Report - b2.gangsloni.com/file/gangsloni/win/vst/Keyscape.zip

Report Overview

Visitedpublic

2024-05-03 20:42:00

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
b2.gangsloni.com	unknown	2021-11-09	2022-06-03 00:54:03	2024-04-27 16:51:44	506 B	17 MB	104.21.45.158

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

b2.gangsloni.com/file/gangsloni/win/vst/Keyscape.zip

IP / ASN

104.21.45.158

#13335 CLOUDFLARENET

File Overview

File TypeZip archive data, at least v2.0 to extract, compression method=deflate

Size17 MB (17030261 bytes)

MD5fb688a590192d87cc0e43eb85490ce69

SHA1b91561e7cde21e12bf98e3635516e4bd25e2135d

SHA2568df1d609679da29074e8a0a2c451f11dfe5ebde14ae25711cb647707d6e0b334

Archive (3)

Modified	Filename	Size	MD5	File type
2022-02-17 12:12	R2R.txt	2.4 kB	80f32ea6731790f3a5d08fc9848b557f	ASCII text, with CRLF line terminators
2022-02-17 12:12	Setup Keyscape v1.3.0f.exe	16 MB	f61a9996082c8c49ae4b7631e13aaed3	PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
2022-02-17 12:12	Spectrasonics KeyGen v3.1.1.exe	1.1 MB	58eea1e1181960442a0d9ce89fea5029	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect files is `SliverFox` malware
VirusTotal	malicious	VirusTotal - Scan result 39/64

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET b2.gangsloni.com/file/gangsloni/win/vst/Keyscape.zip

104.21.45.158

200 OK

17 MB

URL User Request GET HTTPS

b2.gangsloni.com/file/gangsloni/win/vst/Keyscape.zip

IP / ASN

104.21.45.158

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typeZip archive data, at least v2.0 to extract, compression method=deflate

First Seen2023-12-30

Last Seen2024-11-29

Times Seen14

Size17 MB (17030261 bytes)

MD5fb688a590192d87cc0e43eb85490ce69

SHA1b91561e7cde21e12bf98e3635516e4bd25e2135d

SHA2568df1d609679da29074e8a0a2c451f11dfe5ebde14ae25711cb647707d6e0b334

Certificate Info

IssuerLet's Encrypt

Subjectgangsloni.com

FingerprintFB:E1:AC:E3:98:3E:9D:2F:DF:56:BB:C1:2A:75:52:A9:2E:A5:82:9F

ValidityThu, 02 May 2024 07:49:43 GMT - Wed, 31 Jul 2024 07:49:42 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 39/64

HTTP Headers

GET /file/gangsloni/win/vst/Keyscape.zip HTTP/1.1
Host: b2.gangsloni.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 03 May 2024 20:41:32 GMT
content-type: application/zip
content-length: 17030261
x-bz-file-name: win/vst/Keyscape.zip
x-bz-file-id: 4_z42952939db163382830d031b_f108e416d4650d693_d20220419_m071106_c004_v0402001_t0049_u01650352266834
x-bz-content-sha1: b91561e7cde21e12bf98e3635516e4bd25e2135d
x-bz-upload-timestamp: 1650352266834
x-bz-info-src_last_modified_millis: 1650352209288
strict-transport-security: max-age=63072000
last-modified: Fri, 03 May 2024 20:41:23 GMT
cache-control: max-age=14400
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jAno%2BWeom9BdwE01vYc3kkG7W0xRVbzzgzXWUbpyFhs%2FN238VTbGX4pSiM4jxn%2Bl6Heic120tIolYzT83OklnGplbW25MpKWdARYyeAV0lS4GNe5OSQpFOQtB61%2FFKfC6p1u"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87e312884f9a568d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2