Report - cs-geimer.clan.su/_ld/6/671_808_hlserver

Report Overview

Visited public
2025-01-29 22:26:11
Tags
URL
cs-geimer.clan.su/_ld/6/671_808_hlserver_on.zip
Finishing URL
about:privatebrowsing
IP / ASN
193.109.246.47
#204343 Compubyte Limited
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
cs-geimer.clan.su	unknown	2006-03-08	2014-12-03	2023-06-02	513 B	362 kB	193.109.246.47

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
cs-geimer.clan.su/_ld/6/671_808_hlserver_on.zip
IP
193.109.246.47
ASN
#204343 Compubyte Limited

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
362 kB (361624 bytes)
Hash
7995f2993407620781c5f4cb55c89b05
ef4d72c7ef2a037ea5e31f24712ccbb9a8ce34be
a4f3f5e9d23ae5f50d5dcd7f2554ca76de0405df1ecddf725b5fd29185f1537b

Archive (18)

Filename

Md5

File type

hlserverprivate.exe

eb3234581f0accb55fad2d9ac59c6969

PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 4 sections

masters.txt

04a9429de79c20014022fbf5e4d849aa

ASCII text, with CRLF line terminators

ipranges.txt

d41d8cd98f00b204e9800998ecf8427e

ips.txt

d41d8cd98f00b204e9800998ecf8427e

nicknames.txt

d41d8cd98f00b204e9800998ecf8427e

packets.txt

d41d8cd98f00b204e9800998ecf8427e

clcmds.txt

d41d8cd98f00b204e9800998ecf8427e

ctext.txt

d41d8cd98f00b204e9800998ecf8427e

gamenames.txt

d41d8cd98f00b204e9800998ecf8427e

hostnames.txt

5bc37d608961cf6d0a36509091004f59

Unicode text, UTF-8 text, with CRLF line terminators

mappings.txt

d41d8cd98f00b204e9800998ecf8427e

maps.txt

0ad2534967a71602da38dd9e1665e132

ASCII text, with CRLF line terminators

packets.txt

d41d8cd98f00b204e9800998ecf8427e

players.txt

cb492b7df9b5c170d7c87527940eff3b

ASCII text, with CRLF line terminators

redirect.txt

5d9cec91bd4c1734bee40ff6d2ef4e28

ASCII text, with CRLF line terminators

rules.txt

d41d8cd98f00b204e9800998ecf8427e

slist.txt

d41d8cd98f00b204e9800998ecf8427e

config.txt

4de8c4cc986001d61a3fc00a899daff3

ASCII text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 41/62

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

cs-geimer.clan.su/_ld/6/671_808_hlserver_on.zip

193.109.246.47

200 OK

362 kB

URL User Request GET HTTP/1.1
cs-geimer.clan.su/_ld/6/671_808_hlserver_on.zip
IP
193.109.246.47:443
ASN
#204343 Compubyte Limited

Certificate
IssuerGlobalSign nv-sa
Subject*.clan.su
FingerprintAA:26:1E:58:EC:49:21:55:61:01:8F:8F:FB:2A:00:2D:89:F3:95:18
ValidityMon, 21 Oct 2024 12:42:53 GMT - Sat, 22 Nov 2025 12:42:52 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
362 kB (361624 bytes)
Hash
7995f2993407620781c5f4cb55c89b05
ef4d72c7ef2a037ea5e31f24712ccbb9a8ce34be
a4f3f5e9d23ae5f50d5dcd7f2554ca76de0405df1ecddf725b5fd29185f1537b

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 41/62

HTTP Headers

GET /_ld/6/671_808_hlserver_on.zip HTTP/1.1
Host: cs-geimer.clan.su
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 29 Jan 2025 22:25:38 GMT
Content-Type: application/zip
Content-Length: 361624
Connection: keep-alive
Keep-Alive: timeout=15
Last-Modified: Sun, 07 Oct 2012 06:21:02 GMT
ETag: "50711f4e-58498"
Expires: Tue, 18 Feb 2025 22:25:38 GMT
Cache-Control: max-age=1728000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (18)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers