Report - 23.143.152.85/d/msdownload/update/software/defu/2024/07/am_base_patch1_5cfeadcc792ae8089a61c689f88af27ca065a7de.exe?cacheHostOrigin=3.au.download.windowsupdate.com

Report Overview

Visited public
2024-07-09 12:02:56
Tags
Submit Tags
URL
23.143.152.85/d/msdownload/update/software/defu/2024/07/am_base_patch1_5cfeadcc792ae8089a61c689f88af27ca065a7de.exe?cacheHostOrigin=3.au.download.windowsupdate.com
Finishing URL
about:privatebrowsing
IP / ASN
23.143.152.85
#400798 PITIX-INFRA
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
23.143.152.85	unknown	unknown	No data	No data	533 B	17 MB	23.143.152.85
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-07-08 18:12:20	2.9 kB	8.0 kB	23.36.77.32

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-07-09 12:02:26	high	23.143.152.85	Client IP	ET POLICY PE EXE or DLL Windows file download HTTP
2024-07-09 12:02:26	medium	23.143.152.85	Client IP	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-07-09	medium	23.143.152.85/d/msdownload/update/software/defu/2024/07/am_base_patch1_5cfeadcc792ae8089a61c689f88af27ca065a7de.exe?cacheHostOrigin=3.au.download.windowsupdate.com	meth_stackstrings

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-07-09	medium	23.143.152.85	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (10)

URL IP Response Size

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
b34ca6af54e2b9fea57d418f5d1928f7
510b69f4470789a573217726d6f1a3d6ee765460
41e6a348aac9e9db44bfa14b3aa29d411f4489b375ae1f1be6b0d280af98541d

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "41E6A348AAC9E9DB44BFA14B3AA29D411F4489B375AE1F1BE6B0D280AF98541D"
Last-Modified: Mon, 08 Jul 2024 01:53:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4116
Expires: Tue, 09 Jul 2024 13:11:01 GMT
Date: Tue, 09 Jul 2024 12:02:25 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
abec3934929082bd707108b7042796da
4f200b04ad1c6fcac9833107c492a59ebf36dc6e
8e27309b919c0dcb3b0736dd99dad8c7d3bc16b4816dd982e6af6b79d7ead9ed

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "8E27309B919C0DCB3B0736DD99DAD8C7D3BC16B4816DD982E6AF6B79D7EAD9ED"
Last-Modified: Sun, 07 Jul 2024 03:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10167
Expires: Tue, 09 Jul 2024 14:51:52 GMT
Date: Tue, 09 Jul 2024 12:02:25 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
41036a4c62e61466443bce27a927e029
39a2a8a258c5feaf020246696135700b0c30740d
e38b3080a1752122f5a174604bd307c54be31c02e0cdb8e2d9354e2a04e1b50f

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "E38B3080A1752122F5A174604BD307C54BE31C02E0CDB8E2D9354E2A04E1B50F"
Last-Modified: Sun, 07 Jul 2024 11:47:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5816
Expires: Tue, 09 Jul 2024 13:39:21 GMT
Date: Tue, 09 Jul 2024 12:02:25 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
c1f3573a71cfe2a8f30b3fbc7d2d3453
101371f5030c41e4dad4e1e6ac102342db020318
74180138e5609f4047b5a20bc58bfd360dea9bba200acf14fd43fc2d6b5da34b

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "74180138E5609F4047B5A20BC58BFD360DEA9BBA200ACF14FD43FC2D6B5DA34B"
Last-Modified: Sun, 07 Jul 2024 04:18:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6060
Expires: Tue, 09 Jul 2024 13:43:25 GMT
Date: Tue, 09 Jul 2024 12:02:25 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
d7b2c37e4b6c062d80ad32046f42d3d8
131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c
317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2"
Last-Modified: Mon, 08 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17577
Expires: Tue, 09 Jul 2024 16:55:24 GMT
Date: Tue, 09 Jul 2024 12:02:27 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
d7b2c37e4b6c062d80ad32046f42d3d8
131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c
317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2"
Last-Modified: Mon, 08 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17577
Expires: Tue, 09 Jul 2024 16:55:24 GMT
Date: Tue, 09 Jul 2024 12:02:27 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
d7b2c37e4b6c062d80ad32046f42d3d8
131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c
317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2"
Last-Modified: Mon, 08 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17577
Expires: Tue, 09 Jul 2024 16:55:24 GMT
Date: Tue, 09 Jul 2024 12:02:27 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
d7b2c37e4b6c062d80ad32046f42d3d8
131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c
317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2"
Last-Modified: Mon, 08 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17577
Expires: Tue, 09 Jul 2024 16:55:24 GMT
Date: Tue, 09 Jul 2024 12:02:27 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
d7b2c37e4b6c062d80ad32046f42d3d8
131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c
317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2"
Last-Modified: Mon, 08 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17577
Expires: Tue, 09 Jul 2024 16:55:24 GMT
Date: Tue, 09 Jul 2024 12:02:27 GMT
Connection: keep-alive

GET 23.143.152.85/d/msdownload/update/software/defu/2024/07/am_base_patch1_5cfeadcc792ae8089a61c689f88af27ca065a7de.exe?cacheHostOrigin=3.au.download.windowsupdate.com

23.143.152.85

200 OK

17 MB

URL User Request GET HTTP/1.1
23.143.152.85/d/msdownload/update/software/defu/2024/07/am_base_patch1_5cfeadcc792ae8089a61c689f88af27ca065a7de.exe?cacheHostOrigin=3.au.download.windowsupdate.com
IP
23.143.152.85:80
ASN
#400798 PITIX-INFRA

File type
PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
Size
17 MB (16578024 bytes)
Hash
e02dccff15626111a25d034506a343d0
5cfeadcc792ae8089a61c689f88af27ca065a7de
9f248a91343370f70a6a6ec5b9f2bd168b40cb70ad4bdd4e0b69da6f1bf80f6d

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_stackstrings
Quad9 DNS	malicious	Sinkholed

NIDS	Severity	Alert
suricata	high	ET POLICY PE EXE or DLL Windows file download HTTP
suricata	medium	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response

HTTP Headers

GET /d/msdownload/update/software/defu/2024/07/am_base_patch1_5cfeadcc792ae8089a61c689f88af27ca065a7de.exe?cacheHostOrigin=3.au.download.windowsupdate.com HTTP/1.1
Host: 23.143.152.85
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 09 Jul 2024 12:02:26 GMT
Content-Type: application/octet-stream
Content-Length: 16578024
Connection: keep-alive
Cache-Control: public,max-age=172800
Last-Modified: Tue, 09 Jul 2024 02:50:53 GMT
Via: 1.1 varnish
Age: 118
X-Served-By: cache-iad-kjyo7100075-IAD
X-Cache: HIT
X-Cache-Hits: 6
X-Timer: S1720495783.653682,VS0,VE0
X-CID: 10002
X-CCC: 1b5d4fe0-c7fb-4478-8bd9-c6465c475bde
Content-Security-Policy: default-src 'self' http: https: data: blob: 'unsafe-inline'
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
X-Cache-Status: HIT
Accept-Ranges: bytes

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (10)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN