16:42:56 UTC 0 - 1 - 1 14.225.254.203/ 14.225.254.203
2023-06-05 16:23:29 UTC 0 - 0 - 2 103.140.251.122/ 103.140.251.122


Last 5 reports on domain: 103.133.104.112
Date UQ / IDS / BL URL IP
2023-06-06 01:06:52 UTC 0 - 0 - 20 103.133.104.112/dashboard/ 103.133.104.112
2023-06-05 22:08:13 UTC 0 - 3 - 2 103.133.104.112/877/hkcmd.exe 103.133.104.112
2023-06-05 22:08:09 UTC 0 - 1 - 2 103.133.104.112/ih/ihihihihihihihihihihihi%23 (...) 103.133.104.112
2023-06-04 23:01:02 UTC 0 - 4 - 2 103.133.104.112/732/hkcmd.exe 103.133.104.112
2023-06-04 23:00:47 UTC 0 - 1 - 2 103.133.104.112/ib/ibibibibibibibii%23%23%23% (...) 103.133.104.112


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-06-06 06:09:38 UTC 0 - 0 - 1 119.86.181.91:8090/xdispatch23cbfc71b703cb75/ (...) 119.86.181.91
2023-06-06 06:08:48 UTC 0 - 4 - 0 cld.pt/dl/download/3b50ab28-24df-4a5e-968a-ea (...) 213.13.26.153
2023-06-06 06:07:47 UTC 0 - 2 - 0 github.com/phoenix125/AtlasServerUpdateUtilit (...) 140.82.121.3
2023-06-06 06:07:33 UTC 0 - 0 - 1 124.73.239.242:8090/xdispatch2256bc517d408cf8 (...) 124.73.239.242
2023-06-06 06:06:32 UTC 0 - 1 - 0 198-244-178-5.xyz/Getintopc.com/ClickCharts_P (...) 198.244.178.5

JavaScript

Executed Scripts (0)

Executed Evals (0)

Executed Writes (0)

HTTP Transactions (1)


Request Response
 
                                        
                                            GET /329/vbc.exe HTTP/1.1 

                                        
                                            
Host: 103.133.104.112 

                                        
                                    
                                        

                                        
                                            
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 

                                        
                                            
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 

                                        
                                            
Accept-Language: en-US,en;q=0.5 

                                        
                                            
Accept-Encoding: gzip, deflate 

                                        
                                            
DNT: 1 

                                        
                                            
Connection: keep-alive 

                                        
                                            
Upgrade-Insecure-Requests: 1 

                                        
                                            
Pragma: no-cache 

                                        
                                            
Cache-Control: no-cache 

                                        
                                            
 

                                        
                                    
                                        
                                             103.133.104.112

                                            
                                                HTTP/1.1 200 OK 

                                            
                                                
Content-Type: application/x-msdownload 

                                            
                                            
                                            

                                            
                                                
Date: Thu, 25 May 2023 00:47:36 GMT 

                                            
                                                
Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28 

                                            
                                                
Last-Modified: Tue, 23 May 2023 02:06:58 GMT 

                                            
                                                
ETag: "88a00-5fc52d7a2ee05" 

                                            
                                                
Accept-Ranges: bytes 

                                            
                                                
Content-Length: 559616 

                                            
                                                
Keep-Alive: timeout=5, max=100 

                                            
                                                
Connection: Keep-Alive 

                                            
                                                
 

                                            
                                            

                                                

                                                --- Additional Info ---

                                                Magic:  PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows\012- data

                                                Size:   559616

                                                Md5:    cad19e2ce89c85ce3e697c78bca5a7e1

                                                Sha1:   2f86c3fe745444dd8342cf27c8a3b098f8d7e79e

                                                Sha256: 6c68dc2e7ba6c70b48925d1fde1c23d872fd9d5cca7144be2243180f19028984

                                        

                                        
                                            

                                            

                                            
                                                Blocklists:

                                                
                                                      - fortinet: Malware

                                                
                                                      - quad9: Sinkholed

                                                
                                                      - virustotal: 39/71

                                                
                                            
                                            
                                            
                                                IDS:

                                                
                                                          - ETPRO HUNTING Observed Suspicious vbc.exe in URI - Possible Payload Execution 

                                                
                                                          - ET INFO Executable Download from dotted-quad Host

                                                
                                                          - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

                                                
                                                          - ET POLICY PE EXE or DLL Windows file download HTTP

                                                
                                                          - ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response