Report - cdn.yonyoucloud.com/pro/uclient/uclients/2.0.0-build_202402011123

Report Overview

Visitedpublic

2024-03-12 02:31:31

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
cdn.yonyoucloud.com	unknown	2013-05-11	2018-03-01 13:25:03	2024-03-05 15:39:24	539 B	7.0 MB	163.181.50.52
aus5.mozilla.org	2548	1998-01-24	2015-10-27 08:06:24	2024-03-11 18:13:28	511 B	1.2 kB	35.244.181.201

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

cdn.yonyoucloud.com/pro/uclient/uclients/2.0.0-build_202402011123_Windows/UClient.exe

IP / ASN

163.181.50.52

#24429 Zhejiang Taobao Network Co.,Ltd

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

Size7.0 MB (6977536 bytes)

MD5829d8fcb47bd6dedba3102cbe7e12119

SHA1b16c740d93abb1bd8c38e30184f13453df8f4932

SHA256c5ca3799eca0932a472bd0bf33a21d438624391eb908b872ee74668ffd964635

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 6/69

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

GET cdn.yonyoucloud.com/pro/uclient/uclients/2.0.0-build_202402011123_Windows/UClient.exe

163.181.50.52

200 OK

7.0 MB

URL

cdn.yonyoucloud.com/pro/uclient/uclients/2.0.0-build_202402011123_Windows/UClient.exe

IP / ASN

163.181.50.52

#24429 Zhejiang Taobao Network Co.,Ltd

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

First Seen2024-03-05

Last Seen2024-08-20

Times Seen2

Size7.0 MB (6977536 bytes)

MD5829d8fcb47bd6dedba3102cbe7e12119

SHA1b16c740d93abb1bd8c38e30184f13453df8f4932

SHA256c5ca3799eca0932a472bd0bf33a21d438624391eb908b872ee74668ffd964635

Certificate Info

IssuerGlobalSign nv-sa

Subject*.yonyoucloud.com

Fingerprint1B:DF:07:5B:E6:15:73:F6:F8:4E:6B:0C:1C:B8:FA:D7:E9:10:4D:63

ValidityFri, 05 Jan 2024 07:54:25 GMT - Wed, 05 Feb 2025 07:54:24 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 6/69

HTTP Headers

GET /pro/uclient/uclients/2.0.0-build_202402011123_Windows/UClient.exe HTTP/1.1
Host: cdn.yonyoucloud.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Tengine
content-type: application/octet-stream
content-length: 6977536
date: Tue, 12 Mar 2024 01:32:04 GMT
x-oss-request-id: 65EFB094AC3032373618B2FB
x-oss-cdn-auth: success
accept-ranges: bytes
x-oss-object-type: Normal
x-oss-storage-class: Standard
x-oss-version-id: CAEQLBiBgIC.9P2P6xgiIDgxYzk2MTM2YzA1MDRjMWViMTdkN2Q0ZTIzNjExZTQ2
content-md5: gp2Py0e9be26MQLL5+EhGQ==
x-oss-server-time: 50
ali-swift-global-savetime: 1710207124
via: cache2.l2de2[0,0,304-0,H], cache23.l2de2[0,0], cache10.it3[0,0,200-0,H], cache3.it3[4,0]
etag: "829D8FCB47BD6DEDBA3102CBE7E12119"
last-modified: Thu, 01 Feb 2024 09:27:49 GMT
x-oss-hash-crc64ecma: 6108911859011960047
age: 3541
x-cache: HIT TCP_MEM_HIT dirn:12:765847941
x-swift-savetime: Tue, 12 Mar 2024 01:39:23 GMT
x-swift-cachetime: 3600
access-control-expose-headers: EagleId
access-control-allow-methods: GET,OPTIONS
access-control-allow-origin: *
timing-allow-origin: *
eagleid: a3b5329717102106653291382e
X-Firefox-Spdy: h2

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-97-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

35.244.181.201

444 B

URL

aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-97-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml

IP / ASN

35.244.181.201

#396982 GOOGLE-CLOUD-PLATFORM

Requested byN/A

Resource Info

File typeXML 1.0 document, ASCII text, with very long lines (332)

First Seen2023-10-13

Last Seen2025-06-20

Times Seen185315

Size444 B (444 bytes)

MD53b324dec137a87ef7e24a30a65b13dd0

SHA1c0faa95b2f1018e264b3a14aaf50d1003e6c27b3

SHA2566cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463

HTTP Headers

GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-97-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-04-29-22-13-57.chain; p384ecdsa=BGab7xSDc2-sw84Js4D7qVd3DedTqdiiWRUCmtp1n57Mtv-TVgMlT39LB_RA0ELlWrm1xWKvg8U_WjchiR0M_-a5xvEozWLUtZP1Dx2r2g6hykV4048XcEPKnDqwNJc4
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
date: Tue, 12 Mar 2024 02:29:43 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 101
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2