GET installpack.net/InstallPack.exe?preselecteditems=winiso&ga_cn=direct&ga_cs=isg&cid=50393950.88419439
302 Moved Temporarily 138 B URL User Request GET HTTP/1.1 installpack.net/InstallPack.exe?preselecteditems=winiso&ga_cn=direct&ga_cs=isg&cid=50393950.88419439
IP
ASN #49352 Domain names registrar REG.RU, Ltd
Certificate IssuerLet's Encrypt
Subjectinstallpack.net
FingerprintA6:97:52:11:39:E5:48:97:34:A2:20:F8:54:BD:86:B6:82:01:AC:93
ValidityMon, 11 Mar 2024 07:53:55 GMT - Sun, 09 Jun 2024 07:53:54 GMT
File type HTML document, ASCII text, with CRLF line terminators
Hash aff950cab4c0265e21d401db15f1026d
f03e18461817f7a6546c8bf8fa8d686d7e30aca0
753e0dd54f28c4f7009b9c0b18a68aed175416bd8b7d134858264586eaac56f0
GET /InstallPack.exe?preselecteditems=winiso&ga_cn=direct&ga_cs=isg&cid=50393950.88419439 HTTP/1.1
Host: installpack.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Wed, 03 Apr 2024 01:03:12 GMT
Content-Type: text/html
Content-Length: 138
Connection: keep-alive
Location: https://scdn.softcdn.ru/10.html?parameter=InstallPack.exe&preselecteditems=winiso&ga_cn=direct&ga_cs=isg&cid=50393950.88419439
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Origin: *
GET scdn.softcdn.ru/10.html?parameter=InstallPack.exe&preselecteditems=winiso&ga_cn=direct&ga_cs=isg&cid=50393950.88419439
302 Moved Temporarily 0 B URL User Request GET HTTP/1.1 scdn.softcdn.ru/10.html?parameter=InstallPack.exe&preselecteditems=winiso&ga_cn=direct&ga_cs=isg&cid=50393950.88419439
IP
ASN #24940 Hetzner Online GmbH
Certificate IssuerLet's Encrypt
Subjectsoftcdn.ru
Fingerprint1E:15:A4:24:CF:F4:D2:90:53:D6:2A:36:62:CC:7B:4C:54:4E:5A:D4
ValidityMon, 11 Mar 2024 08:54:58 GMT - Sun, 09 Jun 2024 08:54:57 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /10.html?parameter=InstallPack.exe&preselecteditems=winiso&ga_cn=direct&ga_cs=isg&cid=50393950.88419439 HTTP/1.1
Host: scdn.softcdn.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Wed, 03 Apr 2024 01:03:12 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: mvwtl=BoIcADEwAAIAOADQqgxm___QqgxmQAABAAAA0KoMZgA-; expires=Thu, 03-Apr-2025 01:03:12 GMT; path=/; domain=scdn.softcdn.ru
Location: https://ip.apps-windows.com/InstallPack.exe?preselecteditems=winiso&cid=&uid=&type=ip&ga_ci=blknstl_ruopera&singleRename=1&sign=1&ga_an=&ga_cn=direct&ga_cs=isg&ga_cm=&ga_ck=isg&ga_cc=&utm_source=&utm_campaign=&utm_medium=&uagent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A96.0%29+Gecko%2F20100101+Firefox%2F96.0&abs=1
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
GET ip.apps-windows.com/InstallPack.exe?preselecteditems=winiso&cid=&uid=&type=ip&ga_ci=blknstl_ruopera&singleRename=1&sign=1&ga_an=&ga_cn=direct&ga_cs=isg&ga_cm=&ga_ck=isg&ga_cc=&utm_source=&utm_campaign=&utm_medium=&uagent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A96.0%29+Gecko%2F20100101+Firefox%2F96.0&abs=1
200 OK 2.8 MB URL User Request GET HTTP/1.1 ip.apps-windows.com/InstallPack.exe?preselecteditems=winiso&cid=&uid=&type=ip&ga_ci=blknstl_ruopera&singleRename=1&sign=1&ga_an=&ga_cn=direct&ga_cs=isg&ga_cm=&ga_ck=isg&ga_cc=&utm_source=&utm_campaign=&utm_medium=&uagent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A96.0%29+Gecko%2F20100101+Firefox%2F96.0&abs=1
IP
ASN #24940 Hetzner Online GmbH
Certificate IssuerLet's Encrypt
Subjectapps-windows.com
FingerprintA6:9F:49:B5:4C:B3:8A:6F:D9:72:B1:BE:12:8D:82:E4:35:DD:6D:4E
ValidityMon, 11 Mar 2024 08:52:58 GMT - Sun, 09 Jun 2024 08:52:57 GMT
File type PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
Size 2.8 MB (2798808 bytes)
Hash 7501d485f2602bb23f5bdd9e1c1ba45c
65020b17ac53fc7bb4a8db723220f9a2bc11a547
915deb6fb5559c5feaf1991f13ecda7f42c6fba8c1ceea99b701ed4ae95b8fd1
Analyzer Verdict Alert Public Nextron YARA rules malware Detects suspicious SFX as used by Gamaredon group
VirusTotal malicious
GET /InstallPack.exe?preselecteditems=winiso&cid=&uid=&type=ip&ga_ci=blknstl_ruopera&singleRename=1&sign=1&ga_an=&ga_cn=direct&ga_cs=isg&ga_cm=&ga_ck=isg&ga_cc=&utm_source=&utm_campaign=&utm_medium=&uagent=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%3B+rv%3A96.0%29+Gecko%2F20100101+Firefox%2F96.0&abs=1 HTTP/1.1
Host: ip.apps-windows.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 03 Apr 2024 01:03:12 GMT
Content-Type: application/octet-stream
Content-Length: 2798808
Last-Modified: Thu, 02 Mar 2023 00:10:56 GMT
Connection: keep-alive
Content-Disposition: attachment; filename="Winiso_InstallPack_67802f.exe"
ETag: "63ffe990-2ab4d8"
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Methods: GET
Access-Control-Expose-Headers: Content-Disposition
Accept-Ranges: bytes
176.99.5.252
195.201.247.90