IP 104.21.64.1:80
File typePE32 executable (GUI) Intel 80386, for MS Windows, 8 sections Size1.9 MB (1889792 bytes) Hash92beef1d585b98dbf7641f3aa93f51f0 48224b7184af2548c639bd919f1cd21c3fef0fa0 a3d66a48ab9f7c78985f36a9eccbacba1f68a34fb1e32201e3d1f6756cc5d938
| Analyzer | Verdict | Alert |
|---|
| RussianPanda public YARA rules | malware | Detects XRed backdoor | | VirusTotal | malicious | |
| NIDS | Severity | Alert |
|---|
| suricata | high | ET MALWARE Single char EXE direct download likely trojan (multiple families) | | suricata | medium | ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile | | suricata | medium | ET HUNTING Terse Named Filename EXE Download - Possibly Hostile | | suricata | high | ET POLICY PE EXE or DLL Windows file download HTTP | | suricata | low | ET INFO EXE - Served Attached HTTP |
GET /d.exe HTTP/1.1
Host: pic.wzy1999.wang
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 30 Apr 2025 21:29:50 GMT
Content-Type: application/octet-stream
Content-Length: 1889792
Connection: keep-alive
Last-Modified: Sat, 26 Oct 2024 09:48:50 GMT
Content-Disposition: attachment; filename="d.exe";
CF-Cache-Status: BYPASS
Set-Cookie: HFS_SID=0.439023605780676; path=/;
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BIEULtO98%2B4NtktCjhYYtuQaD5fvw4mUsUNgjiBYrLly9Wnd1PJH%2FjjHGCf7k%2Fz0wNrTGMLxi5asv%2B%2BIp4WxXC%2BMve7k6cOcX7J0xodQRnfyrW1MtRNGcv1XP2vxjsq5x14r"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 938a2302d8a956ca-OSL
alt-svc: h2=":443"; ma=60
server-timing: cfL4;desc="?proto=TCP&rtt=450&min_rtt=450&rtt_var=225&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=406&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
|
IP104.21.16.1:443
CertificateIssuerGoogle Trust Services Subjectwzy1999.wang FingerprintC0:0F:29:78:CE:E5:E0:56:86:3A:FF:26:9C:63:A7:03:30:A6:13:2A ValidityMon, 17 Mar 2025 07:28:04 GMT - Sun, 15 Jun 2025 08:26:29 GMT
File typeHTML document, ASCII text, with very long lines (394) Hash3f1f04063d203c11c26ae8d9101e4d59 a3bf35e3529b3c4de9f15b281e1fbbf676ecd865 3c8b017817d6b1c8fc2ab98f517af4279620981c38f4604b3a1cbb681258cfbb
| NIDS | Severity | Alert |
|---|
| suricata | high | ET MALWARE Single char EXE direct download likely trojan (multiple families) | | suricata | medium | ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile | | suricata | medium | ET HUNTING Terse Named Filename EXE Download - Possibly Hostile | | suricata | high | ET POLICY PE EXE or DLL Windows file download HTTP | | suricata | low | ET INFO EXE - Served Attached HTTP |
GET /d.exe HTTP/1.1
Host: pic.wzy1999.wang
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 521 No Reason Phrase
date: Wed, 30 Apr 2025 21:29:49 GMT
content-type: text/html; charset=UTF-8
content-length: 6833
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FLZIYmXB%2F4rP4uy8hboW5aGdZtd%2B87lsvX5f3qyfNyesLbFqwRq2MmJQK0zXvHfRnnj%2Bsjdg4vtxvtNDcitePlQD68%2FF0dE2RkVLrOoGka6kUpkkjU38zrC7UmLnIm89uppc"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
referrer-policy: same-origin
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
server: cloudflare
cf-ray: 938a2300789056b5-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=5860&min_rtt=395&rtt_var=10907&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3275&recv_bytes=1259&delivery_rate=7554782&cwnd=254&unsent_bytes=0&cid=1fbd37af8cb56e66&ts=311&x=0"
X-Firefox-Spdy: h2
|