Report - mstar-cdn.valofe.com/ClubMstar/DownLoader/Live/Mstar

Report Overview

Visitedpublic

2024-03-06 09:20:24

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
mstar-cdn.valofe.com	unknown	unknown	No data	No data	521 B	631 kB	163.171.134.109

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-03-06	medium	mstar-cdn.valofe.com/ClubMstar/DownLoader/Live/Mstar_Downloader.exe	files - file ~tmp01925d3f.exe

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

mstar-cdn.valofe.com/ClubMstar/DownLoader/Live/Mstar_Downloader.exe

IP / ASN

163.171.134.109

#54994 ML-1432-54994

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

Size630 kB (630512 bytes)

MD5e6497f93b9a8f44dddd25c903a9cc385

SHA1e584ae885bfb0793a451c6d8c2d7d048d068b4f8

SHA256b10748518bbba1d5016b2c61588d0d4dc287832c103749b68c0121a2d318593c

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET mstar-cdn.valofe.com/ClubMstar/DownLoader/Live/Mstar_Downloader.exe

163.171.134.109

200 OK

630 kB

URL

mstar-cdn.valofe.com/ClubMstar/DownLoader/Live/Mstar_Downloader.exe

IP / ASN

163.171.134.109

#54994 ML-1432-54994

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

First Seen2024-08-20

Last Seen2024-08-20

Times Seen1

Size630 kB (630512 bytes)

MD5e6497f93b9a8f44dddd25c903a9cc385

SHA1e584ae885bfb0793a451c6d8c2d7d048d068b4f8

SHA256b10748518bbba1d5016b2c61588d0d4dc287832c103749b68c0121a2d318593c

Certificate Info

IssuerGlobalSign nv-sa

Subjectssl2.cdngc.net

Fingerprint01:F3:EA:F8:8D:D6:55:00:78:E4:20:C1:08:68:C1:CA:FD:9A:84:86

ValidityTue, 16 May 2023 06:54:02 GMT - Tue, 28 May 2024 02:36:31 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe

HTTP Headers

GET /ClubMstar/DownLoader/Live/Mstar_Downloader.exe HTTP/1.1
Host: mstar-cdn.valofe.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 06 Mar 2024 09:19:59 GMT
Content-Type: application/octet-stream
Content-Length: 630512
Connection: keep-alive
Accept-Ranges: bytes
Last-Modified: Fri, 16 Feb 2024 06:53:46 GMT
Server: PWS/8.3.1.0.8
Cache-Control: max-age=2592000
Age: 913961
Via: 1.1 PShgseSEL5iw163:3 (W), 1.1 PSdgflkfFRA1bc200:7 (W), 1.1 PSrdsdgemSTO1sw92:11 (W)
X-Px: ht PSrdsdgemSTO1sw92ARN
X-Ws-Request-Id: 65e8353f_PSrdsdgemSTO1sw92_24135-49625
Access-Control-Allow-Origin: *