Report Overview
Visitedpublic
2025-04-22 07:38:49
Tags
Submit Tags
URL
krnl.vip/krnl.msi
Finishing URL
about:privatebrowsing
IP / ASN
172.67.136.103
#13335 CLOUDFLARENET
Title
about:privatebrowsing

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
1

Host Summary

HostRankRegisteredFirst SeenLast Seen
krnl.vip
unknown2021-05-192021-05-262025-03-29
github.com
14232007-10-092016-07-132025-04-16
objects.githubusercontent.com
1340602014-02-062021-11-012025-04-16

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected


OpenPhish

No alerts detected


PhishTank

No alerts detected


Quad9 DNS

No alerts detected


ThreatFox

No alerts detected


File detected

URL
objects.githubusercontent.com/github-production-release-asset-2e65be/596410192/187d7d6d-8ad7-4f59-bb01-10ca6b37db43?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250422%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250422T073827Z&X-Amz-Expires=300&X-Amz-Signature=c7da051eb1618199329ec5ec6b009ec8fd9f78f01c9be783a2eab3b1f98ff8ed&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DKrnl_8.14.1_x64_en-US.msi&response-content-type=application%2Foctet-stream
IP / ASN
185.199.110.133
#54113 FASTLY
File Overview
File TypeComposite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: jjsploit, Author: wearedevs, Keywords: Installer, Comments: This installer database contains the logic and data required to install jjsploit., Template: x64;0, Revision Number: {520ECEE8-0814-41B5-A3A2-A3DC4D26C168}, Create Time/Date: Tue Mar 18 19:57:40 2025, Last Saved Time/Date: Tue Mar 18 19:57:40 2025, Number of Pages: 450, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
Size6.6 MB (6594560 bytes)
MD590fe4ea1323d1b17c90efdc69fa13cf5
SHA1b92333fd238d9bcf80cfd170251c0ed05ae5edc6

Detections

AnalyzerVerdictAlert
VirusTotalsuspicious

JavaScript (0)

HTTP Transactions (3)

URLIPResponseSize
GET krnl.vip/krnl.msi
172.67.136.103301 Moved Permanently6.6 MB
GET github.com/oculusapp/oculusapp.github.io/releases/download/1.1/Krnl_8.14.1_x64_en-US.msi
140.82.121.4302 Found6.6 MB
GET objects.githubusercontent.com/github-production-release-asset-2e65be/596410192/187d7d6d-8ad7-4f59-bb01-10ca6b37db43?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250422%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250422T073827Z&X-Amz-Expires=300&X-Amz-Signature=c7da051eb1618199329ec5ec6b009ec8fd9f78f01c9be783a2eab3b1f98ff8ed&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DKrnl_8.14.1_x64_en-US.msi&response-content-type=application%2Foctet-stream
185.199.110.133200 OK6.6 MB