Report - ar.rghost.net/download/56816249/2c72ee4496af03ca1ee2f3ad1199b434748aff93/crypted.exe

Report Overview

Visitedpublic

2025-04-07 08:55:16

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
ar.rghost.net	unknown	2007-07-15	2012-06-22	2025-02-10	552 B	8.2 kB	172.67.212.239

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-04-07 08:55:15	high	Client IP	172.67.212.239	ET HUNTING Download Request Containing Suspicious Filename - Crypted

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET ar.rghost.net/download/56816249/2c72ee4496af03ca1ee2f3ad1199b434748aff93/crypted.exe

172.67.212.239

522 No Reason Phrase

7.1 kB

URL

ar.rghost.net/download/56816249/2c72ee4496af03ca1ee2f3ad1199b434748aff93/crypted.exe

IP / ASN

172.67.212.239

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with very long lines (460)

First Seen2025-04-07

Last Seen2025-04-07

Times Seen1

Size7.1 kB (7105 bytes)

MD5fb919e8ad5298372d9c64ca22f78054c

SHA1e6d341d6249ff93405a29fa935ac45f0fecc4c03

SHA25670849d32158e40e42b8afc028b99e190bff70cab8bf730bf06250204454d7a18

Certificate Info

IssuerGoogle Trust Services

Subjectrghost.net

Fingerprint06:72:B0:1B:F5:09:91:5A:C2:BE:45:A7:44:3B:FB:B1:08:BD:69:C6

ValidityTue, 11 Mar 2025 16:21:21 GMT - Mon, 09 Jun 2025 17:19:53 GMT

Detections

Analyzer	Verdict	Alert
suricata	high	ET HUNTING Download Request Containing Suspicious Filename - Crypted

HTTP Headers

GET /download/56816249/2c72ee4496af03ca1ee2f3ad1199b434748aff93/crypted.exe HTTP/1.1
Host: ar.rghost.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 522 No Reason Phrase
date: Mon, 07 Apr 2025 08:55:14 GMT
content-type: text/html; charset=UTF-8
content-length: 7105
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4NXcx9UeCvL3MNNCiyiolxF2KHx%2BFVxH6504YDcxxAwGqWXZHLSnuFqSHLLg6%2Fh3ueKcZ%2FEy73GOiUuRALvlqjE5AfEAvkU9TUV2MBFgmdXR55vrvyunPD8aujJOb3t%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
referrer-policy: same-origin
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
set-cookie: cf_ob_info=522:92c84d918c1d0b31:OSL; path=/; expires=Mon, 07-Apr-25 08:55:44 GMT
cf_use_ob=443; path=/; expires=Mon, 07-Apr-25 08:55:44 GMT
server: cloudflare
cf-ray: 92c84d918c1d0b31-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=6652&min_rtt=466&rtt_var=12161&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3270&recv_bytes=1299&delivery_rate=7144736&cwnd=250&unsent_bytes=0&cid=f7b2cb1daabfeb15&ts=19360&x=0"
X-Firefox-Spdy: h2