Report - utorrent-backup-server3.top/update/TPB-1.exe

Report Overview

Visitedpublic

2025-01-03 08:17:06

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
utorrent-backup-server3.top	unknown	2021-09-27	2021-09-29	2024-12-25	414 B	370 kB	62.60.226.41

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-01-03 08:16:41	high	Client IP	62.60.226.41	ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
2025-01-03 08:16:41	medium	Client IP	62.60.226.41	ET INFO HTTP Request to a *.top domain
2025-01-03 08:16:41	high	62.60.226.41	Client IP	ET POLICY PE EXE or DLL Windows file download HTTP
2025-01-03 08:16:41	low	62.60.226.41	Client IP	ET HUNTING Possible EXE Download From Suspicious TLD

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-01-03	medium	utorrent-backup-server3.top	Sinkholed

ThreatFox

No alerts detected

File detected

URL

utorrent-backup-server3.top/update/TPB-1.exe

IP / ASN

62.60.226.41

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 6 sections

Size369 kB (369152 bytes)

MD5ed0fdaf80191fad95aa5c2a7882064e2

SHA1debe6e60480b524022308a7a0c66e0424f91dade

SHA25672a37e2a65b502af4a3fabf99f069bdb51a50cebb764fb6eb4a1920320dd849c

Detections

Analyzer	Verdict	Alert
VirusTotal	malicious	VirusTotal - Scan result 52/72

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET utorrent-backup-server3.top/update/TPB-1.exe

62.60.226.41

200 OK

369 kB

URL

utorrent-backup-server3.top/update/TPB-1.exe

IP / ASN

62.60.226.41

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 6 sections

First Seen2025-01-01

Last Seen2025-01-03

Times Seen5

Size369 kB (369152 bytes)

MD5ed0fdaf80191fad95aa5c2a7882064e2

SHA1debe6e60480b524022308a7a0c66e0424f91dade

SHA25672a37e2a65b502af4a3fabf99f069bdb51a50cebb764fb6eb4a1920320dd849c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed
VirusTotal	malicious	VirusTotal - Scan result 52/72
suricata	high	ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
suricata	medium	ET INFO HTTP Request to a *.top domain
suricata	high	ET POLICY PE EXE or DLL Windows file download HTTP
suricata	low	ET HUNTING Possible EXE Download From Suspicious TLD

HTTP Headers

GET /update/TPB-1.exe HTTP/1.1
Host: utorrent-backup-server3.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 03 Jan 2025 08:16:41 GMT
Server: Apache/2.4.58 (Ubuntu)
Last-Modified: Mon, 30 Dec 2024 08:28:07 GMT
ETag: "5a200-62a78979396b3"
Accept-Ranges: bytes
Content-Length: 369152
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/x-msdos-program