Report - kemono.su/data/13/45/1345d8caf741c2337f9c0aec49bda3658d043ddfadd1812974c233dba204c937.7z?f=HYDRA_1.6F

Report Overview

Submitted URL
kemono.su/data/13/45/1345d8caf741c2337f9c0aec49bda3658d043ddfadd1812974c233dba204c937.7z?f=HYDRA_1.6F_PRO.7z
IP
190.115.16.14
ASN
#59692 IQWeb FZ-LLC
Submitted
2024-05-07 21:36:16
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
17

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
c2.kemono.su	unknown	2022-08-25	2023-10-22	2024-04-16	603 B	7.3 MB	91.149.227.2
kemono.su	unknown	2022-08-25	2023-06-03	2024-05-03	562 B	686 B	190.115.16.14

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
c2.kemono.su/data/13/45/1345d8caf741c2337f9c0aec49bda3658d043ddfadd1812974c233dba204c937.7z?f=HYDRA_1.6F_PRO.7z
IP
91.149.227.2
ASN
#200508 Sorok76 Ltd

File type
7-zip archive data, version 0.4
Size
7.3 MB (7263360 bytes)
Hash
fd62255f45b18c6f81790368e6495844
7600a6fefd00f395d89d72c4dd10717fbac24eda
1345d8caf741c2337f9c0aec49bda3658d043ddfadd1812974c233dba204c937

Archive (44)

Filename

Md5

File type

AMDVBFLASH_User_Guide_NDA.pdf

f4a483489567d6b10b6a2a884205da5d

PDF document, version 1.7, 12 pages

arguments.txt

696a0182c4867d2f6c6d7fb72674e7a2

Unicode text, UTF-8 text, with CRLF line terminators

Changelog.txt

e55a0130c287f8acaaa432b787a4c8bb

ASCII text, with CRLF line terminators

readme.txt

b60613ca7dbe272cec714088dc518682

ASCII text, with CRLF line terminators

AdlTune.dll

8b2e7eb05d72a41cd9326c3edc473a25

PE32+ executable (DLL) (console) x86-64, for MS Windows, 6 sections

amdvbflash.exe

313ed2279df1af019a0ccd06b4507277

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

AMDVBFlashDriverInstaller.exe

98d09e802ee2130801160a3f395b5774

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

Bunifu.Licensing.dll

2b2740e0c34a46de31cf9da8a75d77cf

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.1.5.3.dll

019b3a5dd20f3e55b426e652ed512079

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuButton.dll

7e751ae1a357a30e3aa5153352ebcafd

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuCheckBox.dll

4274a77b71f547347f241386c6729cd6

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuCircleProgress.dll

69beccb5c9e400ca1434932d094d137a

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuDataGridView.dll

c895e9bad25d4a9d97ec1db436f7071e

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuDropdown.dll

c715cbdee4b7e42294bea2a949626d41

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuFormDock.dll

e650ea1fb5e93378801e29ea63448e6b

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuGauge.dll

67a0fdeffa7a25ace3510a3dbb6fbf98

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuGradientPanel.dll

63efe260262b27a23e19eeff6af0136d

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuImageButton.dll

ac51e7ef8f6c6c7c702da1b1c866aaac

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuLoader.dll

5c5e23a67c2aeb47cfc22f427938bc60

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuPages.dll

afdcd61a8a6af3e24c8a078c6a061a9e

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuPictureBox.dll

601c4bcad4fa72e1aa2969c886561851

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuProgressBar.dll

d184cab2f5ab5d4b039db5e0fc1775ce

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuScrollBar.dll

bf1ee8bb0b5d51536d10bd1032cf10e2

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuSeparator.dll

6045f5a968c65d08d47827d14e04dcab

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuShapes.dll

9f6fdd0ac1f813eb3168cd0764f53ada

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuSlider.dll

6dc11a882fe619c030263e1b2b2990bd

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuTextBox.dll

94d2d9fe55e9a608e865dd472a98ba75

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuToggleSwitch.dll

08adb1587981473e8032d0397a994467

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Bunifu.UI.WinForms.BunifuToolTip.dll

27529cab8c6b19ef0b8a6f5f4d131cc4

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

HYDRA.exe

488f443e565ebb5773e02898cba6eb48

PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 3 sections

hydra_1.dll

d9d3531106bba8b8b2846c95597c1a40

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

hydra_2.dll

49bd0408506e9128795b2e1d09a48c32

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

inpoutx64.dll

ac0c3ae82ec0764c605fa59e7bf05614

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

MemSpeed.exe

428293382eb4398e06a06a32c1e1b502

PE32+ executable (console) x86-64, for MS Windows, 7 sections

memtest.exe

2da23869191b9b93106967d1924e6342

PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

Microsoft.Win32.TaskScheduler.dll

a844ac745a4005fbd3f51d79ff88583c

PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

atiadlxx.dll

506414ab03cfad5235e481a541b770f4

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

nvapi64.dll

828638339436efa9358fe004e19d38a9

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

nvml.dll

b781f53fb82453a973d800ca7357914b

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections

NVapi.dll

9f9a5e87b4c44b45aa2ae7161d17e4a7

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

RandomLatency.exe

6d4a2272634907991796ab98ed0689b6

PE32+ executable (console) x86-64, for MS Windows, 7 sections

restart64.exe

297aa19bade534a791d053ca190b74ad

PE32+ executable (GUI) x86-64, for MS Windows, 6 sections

WinRing0x64.dll

d98ee0134e3799bdf2254dcecd5ea55d

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

WinRing0x64.sys

0c0195c48b6b8582fa6f6373032118da

PE32+ executable (native) x86-64, for MS Windows, 6 sections

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - inpoutx64.sys
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
Public Nextron YARA rules	malware	Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0x64.sys
YARAhub by abuse.ch	malware	signed_sys_with_vulnerablity
VirusTotal	suspicious	VirusTotal - Scan result 3/61

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

kemono.su/data/13/45/1345d8caf741c2337f9c0aec49bda3658d043ddfadd1812974c233dba204c937.7z?f=HYDRA_1.6F_PRO.7z

190.115.16.14

302 Found

138 B

URL User Request GET HTTP/2
kemono.su/data/13/45/1345d8caf741c2337f9c0aec49bda3658d043ddfadd1812974c233dba204c937.7z?f=HYDRA_1.6F_PRO.7z
IP
190.115.16.14:443
ASN
#59692 IQWeb FZ-LLC

Certificate
IssuerLet's Encrypt
Subjectkemono.su
Fingerprint90:72:9B:52:C4:20:9A:BB:1C:D9:60:EB:2A:A2:CC:1F:50:00:B1:19
ValidityFri, 03 May 2024 09:20:10 GMT - Thu, 01 Aug 2024 09:20:09 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
138 B (138 bytes)
Hash
aff950cab4c0265e21d401db15f1026d
f03e18461817f7a6546c8bf8fa8d686d7e30aca0
753e0dd54f28c4f7009b9c0b18a68aed175416bd8b7d134858264586eaac56f0

HTTP Headers

GET /data/13/45/1345d8caf741c2337f9c0aec49bda3658d043ddfadd1812974c233dba204c937.7z?f=HYDRA_1.6F_PRO.7z HTTP/1.1
Host: kemono.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: ddos-guard
content-security-policy: upgrade-insecure-requests;
set-cookie: __ddg1_=kuRefhbRTY3odgcuZkJl; Domain=.kemono.su; HttpOnly; Path=/; Expires=Wed, 07-May-2025 21:35:45 GMT
date: Tue, 07 May 2024 21:35:45 GMT
content-type: text/html
content-length: 138
location: https://c2.kemono.su/data/13/45/1345d8caf741c2337f9c0aec49bda3658d043ddfadd1812974c233dba204c937.7z?f=HYDRA_1.6F_PRO.7z
strict-transport-security: max-age=63072000; includeSubDomains; preload
age: 0
ddg-cache-status: MISS
X-Firefox-Spdy: h2

c2.kemono.su/data/13/45/1345d8caf741c2337f9c0aec49bda3658d043ddfadd1812974c233dba204c937.7z?f=HYDRA_1.6F_PRO.7z

91.149.227.2

200 OK

7.3 MB

URL User Request GET HTTP/2
c2.kemono.su/data/13/45/1345d8caf741c2337f9c0aec49bda3658d043ddfadd1812974c233dba204c937.7z?f=HYDRA_1.6F_PRO.7z
IP
91.149.227.2:443
ASN
#200508 Sorok76 Ltd

Certificate
IssuerLet's Encrypt
Subjectc2.kemono.su
Fingerprint28:FA:70:2F:6D:8E:98:08:EE:80:7D:1A:36:59:01:FD:F2:A9:A2:C9
ValidityWed, 17 Apr 2024 23:41:21 GMT - Tue, 16 Jul 2024 23:41:20 GMT

File type
7-zip archive data, version 0.4
Size
7.3 MB (7263360 bytes)
Hash
fd62255f45b18c6f81790368e6495844
7600a6fefd00f395d89d72c4dd10717fbac24eda
1345d8caf741c2337f9c0aec49bda3658d043ddfadd1812974c233dba204c937

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 3/61

HTTP Headers

GET /data/13/45/1345d8caf741c2337f9c0aec49bda3658d043ddfadd1812974c233dba204c937.7z?f=HYDRA_1.6F_PRO.7z HTTP/1.1
Host: c2.kemono.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __ddg1_=kuRefhbRTY3odgcuZkJl
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Tue, 07 May 2024 21:35:47 GMT
content-type: application/x-7z-compressed
content-length: 7263360
last-modified: Fri, 05 Apr 2024 16:19:15 GMT
etag: "66102483-6ed480"
content-disposition: inline; filename=HYDRA_1.6F_PRO.7z
access-control-allow-origin: https://kemono.su
access-control-allow-methods: GET, OPTIONS
access-control-allow-headers: *
cache-control: public, max-age=2592000, s-maxage=2592000
accept-ranges: bytes
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (44)

Detections

JavaScript (0)

HTTP Transactions (2)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers