Report - s3.alphaconsole.io/bakkesmod/CookedPCConsole/ForgeMode/ForgeMode.zip

Report Overview

Visited public
2025-04-29 09:39:40
Tags
URL
s3.alphaconsole.io/bakkesmod/CookedPCConsole/ForgeMode/ForgeMode.zip
Finishing URL
about:privatebrowsing
IP / ASN
104.21.80.208
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
s3.alphaconsole.io	unknown	2022-11-02	2024-02-12	2025-04-29	536 B	5.5 MB	172.67.153.209

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
s3.alphaconsole.io/bakkesmod/CookedPCConsole/ForgeMode/ForgeMode.zip
IP
172.67.153.209
ASN
#13335 CLOUDFLARENET

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
5.5 MB (5476175 bytes)
Hash
23006811e0109cea3edae1bf92863e41
73b74bd3228e4c987e38088a84b75c99b55065f1
6ebda17e51594b118cfb0604ad6e4647a65cdc20fe54261a4aa3a0b9041dd379

Archive (6)

Filename

Md5

File type

FM_Core.upk

26b768d12fa1d3cccecb31f83e484b10

Unreal Engine package (little-endian), version 867, folder "None", names: 85, imports: 34, exports: 12

FM_Column.upk

35f88e9dd1613564388d5fe0610ef1b0

Unreal Engine package (little-endian), version 867, folder "None", names: 97, imports: 38, exports: 20

FM_Cone.upk

d7941bde95640c074df9deb4240fc4d3

Unreal Engine package (little-endian), version 867, folder "None", names: 121, imports: 40, exports: 22

FM_Crate.upk

379a65e0c0657ecba4c0763ec39125be

Unreal Engine package (little-endian), version 867, folder "None", names: 123, imports: 40, exports: 22

FM_Kicker.upk

64882a8bf1117dbb796ba1e91ab61438

Unreal Engine package (little-endian), version 867, folder "None", names: 95, imports: 36, exports: 20

FM_Ring.upk

052b95c4e093758fdd32fe38b131a41d

Unreal Engine package (little-endian), version 867, folder "None", names: 96, imports: 36, exports: 20

Detections

Analyzer	Verdict	Alert
CAPEv2 YARA detection rules	malware	Cobalt Strike Beacon Payload

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

	URL	IP	Response	Size
	s3.alphaconsole.io/bakkesmod/CookedPCConsole/ForgeMode/ForgeMode.zip	172.67.153.209	200 OK	5.5 MB
URL User Request GET s3.alphaconsole.io/bakkesmod/CookedPCConsole/ForgeMode/ForgeMode.zip IP 172.67.153.209:443 ASN #13335 CLOUDFLARENET Certificate IssuerGoogle Trust Services Subjects3.alphaconsole.io FingerprintAF:FC:AE:01:15:E7:FD:DF:94:EF:68:18:8C:13:47:95:98:93:A0:72 ValidityThu, 24 Apr 2025 00:54:39 GMT - Wed, 23 Jul 2025 01:54:33 GMT File type Zip archive data, at least v1.0 to extract, compression method=store Size 5.5 MB (5476175 bytes) Hash 23006811e0109cea3edae1bf92863e41 73b74bd3228e4c987e38088a84b75c99b55065f1 6ebda17e51594b118cfb0604ad6e4647a65cdc20fe54261a4aa3a0b9041dd379 HTTP Headers GET /bakkesmod/CookedPCConsole/ForgeMode/ForgeMode.zip HTTP/1.1 Host: s3.alphaconsole.io User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/2 200 OK date: Tue, 29 Apr 2025 09:39:04 GMT content-type: application/zip content-length: 5476175 accept-ranges: bytes etag: "23006811e0109cea3edae1bf92863e41" last-modified: Sun, 05 Jan 2025 21:22:59 GMT vary: Accept-Encoding cache-control: max-age=14400 cf-cache-status: MISS report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VYOq9PrN2GqTbrZStiG1z51BmTIGmqZoXprxUj81LdR2YD%2FWNJKSuaBOjyujfBkvqkfySeD8GSSdx%2B3xlMQcq6Z3sx69Zy0mi0pk4SVh%2BsrarT%2BTXcZ8fU5dx%2FQR4hlhuHfUTpI%3D"}],"group":"cf-nel","max_age":604800} nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server: cloudflare cf-ray: 937dd481cc5d0b41-OSL alt-svc: h3=":443"; ma=86400 server-timing: cfCacheStatus;desc="MISS", cfL4;desc="?proto=TCP&rtt=6305&min_rtt=430&rtt_var=11713&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3274&recv_bytes=1294&delivery_rate=6928229&cwnd=254&unsent_bytes=0&cid=1f4889d7d4102a3e&ts=290&x=0" X-Firefox-Spdy: h2

s3.alphaconsole.io/bakkesmod/CookedPCConsole/ForgeMode/ForgeMode.zip

172.67.153.209

200 OK

5.5 MB

URL User Request GET
s3.alphaconsole.io/bakkesmod/CookedPCConsole/ForgeMode/ForgeMode.zip
IP
172.67.153.209:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjects3.alphaconsole.io
FingerprintAF:FC:AE:01:15:E7:FD:DF:94:EF:68:18:8C:13:47:95:98:93:A0:72
ValidityThu, 24 Apr 2025 00:54:39 GMT - Wed, 23 Jul 2025 01:54:33 GMT

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
5.5 MB (5476175 bytes)
Hash
23006811e0109cea3edae1bf92863e41
73b74bd3228e4c987e38088a84b75c99b55065f1
6ebda17e51594b118cfb0604ad6e4647a65cdc20fe54261a4aa3a0b9041dd379

HTTP Headers

GET /bakkesmod/CookedPCConsole/ForgeMode/ForgeMode.zip HTTP/1.1
Host: s3.alphaconsole.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 29 Apr 2025 09:39:04 GMT
content-type: application/zip
content-length: 5476175
accept-ranges: bytes
etag: "23006811e0109cea3edae1bf92863e41"
last-modified: Sun, 05 Jan 2025 21:22:59 GMT
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VYOq9PrN2GqTbrZStiG1z51BmTIGmqZoXprxUj81LdR2YD%2FWNJKSuaBOjyujfBkvqkfySeD8GSSdx%2B3xlMQcq6Z3sx69Zy0mi0pk4SVh%2BsrarT%2BTXcZ8fU5dx%2FQR4hlhuHfUTpI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 937dd481cc5d0b41-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfCacheStatus;desc="MISS", cfL4;desc="?proto=TCP&rtt=6305&min_rtt=430&rtt_var=11713&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3274&recv_bytes=1294&delivery_rate=6928229&cwnd=254&unsent_bytes=0&cid=1f4889d7d4102a3e&ts=290&x=0"
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (6)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers