Report - cdn6.filehaus.su/files/1725037836

Report Overview

Visitedpublic

2024-09-01 03:19:20

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-08-31 18:12:11	1.3 kB	3.5 kB	23.36.76.226
cdn6.filehaus.su	unknown	unknown	No data	No data	513 B	865 kB	94.177.106.193

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-09-01	medium	cdn6.filehaus.su/files/1725037836_63906/AutoClicker-3.0.exe	meth_get_eip
2024-09-01	medium	cdn6.filehaus.su/files/1725037836_63906/AutoClicker-3.0.exe	Identifies compiled AutoIT script (as EXE).

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

cdn6.filehaus.su/files/1725037836_63906/AutoClicker-3.0.exe

IP / ASN

94.177.106.193

#9050 Orange Romania Communication S.A

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

Size864 kB (864317 bytes)

MD57ecfc8cd7455dd9998f7dad88f2a8a9d

SHA11751d9389adb1e7187afa4938a3559e58739dce6

SHA2562e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
Public InfoSec YARA rules	malware	Identifies compiled AutoIT script (as EXE).
VirusTotal	suspicious	VirusTotal - Scan result 2/74

JavaScript (0)

HTTP Transactions (5)

URL IP Response Size

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-31

Last Seen2024-09-20

Times Seen36159

Size504 B (504 bytes)

MD5404e3e4520c09fcce1358b1a21f6b171

SHA1040aa03460f3d7ec6f75cae0bf5a462a4bb9798d

SHA256f6fc34acb6b2d60bb37dd5caf92b0988cdd52927d80d1f5e7bc23b7db9e8209a

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "F6FC34ACB6B2D60BB37DD5CAF92B0988CDD52927D80D1F5E7BC23B7DB9E8209A"
Last-Modified: Sat, 31 Aug 2024 00:20:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2310
Expires: Sun, 01 Sep 2024 03:57:24 GMT
Date: Sun, 01 Sep 2024 03:18:54 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-31

Last Seen2024-09-20

Times Seen25067

Size504 B (504 bytes)

MD5231aa156f55dd8497dca6a2066312be3

SHA1741432c8275492eb38bba5d0841685dc4f864fee

SHA256f348affacf8e814c579ff56d592287275dcf79e2f55f1d041921833d730d2349

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "F348AFFACF8E814C579FF56D592287275DCF79E2F55F1D041921833D730D2349"
Last-Modified: Sat, 31 Aug 2024 02:34:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6925
Expires: Sun, 01 Sep 2024 05:14:19 GMT
Date: Sun, 01 Sep 2024 03:18:54 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-31

Last Seen2024-09-20

Times Seen27687

Size504 B (504 bytes)

MD59d2c063731a46a7e1548540195080de0

SHA1dd1924ebf7697509a10f3f07604f28f96b4fc498

SHA2560d414ed4850119c53fae9ddd19ee1dd95783fd08f7389c3e8ec95215023e298e

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "0D414ED4850119C53FAE9DDD19EE1DD95783FD08F7389C3E8EC95215023E298E"
Last-Modified: Sat, 31 Aug 2024 02:33:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7160
Expires: Sun, 01 Sep 2024 05:18:14 GMT
Date: Sun, 01 Sep 2024 03:18:54 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-09-20

Last Seen2024-09-20

Times Seen1

Size504 B (504 bytes)

MD59e84a67edc95e6318f9e7b498786b0a7

SHA147d992694325ad03478af92ed4a583c017c53b4b

SHA2567ddbb208be6d8391d52cfbc39444a2325706573d453bb9019603c2bfb4545098

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "7DDBB208BE6D8391D52CFBC39444A2325706573D453BB9019603C2BFB4545098"
Last-Modified: Sat, 31 Aug 2024 03:56:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9213
Expires: Sun, 01 Sep 2024 05:52:27 GMT
Date: Sun, 01 Sep 2024 03:18:54 GMT
Connection: keep-alive

GET cdn6.filehaus.su/files/1725037836_63906/AutoClicker-3.0.exe

94.177.106.193

200 OK

864 kB

URL

cdn6.filehaus.su/files/1725037836_63906/AutoClicker-3.0.exe

IP / ASN

94.177.106.193

#9050 Orange Romania Communication S.A

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

First Seen2023-04-22

Last Seen2025-05-27

Times Seen530

Size864 kB (864317 bytes)

MD57ecfc8cd7455dd9998f7dad88f2a8a9d

SHA11751d9389adb1e7187afa4938a3559e58739dce6

SHA2562e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

Certificate Info

IssuerLet's Encrypt

Subjectcdn6.filehaus.su

Fingerprint4F:30:20:80:4F:6F:2A:86:83:B7:53:58:E3:B4:09:4B:E6:F1:E0:F5

ValidityWed, 10 Jul 2024 19:05:57 GMT - Tue, 08 Oct 2024 19:05:56 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
Public InfoSec YARA rules	malware	Identifies compiled AutoIT script (as EXE).
VirusTotal	suspicious	VirusTotal - Scan result 2/74

HTTP Headers

GET /files/1725037836_63906/AutoClicker-3.0.exe HTTP/1.1
Host: cdn6.filehaus.su
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.18.0
Date: Sun, 01 Sep 2024 03:18:54 GMT
Content-Type: application/octet-stream
Content-Length: 864317
Last-Modified: Fri, 30 Aug 2024 17:10:36 GMT
Connection: keep-alive
ETag: "66d1fd0c-d303d"
Accept-Ranges: bytes