Report - edcthmedu.serveblog.net/Bin/ScreenConnect.Windows.dll

Report Overview

Visitedpublic

2024-08-05 18:31:37

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
edcthmedu.serveblog.net	unknown				2.0 kB	1.6 MB	45.88.186.241
r10.o.lencr.org	unknown				2.0 kB	5.3 kB	23.36.77.32

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

edcthmedu.serveblog.net/Bin/ScreenConnect.Windows.dll

IP / ASN

45.88.186.241

#23470 RELIABLESITE

File Overview

File TypePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Size820 kB (819534 bytes)

MD5254d64388c6c52228d7a921960a03f6b

SHA1b023b69348bb06c4b4ad67bee0f55bb9cfb3748c

SHA25605e78416a344f74095e36ff14baa719867e9e163e1ae9a96c29df8615748b0ae

URL

edcthmedu.serveblog.net/Bin/ScreenConnect.Windows.dll

IP / ASN

45.88.186.241

#23470 RELIABLESITE

File Overview

File TypePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Size820 kB (819534 bytes)

MD5254d64388c6c52228d7a921960a03f6b

SHA1b023b69348bb06c4b4ad67bee0f55bb9cfb3748c

SHA25605e78416a344f74095e36ff14baa719867e9e163e1ae9a96c29df8615748b0ae

JavaScript (0)

HTTP Transactions (10)

URL IP Response Size

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-04

Last Seen2024-08-19

Times Seen13648

Size504 B (504 bytes)

MD5addc02313d62bf977d4b5dd463b48637

SHA149b5e37e2888a9db981bd54827c4f4c7b9f7b53a

SHA2569b553a61256a129f9c5c31614a702c4f0441a3f018cc2b3897ab2cc16e184eeb

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "9B553A61256A129F9C5C31614A702C4F0441A3F018CC2B3897AB2CC16E184EEB"
Last-Modified: Sat, 03 Aug 2024 18:28:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3106
Expires: Mon, 05 Aug 2024 19:22:57 GMT
Date: Mon, 05 Aug 2024 18:31:11 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-04

Last Seen2024-08-21

Times Seen24116

Size504 B (504 bytes)

MD5084406a853d82fa208410ee4bc78b67c

SHA11c6276ec2e9a0fa10937dc34d821a64633c7d16a

SHA2566d567507b5502a9e553e77b519b679e83b3a8a01896731cec08bd1da0699b379

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "6D567507B5502A9E553E77B519B679E83B3A8A01896731CEC08BD1DA0699B379"
Last-Modified: Sat, 03 Aug 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16406
Expires: Mon, 05 Aug 2024 23:04:37 GMT
Date: Mon, 05 Aug 2024 18:31:11 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-03

Last Seen2024-08-19

Times Seen30175

Size504 B (504 bytes)

MD58bd7201be8d12c4b511d2c5643b45dbc

SHA1f2ecb2ebafbf4f8d92f92007753001befcedc634

SHA25625cb2e6ad29d4503f32121fbe37e2b0f4ce64a7f6cb57233ebf16df5d6b78d53

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "25CB2E6AD29D4503F32121FBE37E2B0F4CE64A7F6CB57233EBF16DF5D6B78D53"
Last-Modified: Sat, 03 Aug 2024 18:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10864
Expires: Mon, 05 Aug 2024 21:32:16 GMT
Date: Mon, 05 Aug 2024 18:31:12 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-04

Last Seen2024-08-21

Times Seen29425

Size504 B (504 bytes)

MD53653abf0951eea060f104ae59d60cf7c

SHA175790e8c59cb78c77ab522e7dc7140b62a046bb9

SHA256d059eeda67b64dd02259f5a9352df39cc808e3f9e03068a434e0f6486814893d

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "D059EEDA67B64DD02259F5A9352DF39CC808E3F9E03068A434E0F6486814893D"
Last-Modified: Sat, 03 Aug 2024 18:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2495
Expires: Mon, 05 Aug 2024 19:12:47 GMT
Date: Mon, 05 Aug 2024 18:31:12 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-04

Last Seen2024-08-21

Times Seen27770

Size504 B (504 bytes)

MD578be19d93b8add0d8f3c63b67e490038

SHA12ed9c5d656a70a78ced84cd8fedbf0dcceb35bd6

SHA256b8a162cbf6a846ccd9bd65a8744c313d48c66700352346c24777bdc1c2358726

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B8A162CBF6A846CCD9BD65A8744C313D48C66700352346C24777BDC1C2358726"
Last-Modified: Sat, 03 Aug 2024 18:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14359
Expires: Mon, 05 Aug 2024 22:30:33 GMT
Date: Mon, 05 Aug 2024 18:31:14 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.77.32

504 B

URL

r10.o.lencr.org/

IP / ASN

23.36.77.32

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-08-04

Last Seen2024-08-21

Times Seen27770

Size504 B (504 bytes)

MD578be19d93b8add0d8f3c63b67e490038

SHA12ed9c5d656a70a78ced84cd8fedbf0dcceb35bd6

SHA256b8a162cbf6a846ccd9bd65a8744c313d48c66700352346c24777bdc1c2358726

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B8A162CBF6A846CCD9BD65A8744C313D48C66700352346C24777BDC1C2358726"
Last-Modified: Sat, 03 Aug 2024 18:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14359
Expires: Mon, 05 Aug 2024 22:30:33 GMT
Date: Mon, 05 Aug 2024 18:31:14 GMT
Connection: keep-alive

edcthmedu.serveblog.net/favicon.ico

45.88.186.241

1.9 kB

URL

edcthmedu.serveblog.net/favicon.ico

IP / ASN

45.88.186.241

#23470 RELIABLESITE

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with CRLF line terminators

First Seen2023-04-11

Last Seen2025-07-25

Times Seen1656

Size1.9 kB (1896 bytes)

MD5efa352ec75b8a0ae8e2dd58d876575a8

SHA16d03edbfb5ada3c6122ec521c740163932897072

SHA25622c7a38d8509b322ab9460aeca4419462a5373f51c39bcd1ab15521a196d69d8

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: edcthmedu.serveblog.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://edcthmedu.serveblog.net/Bin/ScreenConnect.Windows.dll
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
cache-control: private
content-length: 1896
content-type: text/html; charset=utf-8
server: ScreenConnect/23.2.9.8466-427637685 Microsoft-HTTPAPI/2.0
date: Mon, 05 Aug 2024 18:31:13 GMT
X-Firefox-Spdy: h2

edcthmedu.serveblog.net/Bin/ScreenConnect.Windows.dll

45.88.186.241

820 kB

URL

edcthmedu.serveblog.net/Bin/ScreenConnect.Windows.dll

IP / ASN

45.88.186.241

#23470 RELIABLESITE

Requested byN/A

Resource Info

File typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

First Seen2023-04-17

Last Seen2025-01-27

Times Seen32

Size820 kB (819534 bytes)

MD5254d64388c6c52228d7a921960a03f6b

SHA1b023b69348bb06c4b4ad67bee0f55bb9cfb3748c

SHA25605e78416a344f74095e36ff14baa719867e9e163e1ae9a96c29df8615748b0ae

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /Bin/ScreenConnect.Windows.dll HTTP/1.1
Host: edcthmedu.serveblog.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: private
content-length: 819534
content-type: text/html
content-encoding: gzip
server: ScreenConnect/23.2.9.8466-427637685 Microsoft-HTTPAPI/2.0
date: Mon, 05 Aug 2024 18:31:12 GMT
X-Firefox-Spdy: h2

edcthmedu.serveblog.net/favicon.ico

45.88.186.241

1.9 kB

URL

edcthmedu.serveblog.net/favicon.ico

IP / ASN

45.88.186.241

#23470 RELIABLESITE

Requested byN/A

Resource Info

File typeHTML document, ASCII text, with CRLF line terminators

First Seen2023-04-11

Last Seen2025-07-25

Times Seen1656

Size1.9 kB (1896 bytes)

MD5efa352ec75b8a0ae8e2dd58d876575a8

SHA16d03edbfb5ada3c6122ec521c740163932897072

SHA25622c7a38d8509b322ab9460aeca4419462a5373f51c39bcd1ab15521a196d69d8

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: edcthmedu.serveblog.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://edcthmedu.serveblog.net/Bin/ScreenConnect.Windows.dll
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
cache-control: private
content-length: 1896
content-type: text/html; charset=utf-8
server: ScreenConnect/23.2.9.8466-427637685 Microsoft-HTTPAPI/2.0
date: Mon, 05 Aug 2024 18:31:16 GMT
X-Firefox-Spdy: h2

edcthmedu.serveblog.net/Bin/ScreenConnect.Windows.dll

45.88.186.241

820 kB

URL

edcthmedu.serveblog.net/Bin/ScreenConnect.Windows.dll

IP / ASN

45.88.186.241

#23470 RELIABLESITE

Requested byN/A

Resource Info

File typePE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

First Seen2023-04-17

Last Seen2025-01-27

Times Seen32

Size820 kB (819534 bytes)

MD5254d64388c6c52228d7a921960a03f6b

SHA1b023b69348bb06c4b4ad67bee0f55bb9cfb3748c

SHA25605e78416a344f74095e36ff14baa719867e9e163e1ae9a96c29df8615748b0ae

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - DynDNS domain

HTTP Headers

GET /Bin/ScreenConnect.Windows.dll HTTP/1.1
Host: edcthmedu.serveblog.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: private
content-length: 819534
content-type: text/html
content-encoding: gzip
server: ScreenConnect/23.2.9.8466-427637685 Microsoft-HTTPAPI/2.0
date: Mon, 05 Aug 2024 18:31:15 GMT
X-Firefox-Spdy: h2