Report Overview
Visitedpublic
2025-01-29 22:27:20
Tags
Submit Tags
URL
loader.colortune.ru/Defender%20Control%20v2.1.zip
Finishing URL
about:privatebrowsing
IP / ASN
45.130.41.108
Title
about:privatebrowsing
Detections
urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
0
Host Summary
| Host | Rank | Registered | First Seen | Last Seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
loader.colortune.ru 1 alert(s) on this Host | unknown | 2024-04-15 | 2025-01-29 | 2025-01-29 | 515 B | 459 kB | 45.130.41.108 |
Related reports
Threat Detection Systems
Public InfoSec YARA rules
No alerts detected
OpenPhish
No alerts detected
PhishTank
No alerts detected
Quad9 DNS
No alerts detected
ThreatFox
No alerts detected
File detected
URL
loader.colortune.ru/Defender%20Control%20v2.1.zip
IP / ASN
45.130.41.108
File Overview
File TypeZip archive data, at least v2.0 to extract, compression method=deflate
Size459 kB (458899 bytes)
MD5bfdecdb70bff7e8c8e70cc31e52cb4cb
SHA13d318d78cf5690c982eb9e3f229a1a4104dcd5cc
Archive (4)
| Filename | MD5 | File type |
|---|---|---|
| dControl.exe | 58008524a6473bdf86c1040a9a9e39c3 | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections |
| dControl.ini | 05450ff06366ae22654b63a6e27d1624 | Unicode text, UTF-16, little-endian text, with CRLF line terminators |
| Defender_Settings.vbs | b0bf0a477bcca312021177572311e666 | ASCII text, with CRLF line terminators |
| ReadMe.txt | 8dbe87a9bf6342c4e2ea406fa86e76bb | Non-ISO extended-ASCII text, with CRLF line terminators |
Detections
| Analyzer | Verdict | Alert |
|---|---|---|
| Public Nextron YARA rules | malware | Detects malware by known bad imphash or rich_pe_header_hash |
| Public InfoSec YARA rules | malware | Identifies Defender Control, used by attackers to disable Windows Defender. |
| VirusTotal | malicious |
JavaScript (0)
No JavaScripts
HTTP Transactions (1)
| URL | IP | Response | Size |
|---|