Report - lottocad.pl/download/downsql.zip

Report Overview

Visited public
2024-08-24 09:13:18
Tags
URL
lottocad.pl/download/downsql.zip
Finishing URL
about:privatebrowsing
IP / ASN
148.251.67.142
#24940 Hetzner Online GmbH
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-08-23 18:12:18	981 B	2.7 kB	23.33.119.27
r11.o.lencr.org	unknown	2020-06-29	2024-06-07 07:43:57	2024-08-23 18:12:28	1.3 kB	3.6 kB	23.33.119.57
lottocad.pl	unknown	2005-01-19	2014-11-28 16:32:37	2024-03-22 14:55:03	486 B	1.0 MB	148.251.67.142

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
lottocad.pl/download/downsql.zip
IP
148.251.67.142
ASN
#24940 Hetzner Online GmbH

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
1.0 MB (1035962 bytes)
Hash
2068ece875a24d2b8c3b3b5cacdb12fd
603004fd9976e5562480b1be95fb655c55f78d6d
c9a2077d354757501597ff2190e5a6020da3b905e5c11cb250636c8403b38f8d

Archive (1)

Filename

Md5

File type

downsql.dll

5df8fe21aaf5356689eaf778470fade1

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 8 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect files is `SliverFox` malware

JavaScript (0)

HTTP Transactions (8)

	URL	IP	Response	Size
	r10.o.lencr.org/	23.33.119.27		504 B
URL r10.o.lencr.org/ IP 23.33.119.27:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 34b72ef98ffb750d7e3020d58da271c5 a0b34c22554f5cadf812b8d1f818be5dc840f211 a0d352f8b8c2248c32607b1d77c3ff6ff7382a5df118182f69aae7d7145ee100 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "A0D352F8B8C2248C32607B1D77C3FF6FF7382A5DF118182F69AAE7D7145EE100" Last-Modified: Fri, 23 Aug 2024 14:35:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10329 Expires: Sat, 24 Aug 2024 12:05:01 GMT Date: Sat, 24 Aug 2024 09:12:52 GMT Connection: keep-alive`

	r11.o.lencr.org/	23.33.119.57		504 B
URL r11.o.lencr.org/ IP 23.33.119.57:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash a081f9755218e081db962afea1117844 fab4e95becdbacea971038e8f0ea80b4e1064e4b db03b08d76424bb0dd34b51c11cf222b9126bd1f6017afd35cb1c2d0c3d1f86e HTTP Headers `POST / HTTP/1.1 Host: r11.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "DB03B08D76424BB0DD34B51C11CF222B9126BD1F6017AFD35CB1C2D0C3D1F86E" Last-Modified: Fri, 23 Aug 2024 14:33:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=13590 Expires: Sat, 24 Aug 2024 12:59:22 GMT Date: Sat, 24 Aug 2024 09:12:52 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.33.119.27		504 B
URL r10.o.lencr.org/ IP 23.33.119.27:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 515f455d93caad6521481d99fc23e623 cb770c44b3e280f2151b3f5e887d61fbe0ef66fb cf43d0127c72bf58a1799b4e7ce0e5c9e18ec12e978df6dac9c17920a20173d5 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "CF43D0127C72BF58A1799B4E7CE0E5C9E18EC12E978DF6DAC9C17920A20173D5" Last-Modified: Fri, 23 Aug 2024 14:37:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10388 Expires: Sat, 24 Aug 2024 12:06:00 GMT Date: Sat, 24 Aug 2024 09:12:52 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.33.119.27		504 B
URL r10.o.lencr.org/ IP 23.33.119.27:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash f04a331cae60388b5b3c547bcdd5a8e8 a74ba9ea1965e39a78db26c6568b3524156f0b5c 133a1fe03de9efd148f43efda3cd37d24e4f5cc936d1008a8ce7aacc6653afa3 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "133A1FE03DE9EFD148F43EFDA3CD37D24E4F5CC936D1008A8CE7AACC6653AFA3" Last-Modified: Fri, 23 Aug 2024 14:38:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=11666 Expires: Sat, 24 Aug 2024 12:27:18 GMT Date: Sat, 24 Aug 2024 09:12:52 GMT Connection: keep-alive`

	r11.o.lencr.org/	23.33.119.27		504 B
URL r11.o.lencr.org/ IP 23.33.119.27:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash bd073dc5f9963e4575068d37f2fda738 2cc9e1d983095f9307ca4d8e13a4a4095707a4f1 eb2fff2f3c9e3d55b9024e4c340a1883daf12b284d9e0ea6faa90ac4a1cdc54a HTTP Headers `POST / HTTP/1.1 Host: r11.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "EB2FFF2F3C9E3D55B9024E4C340A1883DAF12B284D9E0EA6FAA90AC4A1CDC54A" Last-Modified: Sat, 24 Aug 2024 09:12:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=21567 Expires: Sat, 24 Aug 2024 15:12:19 GMT Date: Sat, 24 Aug 2024 09:12:52 GMT Connection: keep-alive`

	lottocad.pl/download/downsql.zip	148.251.67.142	200 OK	1.0 MB
URL User Request GET HTTP/2 lottocad.pl/download/downsql.zip IP 148.251.67.142:443 ASN #24940 Hetzner Online GmbH Certificate IssuerLet's Encrypt Subjectlottocad.pl FingerprintE6:CA:08:F5:0F:B9:29:BC:DC:D0:44:7F:03:AD:F8:C7:99:9D:0C:FF ValiditySat, 20 Jul 2024 00:04:13 GMT - Fri, 18 Oct 2024 00:04:12 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 1.0 MB (1035962 bytes) Hash 2068ece875a24d2b8c3b3b5cacdb12fd 603004fd9976e5562480b1be95fb655c55f78d6d c9a2077d354757501597ff2190e5a6020da3b905e5c11cb250636c8403b38f8d HTTP Headers `GET /download/downsql.zip HTTP/1.1 Host: lottocad.pl User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK date: Sat, 24 Aug 2024 09:12:54 GMT server: Apache/2.4 last-modified: Tue, 07 May 2024 12:08:25 GMT accept-ranges: bytes content-length: 1035962 content-type: application/zip X-Firefox-Spdy: h2`

	r11.o.lencr.org/	23.33.119.27		504 B
URL r11.o.lencr.org/ IP 23.33.119.27:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 858eda022f9abab07abe65d5db47bdd7 50676984a7c33451e955b30f0c2796d8cbd39b37 d5d1370d54dbc79eef9d826334b31217d5b9823cfd1d012036b1bc4f38b724b4 HTTP Headers `POST / HTTP/1.1 Host: r11.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "D5D1370D54DBC79EEF9D826334B31217D5B9823CFD1D012036B1BC4F38B724B4" Last-Modified: Fri, 23 Aug 2024 14:37:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=12850 Expires: Sat, 24 Aug 2024 12:47:04 GMT Date: Sat, 24 Aug 2024 09:12:54 GMT Connection: keep-alive`

	r11.o.lencr.org/	23.33.119.27		504 B
URL r11.o.lencr.org/ IP 23.33.119.27:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 858eda022f9abab07abe65d5db47bdd7 50676984a7c33451e955b30f0c2796d8cbd39b37 d5d1370d54dbc79eef9d826334b31217d5b9823cfd1d012036b1bc4f38b724b4 HTTP Headers `POST / HTTP/1.1 Host: r11.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "D5D1370D54DBC79EEF9D826334B31217D5B9823CFD1D012036B1BC4F38B724B4" Last-Modified: Fri, 23 Aug 2024 14:37:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=12850 Expires: Sat, 24 Aug 2024 12:47:04 GMT Date: Sat, 24 Aug 2024 09:12:54 GMT Connection: keep-alive`

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (1)

Detections

JavaScript (0)

HTTP Transactions (8)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers