Report - basharast.github.io/wut/app/telnet.zip

Report Overview

Visitedpublic

2024-10-07 21:41:26

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-10-07 11:57:05	327 B	888 B	23.36.77.32
basharast.github.io	unknown	2013-03-08	2021-11-29 21:03:34	2024-03-10 08:37:20	492 B	16 kB	185.199.109.153

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

basharast.github.io/wut/app/telnet.zip

IP / ASN

185.199.109.153

#54113 FASTLY

File Overview

File TypeZip archive data, at least v2.0 to extract, compression method=deflate

Size16 kB (15655 bytes)

MD5980e815754239ccf207a676cd8e1134c

SHA12cd149e4043c632e149eaa2728a0422f62f99ce1

SHA2561f627bf2f239dc4edd07b320a509ee12e4ab76ebcc0f515b296262903c9874ef

Archive (1)

Modified	Filename	Size	MD5	File type
2021-10-21 14:49	TelnetServer.exe	27 kB	35e8f27b3832d928aeea3158bd240a74	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/57

JavaScript (0)

HTTP Transactions (2)

URL IP Response Size

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-10-07

Last Seen2024-10-11

Times Seen3335

Size504 B (504 bytes)

MD51c6ec54110f6660628ae2b384e9db497

SHA160ea2745eec8480cb26cc9f830ce11a59b1fd0a6

SHA256947763a82d6d4a247a00032dab950c3911e201ce626fe9c87d8c6254635fdd3d

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "947763A82D6D4A247A00032DAB950C3911E201CE626FE9C87D8C6254635FDD3D"
Last-Modified: Mon, 07 Oct 2024 18:28:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12569
Expires: Tue, 08 Oct 2024 01:10:30 GMT
Date: Mon, 07 Oct 2024 21:41:01 GMT
Connection: keep-alive

GET basharast.github.io/wut/app/telnet.zip

185.199.109.153

200 OK

16 kB

URL

basharast.github.io/wut/app/telnet.zip

IP / ASN

185.199.109.153

#54113 FASTLY

Requested byN/A

Resource Info

File typeZip archive data, at least v2.0 to extract, compression method=deflate

First Seen2023-07-14

Last Seen2025-07-21

Times Seen20

Size16 kB (15655 bytes)

MD5980e815754239ccf207a676cd8e1134c

SHA12cd149e4043c632e149eaa2728a0422f62f99ce1

SHA2561f627bf2f239dc4edd07b320a509ee12e4ab76ebcc0f515b296262903c9874ef

Certificate Info

IssuerDigiCert Inc

Subject*.github.io

Fingerprint97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28

ValidityFri, 15 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT

Detections

Analyzer	Verdict	Alert
VirusTotal	suspicious	VirusTotal - Scan result 1/57

HTTP Headers

GET /wut/app/telnet.zip HTTP/1.1
Host: basharast.github.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: GitHub.com
content-type: application/zip
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Tue, 20 Aug 2024 02:10:15 GMT
access-control-allow-origin: *
etag: "66c3fb07-3d27"
expires: Mon, 07 Oct 2024 21:51:01 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: 7204:322B62:71E6F0:7503AC:6704556C
accept-ranges: bytes
age: 0
date: Mon, 07 Oct 2024 21:41:01 GMT
via: 1.1 varnish
x-served-by: cache-hel1410029-HEL
x-cache: MISS
x-cache-hits: 0
x-timer: S1728337261.381140,VS0,VE146
vary: Accept-Encoding
x-fastly-request-id: 01db09d026a1258c3f047cc08fbfdda7936ec2d4
content-length: 15655
X-Firefox-Spdy: h2