Report - zandronum.com/downloads/testing/3.1/ZandroDev3.1-180429-2031windows.zip

Report Overview

Visited public
2024-09-18 03:26:27
Tags
URL
zandronum.com/downloads/testing/3.1/ZandroDev3.1-180429-2031windows.zip
Finishing URL
about:privatebrowsing
IP / ASN
45.56.67.39
#63949 Akamai Connected Cloud
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r11.o.lencr.org	unknown	2020-06-29	2024-06-07 07:43:57	2024-09-17 18:12:27	327 B	888 B	23.36.76.226
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-09-17 18:12:05	1.6 kB	4.4 kB	23.36.77.32
zandronum.com	unknown	2012-05-30	2014-05-05 16:56:59	2024-04-18 14:12:58	525 B	4.2 MB	45.56.67.39

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
zandronum.com/downloads/testing/3.1/ZandroDev3.1-180429-2031windows.zip
IP
45.56.67.39
ASN
#63949 Akamai Connected Cloud

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
4.2 MB (4184595 bytes)
Hash
117deb72ed5a2d27619903e5080c73e7
a261be046b13091237ceffec85e1eb1f615a4dfb
f51b3e6fa954bc37cdde2005f50ea569fbe51aff7ffb2eed87b16ba7e76a3a41

Archive (4)

Filename

Md5

File type

fmodex.dll

788d2837a82c1810d2c6916375acc6ef

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections

skulltag_actors.pk3

14792ced806bb679d0b7b5a3fc2d4f2d

Zip archive data, at least v2.0 to extract, compression method=deflate

zandronum.exe

6828841b62cc5805469a5a346bf83df0

PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections

zandronum.pk3

afa44300a0f3800c2d8e77333df9f214

Zip archive data, at least v2.0 to extract, compression method=deflate

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (7)

	URL	IP	Response	Size
	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash a4e61c096fb8a0f28561b209588076fe 84634c409a230cba663826d593379499fce545a8 17f85499c27b8bafbc202dc51cd5e7fa80be0988a0d820dbf8a4c81344f26da9 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "17F85499C27B8BAFBC202DC51CD5E7FA80BE0988A0D820DBF8A4C81344F26DA9" Last-Modified: Tue, 17 Sep 2024 12:20:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=17147 Expires: Wed, 18 Sep 2024 08:11:42 GMT Date: Wed, 18 Sep 2024 03:25:55 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash b4ddabe3dc0fdf5ea3a82a9aebbb01c6 bfbff7cc66b83f1e16d8739a987f175866a6de68 73c53b2f9ea6cb310eb9df3e6d917f4649a2c2470b3ae7ee1e4bbb7102550016 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "73C53B2F9EA6CB310EB9DF3E6D917F4649A2C2470B3AE7EE1E4BBB7102550016" Last-Modified: Sun, 15 Sep 2024 21:19:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=15045 Expires: Wed, 18 Sep 2024 07:36:40 GMT Date: Wed, 18 Sep 2024 03:25:55 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 946bd983da8ed3f6d5c12abcab5273e0 eaf94210f1202240080722b9f0a78aa64b6cc1b3 f772e410f6d95169a72a7473bf8ff96f7c642b0e8cd820c34b9debdfc367c44e HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "F772E410F6D95169A72A7473BF8FF96F7C642B0E8CD820C34B9DEBDFC367C44E" Last-Modified: Tue, 17 Sep 2024 14:37:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=4863 Expires: Wed, 18 Sep 2024 04:46:58 GMT Date: Wed, 18 Sep 2024 03:25:55 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash a31eb23bb83183cf82d06967d5e3f31e 803053eed17ab1e4d902c93d5f20ae6e930c89e4 116549023fd841d0418e44c97968a7f84c98b643b76ce6b9a94ca70446de13f1 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "116549023FD841D0418E44C97968A7F84C98B643B76CE6B9A94CA70446DE13F1" Last-Modified: Tue, 17 Sep 2024 14:38:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=5167 Expires: Wed, 18 Sep 2024 04:52:02 GMT Date: Wed, 18 Sep 2024 03:25:55 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash d7797a1388130634532149b4e1fb0d11 c55969a1885b5dbcdf039b466f2260b0e76814ca 2ee2abd8cadea1431d08f6d04abd7017a8d8c57ffb92d102a5a60c8c32899f3f HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "2EE2ABD8CADEA1431D08F6D04ABD7017A8D8C57FFB92D102A5A60C8C32899F3F" Last-Modified: Tue, 17 Sep 2024 19:53:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=12798 Expires: Wed, 18 Sep 2024 06:59:14 GMT Date: Wed, 18 Sep 2024 03:25:56 GMT Connection: keep-alive`

	zandronum.com/downloads/testing/3.1/ZandroDev3.1-180429-2031windows.zip	45.56.67.39	200 OK	4.2 MB
URL User Request GET HTTP/1.1 zandronum.com/downloads/testing/3.1/ZandroDev3.1-180429-2031windows.zip IP 45.56.67.39:443 ASN #63949 Akamai Connected Cloud Certificate IssuerLet's Encrypt Subjectauth.zandronum.com Fingerprint6E:60:B9:CF:16:07:42:9A:BC:74:D9:C8:AE:6F:90:45:8E:32:0C:7D ValidityMon, 05 Aug 2024 20:57:13 GMT - Sun, 03 Nov 2024 20:57:12 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 4.2 MB (4184595 bytes) Hash 117deb72ed5a2d27619903e5080c73e7 a261be046b13091237ceffec85e1eb1f615a4dfb f51b3e6fa954bc37cdde2005f50ea569fbe51aff7ffb2eed87b16ba7e76a3a41 HTTP Headers GET /downloads/testing/3.1/ZandroDev3.1-180429-2031windows.zip HTTP/1.1 Host: zandronum.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 03:25:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 01 May 2018 20:01:15 GMT ETag: "3fda13-56b2a6ec8b8c0" Accept-Ranges: bytes Content-Length: 4184595 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/zip`

	r11.o.lencr.org/	23.36.76.226		504 B
URL r11.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 45c440d4cead985bd4f1f69f84162f7b 1251ec50f9cfdb548fe2e0fef4cbb146fd92a56b 91127a16631d0d606cac9cac289cf04f0ccb542d3f8954ef4bc5caaef374c238 HTTP Headers `POST / HTTP/1.1 Host: r11.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "91127A16631D0D606CAC9CAC289CF04F0CCB542D3F8954EF4BC5CAAEF374C238" Last-Modified: Tue, 17 Sep 2024 14:39:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10880 Expires: Wed, 18 Sep 2024 06:27:17 GMT Date: Wed, 18 Sep 2024 03:25:57 GMT Connection: keep-alive`

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (4)

Detections

JavaScript (0)

HTTP Transactions (7)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers