Report - hoosat.fi/hoobot/hoobot-latest.zip

Report Overview

Submitted URL
hoosat.fi/hoobot/hoobot-latest.zip
IP
167.71.39.179
ASN
#14061 DIGITALOCEAN-ASN
Submitted
2024-04-25 22:23:04
Access
public
Website Title
about:privatebrowsing
Final URL
about:privatebrowsing
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
hoosat.fi	unknown	2023-01-15	2023-01-20	2024-02-20	488 B	3.2 MB	167.71.39.179

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
hoosat.fi/hoobot/hoobot-latest.zip
IP
167.71.39.179
ASN
#14061 DIGITALOCEAN-ASN

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
3.2 MB (3157993 bytes)
Hash
7fcb182b178463e8c64196ce9f4edc95
64a27abcba2af965acdce6983bbbcd2458136667
357d46c6ef6a44cd5fab6166e1d6d530dd4382042c6ccccb90b6cad624f0cbc1

Archive (14)

Filename

Md5

File type

README.md

0a9ba7876eed1fb247d48d8df556150c

ASCII text, with very long lines (457)

osx.sh

6420332ffbb32d280792a428e86e8cf3

Bourne-Again shell script, ASCII text executable

alarm2.mp3

8e37c28f94e3f6634be9888b092d41a1

MPEG ADTS, layer III, v2, 160 kbps, 24 kHz, JntStereo

hoobot-options-simulate.json.example

4f34bea7a1f4495af529dceecfb432b4

JSON text data

hoobot-options.json.example

e0dbfef43fcd5cf0a2f5a61bac610ee4

ASCII text

hoobot.js

896e3a24095f14e4ec8ea6d968e5765e

JavaScript source, Unicode text, UTF-8 text

hoobot.js.map

2ba00257c36b0b25d0e724f5df3ed7aa

JSON text data

eaad953e61490833690363a20e15307c.node

4d719f11ed0ed81e799784fff66b1bc5

ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)

hoobot.service

e3a3c96789760d14fb0a720d4a10d5c5

ASCII text

windows.bat

39984bc52dcfa1fb0e43bf229ad8b2a8

DOS batch file, ASCII text

package.json

0e184aaa36b22f273898632da6f7c1e7

JSON text data

linux.sh

c40a80321cd966e22c5503d33940d1fc

Bourne-Again shell script, ASCII text executable

publish.sh

48df707ebd0796a7c181e937ee4fda01

Bourne-Again shell script, ASCII text executable

alarm.mp3

ffe53153c15a159e737cbb66df7b57ee

Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 64 kbps, 48 kHz, Monaural

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 12/66

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

hoosat.fi/hoobot/hoobot-latest.zip

167.71.39.179

200 OK

3.2 MB

URL User Request GET HTTP/1.1
hoosat.fi/hoobot/hoobot-latest.zip
IP
167.71.39.179:443
ASN
#14061 DIGITALOCEAN-ASN

Certificate
IssuerLet's Encrypt
Subjecthoosat.fi
FingerprintFA:FE:69:F8:77:DF:08:85:15:0C:E4:37:4A:22:26:EB:C6:11:4F:2A
ValidityTue, 23 Apr 2024 07:51:49 GMT - Mon, 22 Jul 2024 07:51:48 GMT

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
3.2 MB (3157993 bytes)
Hash
7fcb182b178463e8c64196ce9f4edc95
64a27abcba2af965acdce6983bbbcd2458136667
357d46c6ef6a44cd5fab6166e1d6d530dd4382042c6ccccb90b6cad624f0cbc1

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 12/66

HTTP Headers

GET /hoobot/hoobot-latest.zip HTTP/1.1
Host: hoosat.fi
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.24.0 (Ubuntu)
Date: Thu, 25 Apr 2024 22:22:35 GMT
Content-Type: application/octet-stream
Transfer-Encoding: chunked
Connection: keep-alive
Content-Security-Policy: script-src 'self' 'nonce-BMoFAdj9e8B7lTSdqMoqVm0m4gv454BFSovqYd1wIrs=' http: https:; style-src 'self' 'unsafe-inline';
Access-Control-Allow-Origin: h
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-Content-Security-Policy
Access-Control-Allow-Credentials: true
Cache-Control: no-cache
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (14)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers