Report - c2.kemono.party/data/7c/00/7c009cec454621153b24da2c5c3fb537dea1d2340243620b8390a5a8ec1fa361.zip?f=Project%20Physalis_AsuiQuickie.apk

Report Overview

Visited public
2023-11-27 17:26:52
Tags
URL
c2.kemono.party/data/7c/00/7c009cec454621153b24da2c5c3fb537dea1d2340243620b8390a5a8ec1fa361.zip?f=Project%20Physalis_AsuiQuickie.apk
Finishing URL
about:privatebrowsing
IP / ASN
91.149.227.2
#58110 IP Volume LTD
Title

Detections

urlquery

0

Network Intrusion Detection

2

Threat Detection Systems

0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
c2.kemono.party	unknown	2020-01-03	2022-12-09 23:35:57	2023-11-25 21:01:28	598 B	462 B	91.149.227.2
ciscobinary.openh264.org	40822	2013-10-19	2014-10-07 07:43:56	2023-11-27 05:09:23	305 B	512 kB	2.22.61.59
c2.kemono.su	unknown	2022-08-25	2023-10-22 01:00:13	2023-11-26 17:06:06	597 B	33 MB	0.0.0.0

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-27 17:26:34	medium	Client IP	Internal IP	ET DNS Query for .su TLD (Soviet Union) Often Malware Related
2023-11-27 17:26:34	medium	Client IP	Internal IP	ET DNS Query for .su TLD (Soviet Union) Often Malware Related

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
IP
2.22.61.59
ASN
#20940 Akamai International B.V.

File type
Zip archive data, at least v2.0 to extract, compression method=deflate\012- data
Size
512 kB (511815 bytes)
Hash
152eda253e242e18443ef3282495bc7c
ff0fa85565f21ec4931baad4573b4c0bd08c4019
8e03090fee16f6e0ee2e436af8e51d0c3deed6d9f0db80dec048e668fc009a48

JavaScript (0)

HTTP Transactions (3)

	URL	IP	Response	Size
	c2.kemono.party/data/7c/00/7c009cec454621153b24da2c5c3fb537dea1d2340243620b8390a5a8ec1fa361.zip?f=Project%20Physalis_AsuiQuickie.apk	91.149.227.2		164 B
URL c2.kemono.party/data/7c/00/7c009cec454621153b24da2c5c3fb537dea1d2340243620b8390a5a8ec1fa361.zip?f=Project%20Physalis_AsuiQuickie.apk IP 91.149.227.2:0 ASN #58110 IP Volume LTD File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Size 164 B (164 bytes) Hash f23c4815ecaef1588f16ac735c0e15d6 026bf8cdd5076014b6fc822878e0086eb44da556 43a81fb3d47b34e7d42d6b8444f592ed9251b8e57db8f67d32419aa40b1480d0 HTTP Headers GET /data/7c/00/7c009cec454621153b24da2c5c3fb537dea1d2340243620b8390a5a8ec1fa361.zip?f=Project%20Physalis_AsuiQuickie.apk HTTP/1.1 Host: c2.kemono.party User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/2 308 Permanent Redirect server: nginx date: Mon, 27 Nov 2023 17:24:48 GMT content-type: text/html content-length: 164 location: https://c2.kemono.su/data/7c/00/7c009cec454621153b24da2c5c3fb537dea1d2340243620b8390a5a8ec1fa361.zip?f=Project%20Physalis_AsuiQuickie.apk X-Firefox-Spdy: h2`

	ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip	2.22.61.59		512 kB
URL ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip IP 2.22.61.59:0 ASN #20940 Akamai International B.V. File type Zip archive data, at least v2.0 to extract, compression method=deflate\012- data Size 512 kB (511815 bytes) Hash 152eda253e242e18443ef3282495bc7c ff0fa85565f21ec4931baad4573b4c0bd08c4019 8e03090fee16f6e0ee2e436af8e51d0c3deed6d9f0db80dec048e668fc009a48 HTTP Headers `GET /openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1 Host: ciscobinary.openh264.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive` `HTTP/1.1 200 OK Last-Modified: Thu, 16 Nov 2023 07:38:15 GMT ETag: 152eda253e242e18443ef3282495bc7c Content-Length: 511815 Accept-Ranges: bytes X-Timestamp: 1700120294.87662 Content-Type: application/zip X-Trans-Id: tx35e1afa589ba4bd9a93ea-006556c567dfw1 Cache-Control: public, max-age=38542 Expires: Tue, 28 Nov 2023 04:09:12 GMT Date: Mon, 27 Nov 2023 17:26:50 GMT Connection: keep-alive`

	c2.kemono.su/data/7c/00/7c009cec454621153b24da2c5c3fb537dea1d2340243620b8390a5a8ec1fa361.zip?f=Project%20Physalis_AsuiQuickie.apk	0.0.0.0		33 MB
URL User Request GET c2.kemono.su/data/7c/00/7c009cec454621153b24da2c5c3fb537dea1d2340243620b8390a5a8ec1fa361.zip?f=Project%20Physalis_AsuiQuickie.apk IP 0.0.0.0:0 ASN #0 Certificate IssuerLet's Encrypt Subjectc2.kemono.su FingerprintC1:9B:03:13:98:09:77:61:EC:4D:9A:CB:D9:04:46:BD:05:45:E5:96 ValiditySat, 21 Oct 2023 21:59:47 GMT - Fri, 19 Jan 2024 21:59:46 GMT File type Size 33 MB (33260064 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers GET /data/7c/00/7c009cec454621153b24da2c5c3fb537dea1d2340243620b8390a5a8ec1fa361.zip?f=Project%20Physalis_AsuiQuickie.apk HTTP/1.1 Host: c2.kemono.su User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/2 200 OK server: nginx date: Mon, 27 Nov 2023 17:24:48 GMT content-type: application/zip content-length: 33260064 last-modified: Tue, 09 Mar 2021 06:48:13 GMT etag: "60471a2d-1fb8220" content-disposition: inline; filename=Project%20Physalis_AsuiQuickie.apk accept-ranges: bytes X-Firefox-Spdy: h2`