Report - 58.215.245.2:9000/help.scr

Report Overview

Visited public
2024-10-19 16:13:50
Tags
Submit Tags
urlhaus
URL
58.215.245.2:9000/help.scr
Finishing URL
about:privatebrowsing
IP / ASN
58.215.245.2
#4134 Chinanet
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
58.215.245.2	unknown	unknown	No data	No data	396 B	9.4 MB	58.215.245.2

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-10-19 16:13:24	high	Client IP	58.215.245.2	ThreatFox Coinminer payload delivery (ip:port - confidence level: 100%)
2024-10-19 16:13:24	high	Client IP	58.215.245.2	URLhaus Known malware download URL detected (2888479)
2024-10-19 16:13:24	high	Client IP	58.215.245.2	ThreatFox payload delivery (url - confidence level: 100%)
2024-10-19 16:13:24	low	Client IP	58.215.245.2	ET HUNTING HTTP request for resource ending in .scr
2024-10-19 16:13:25	high	58.215.245.2	Client IP	ET POLICY PE EXE or DLL Windows file download HTTP
2024-10-19 16:13:25	medium	58.215.245.2	Client IP	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-10-19	medium	58.215.245.2:9000/help.scr	meth_get_eip
2024-10-19	medium	58.215.245.2:9000/help.scr	meth_stackstrings
2024-10-19	medium	58.215.245.2:9000/help.scr	pe_detect_tls_callbacks

OpenPhish

No alerts detected

PhishTank

No alerts detected

Mnemonic Secure DNS

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-10-19	medium	58.215.245.2	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET 58.215.245.2:9000/help.scr

58.215.245.2

200 OK

9.4 MB

URL User Request GET HTTP/1.1
58.215.245.2:9000/help.scr
IP
58.215.245.2:9000
ASN
#4134 Chinanet

File type
PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
Size
9.4 MB (9402368 bytes)
Hash
6b4f06f6c6c73a1d56c5a66be8306541
2af7e6175abe6f102520b61a92e03990c80cc2f4
1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip
YARAhub by abuse.ch	malware	meth_stackstrings
YARAhub by abuse.ch	malware	pe_detect_tls_callbacks
Quad9 DNS	malicious	Sinkholed
VirusTotal	malicious	VirusTotal - Scan result 65/73
ClamAV	malicious	Win.Malware.Mikey-9946342-0

HTTP Headers

GET /help.scr HTTP/1.1
Host: 58.215.245.2:9000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 19 Oct 2024 16:13:24 GMT
Server: Apache
Last-Modified: Thu, 16 May 2024 17:18:48 GMT
ETag: "8f7800-618956da0c3d2"
Accept-Ranges: bytes
Content-Length: 9402368
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Mnemonic Secure DNS

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (1)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers