Report - vrtulex.net/download/windows/rootkity/He4Hook215b6.zip

Report Overview

Submitted URL
vrtulex.net/download/windows/rootkity/He4Hook215b6.zip
IP
185.8.165.81
ASN
#24971 Master Internet s.r.o.
Submitted
2024-04-19 03:25:44
Access
public
Website Title
Warning: Potential Security Risk Ahead
Final URL
about:certerror?e=nssBadCert&u=https%3A//vrtulex.net/download/windows/rootkity/He4Hook215b6.zip&c=UTF-8&d=%20
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
vrtulex.net	unknown	2009-10-17	2017-02-15	2024-01-13	932 B	248 kB	185.8.165.81

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
vrtulex.net/download/windows/rootkity/He4Hook215b6.zip
IP
185.8.165.81
ASN
#24971 Master Internet s.r.o.

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
247 kB (247411 bytes)
Hash
85afd95db7acf27673621b08b632a980
a7248ca1eabc9c00fae63fdd5939f4157939259e
c45aa411204f5fbb444d8b86d2ad9accb92825614f51909d39205e5ebae8c2ec

Archive (78)

Filename

Md5

File type

KNew.h

30ce2ef43a598eada4a5359c7278bf91

C source, ASCII text, with CRLF line terminators

KTypes.h

b7f4cc01ab817cdb00a8c3d30318ca23

ASCII text, with CRLF line terminators

NtoskrnlUndoc.h

63f376e9538f11bcf75bbcab1899d543

C source, ISO-8859 text, with CRLF line terminators

KBinaryTree.cpp

ddd42b719b16244fd57bd88109a2320d

C source, ASCII text, with CRLF line terminators

KBinaryTree.h

bce7f9be1fc29c1d57bd0b2f67570a9f

C++ source, ASCII text, with CRLF line terminators

KBinaryTreeNode.cpp

deb429b0feaba56bafeae4e26a6fb43d

C source, ASCII text, with CRLF line terminators

KBinaryTreeNode.h

516ff2ea8a715fd0aecb19d055e445b3

C++ source, ASCII text, with CRLF line terminators

KDLinkedList.cpp

1ad8408e56f57d897a8ba2f906fe6aa0

C source, ASCII text, with CRLF line terminators

KDLinkedList.h

c9bdcd9791e57cebdebea1ad15248f14

C++ source, ASCII text, with CRLF line terminators

KDLinkedListItem.cpp

3c4f934f7278f869c474d50a263ef7a1

C source, ASCII text, with CRLF line terminators

KDLinkedListItem.h

9222eb88ab6bae731a67fb41252167a1

C++ source, ASCII text, with CRLF line terminators

KInterlockedCounter.cpp

614dd4274a3fcc7b40dc66fb712995b5

C source, ASCII text, with CRLF line terminators

KInterlockedCounter.h

a42ba0546aaa676ae04159c5156156fa

C++ source, ASCII text, with CRLF line terminators

KLocker.cpp

9d491466f4b82ac1e790faf4c01864fd

C source, ASCII text, with CRLF line terminators

KLocker.h

791f562580b4f81c7a4a7b9cd5dc151b

C++ source, ASCII text, with CRLF line terminators

KMemoryManager.cpp

86fd1f23ea320a2e4c71740518db73d7

C source, ISO-8859 text, with CRLF line terminators

KMemoryManager.h

ed5f9aef3b79cf2a4769278ff13aae01

C source, ISO-8859 text, with CRLF line terminators

KMutexSynchroObject.cpp

cfe0eb354bf95ffbb07086415e9c67da

C source, ASCII text, with CRLF line terminators

KMutexSynchroObject.h

307163de3c46dda0ffa4115ceb4f9a28

C++ source, ASCII text, with CRLF line terminators

KShieldDirectory.cpp

78501b56a0abd44fdc32b498c99826b8

C source, ASCII text, with CRLF line terminators

KShieldDirectory.h

c6b5497b346d6ce443cc5cb50ba3b9e9

C++ source, ASCII text, with CRLF line terminators

KShieldDirectoryTree.cpp

5c2aa855c6be7868a60918f0ded2940d

C source, ASCII text, with CRLF line terminators

KShieldDirectoryTree.h

0229e96c8441d19452464b5e61c6c11d

C++ source, ISO-8859 text, with CRLF line terminators

KSpinSynchroObject.cpp

13847eff1b0c46ff0625f84723cfc279

C source, ASCII text, with CRLF line terminators

KSpinSynchroObject.h

f98538228d585b1cbef69eb640179efd

C++ source, ASCII text, with CRLF line terminators

krnlstdlib.cpp

cdf6296e569b6402d76acab5e45bcb28

C source, ASCII text, with CRLF line terminators

krnlstdlib.h

b6feee0dabc68670d2a678673d207b6c

C source, ASCII text, with CRLF line terminators

KSynchroObject.cpp

16eee23507f74d169c351b7f65d18342

C source, ASCII text, with CRLF line terminators

KSynchroObject.h

14ca8ef4e9140ad8a39df84d1bb8e3f4

C++ source, ASCII text, with CRLF line terminators

KTdiInterface.cpp

1d36a08a5e3707d5e87b1697848683b6

C source, ASCII text, with CRLF line terminators

KTdiInterface.h

e5fb198ae875f1e1ab166c62758b76e7

C++ source, ASCII text, with CRLF line terminators

smpletcp.h

2e0a26613c8f6aa78b4f2f4b9f147950

C source, ASCII text, with CRLF line terminators

KTdiStreamSocket.cpp

24aa2ba84a61b048eb98682ce5a42b52

C source, ASCII text, with CRLF line terminators

KTdiStreamSocket.h

89120c0763ec94bcfe561bb459886db4

C++ source, ASCII text, with CRLF line terminators

Misc.cpp

a3522564174eb2c6ac941806e5c096d5

C source, ISO-8859 text, with CRLF line terminators

Misc.h

81b28d42fab65a644a4229e1faccc7a8

C source, ISO-8859 text, with CRLF line terminators

Pefile.cpp

f32ca721c7cb11e64c28394dcb571bb7

C source, ASCII text, with CRLF line terminators

Pefile.h

c33de707adc61b6d904e4743e500a502

C source, ASCII text, with CRLF line terminators

PeHeader.h

d31ef3c26f19a42a0be85e5aec19f2ff

C source, ASCII text, with CRLF line terminators

do.h

cca5f45c1c79de3944fe05b9a79751f9

ISO-8859 text, with CRLF line terminators

DriverObjectHook.cpp

94f681c37c07fc7e51d0284b07a1b2b5

C source, ISO-8859 text, with CRLF line terminators

DriverObjectHook.h

3aba28b1c705d6e43ca5278ea8addb30

C source, ASCII text, with CRLF line terminators

FileSystemHook.cpp

b16673a6a0135c0bd9b89068f9ade41f

C source, ISO-8859 text, with CRLF line terminators

FileSystemHook.h

f9765c2fcb5746c2fbdbea657ededfdc

C source, ASCII text, with CRLF line terminators

He4Command.h

d42d02df80212422008f140bc43b28e8

C source, ASCII text, with CRLF line terminators

He4HookInv.cpp

030cd15b688238dd2b96fde9e692ad48

C source, ISO-8859 text, with CRLF line terminators

He4HookInv.h

9ee27a9770c63c7ec9919c587c00d49f

C source, ASCII text, with CRLF line terminators

SaveObjectsList.cpp

e398e28e200427bd985eaaa5271ea659

C source, ISO-8859 text, with CRLF line terminators

SaveObjectsList.h

bcc6ca26793601debe12e55efc12b168

C source, ASCII text, with CRLF line terminators

UnlockClientsList.cpp

a7a5bab86d298f3c7edbc16c821f51f5

C source, ASCII text, with CRLF line terminators

UnlockClientsList.h

15cbfacd853b8796f3924e39f478c78e

C source, ASCII text, with CRLF line terminators

He4HookInv.sys

8ebe3a158144b56672a4ccffd24ed8f7

PE32 executable (native) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections

He4HookInv.dsp

2a1cee4172bfd4ee71791677c5dbb3a2

ASCII text, with very long lines (532), with CRLF line terminators

He4HookInv.dsw

afacd5a08635a177ebd44fa71e8cce62

ASCII text, with CRLF line terminators

He4HookInv.dsp

1c7bd1051b2bab53ed88bda52c434b7d

ASCII text, with very long lines (540), with CRLF line terminators

He4HookInv.dsw

afacd5a08635a177ebd44fa71e8cce62

ASCII text, with CRLF line terminators

He4Boot.cpp

2ee74586c82e9c5643e2ed57da7ca30d

C source, ASCII text, with CRLF line terminators

He4Boot.dsp

ff88f46860b975622e32c2b2ae8add87

ASCII text, with very long lines (361), with CRLF line terminators

He4Boot.dsw

68c8b8cab3b82445b9505b5b7e329dd5

ASCII text, with CRLF line terminators

ntdll.h

59fb0279121fe1cd0ddfdacec3ef43c5

C source, ISO-8859 text, with CRLF line terminators

He4HookBootDriverHide.cpp

98a26094fbb628e5e34a59b857ac21cb

C source, ASCII text, with CRLF line terminators

He4HookBootDriverHide.hpp

df2d7a3d51a398ffb7dd1cb39f7de009

C++ source, ASCII text, with CRLF line terminators

He4NDISBootDriver.cpp

2ea50dbd201685c3a2ed52e89313efd5

C source, ASCII text, with CRLF line terminators

He4NDISBootDriver.hpp

9382e1939efd7f14096f7d58f2db072b

C++ source, ASCII text, with CRLF line terminators

NtBootDriverControlHide.cpp

53371c5da98cc8c3b29fa342eb7fde8f

C source, ASCII text, with CRLF line terminators

NtBootDriverControlHide.hpp

35e1b9de0222259e46eb87b850728c77

C++ source, ASCII text, with CRLF line terminators

He4HookDriverHide.cpp

9198a3d0912ac89214accc5ddc65a913

C source, ASCII text, with CRLF, LF line terminators

He4HookDriverHide.hpp

d1300e0add062a269321bb8207eaa51b

C++ source, ASCII text, with CRLF line terminators

NtDriverControlHide.cpp

02efc4e262b0fd943ea512fe2423ee33

C source, ISO-8859 text, with CRLF line terminators

NtDriverControlHide.hpp

83743143650aae2e4fb16d4d766cbda6

C++ source, ISO-8859 text, with CRLF line terminators

He4HookControl.dsp

d9b4f55efb00428dedc36966886dc59f

ASCII text, with very long lines (361), with CRLF line terminators

He4HookControl.dsw

0a7bed2e4a3cfc2e93f6a9e7e81fd779

ASCII text, with CRLF line terminators

main.cpp

da821ae8eeb3a70bf60b09092838189a

C source, ASCII text, with CRLF line terminators

He4HookControl.exe

dc4a68f8b4d6bd0cb2737824e8b579d8

PE32 executable (console) Intel 80386, for MS Windows, 3 sections

NtProcessList.cpp

cab1f19392bb3ca0764e56fee3fb4ecd

C source, ISO-8859 text, with CRLF line terminators

NtProcessList.h

d80228742e850af51840fa7be1f3bc65

C source, ISO-8859 text, with CRLF line terminators

He4HookInv.sys

1f5db1674c2522be578bc16ffd0d8ea8

PE32 executable (native) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections

COPYING

7b0683f0a63b15f8cc8273f96fd564a9

ASCII text

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 46/62

JavaScript (1)

	URL	Size	First Seen	Last Seen
	about:certerror?e=nssBadCert&u=https%3A//vrtulex.net/download/windows/rootkity/He4Hook215b6.zip&c=UTF-8&d=%20	0 B	2023-03-07	2024-05-02
Pretty URL about:certerror?e=nssBadCert&u=https%3A//vrtulex.net/download/windows/rootkity/He4Hook215b6.zip&c=UTF-8&d=%20 IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-02 02:49:54 Times Seen37261250 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (2)

URL IP Response Size

vrtulex.net/download/windows/rootkity/He4Hook215b6.zip

185.8.165.81

200 OK

178 B

URL User Request GET HTTP/1.1
vrtulex.net/download/windows/rootkity/He4Hook215b6.zip
IP
185.8.165.81:443
ASN
#24971 Master Internet s.r.o.

Certificate
IssuerZeroSSL
Subjectjadro-windows.cz
Fingerprint07:1B:0F:76:DB:F5:C6:0E:DC:F6:DF:AE:D5:5B:F3:1D:39:C9:0E:E4
ValiditySat, 13 Jan 2024 00:00:00 GMT - Fri, 12 Apr 2024 23:59:59 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
178 B (178 bytes)
Hash
bd2695f4b079c71dbddde3436286fb9c
733c05da132193d6cf1d8e242d12e2525c03bab4
2e04a18ff185ba5b16f762a0538339bc4049aceaef9738edd43af77d2ceb788b

HTTP Headers

GET /download/windows/rootkity/He4Hook215b6.zip HTTP/1.1
Host: vrtulex.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 19 Apr 2024 03:25:17 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://vrtulex.net/download/windows/rootkity/He4Hook215b6.zip

vrtulex.net/download/windows/rootkity/He4Hook215b6.zip

185.8.165.81

200 OK

247 kB

URL User Request GET HTTP/1.1
vrtulex.net/download/windows/rootkity/He4Hook215b6.zip
IP
185.8.165.81:443
ASN
#24971 Master Internet s.r.o.

Certificate
IssuerZeroSSL
Subjectjadro-windows.cz
Fingerprint07:1B:0F:76:DB:F5:C6:0E:DC:F6:DF:AE:D5:5B:F3:1D:39:C9:0E:E4
ValiditySat, 13 Jan 2024 00:00:00 GMT - Fri, 12 Apr 2024 23:59:59 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
247 kB (247411 bytes)
Hash
85afd95db7acf27673621b08b632a980
a7248ca1eabc9c00fae63fdd5939f4157939259e
c45aa411204f5fbb444d8b86d2ad9accb92825614f51909d39205e5ebae8c2ec

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 46/62

HTTP Headers

GET /download/windows/rootkity/He4Hook215b6.zip HTTP/1.1
Host: vrtulex.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 19 Apr 2024 03:25:19 GMT
Content-Type: application/zip
Content-Length: 247411
Last-Modified: Wed, 08 Jun 2016 12:29:48 GMT
Connection: keep-alive
ETag: "57580fbc-3c673"
Strict-Transport-Security: max-age=0;
Accept-Ranges: bytes

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (78)

Detections

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (2)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers