Report - c4dkey.vip.cpolar.cn/d/ChinaCloud/Tools/USBRedirector+Ksa.zip

Report Overview

Visited public
2023-12-11 17:26:51
Tags
URL
c4dkey.vip.cpolar.cn/d/ChinaCloud/Tools/USBRedirector+Ksa.zip
Finishing URL
about:privatebrowsing
IP / ASN
61.160.195.97
#4134 Chinanet
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
zerossl.ocsp.sectigo.com	4049	2018-08-16	2020-05-09 21:05:29	2023-12-11 05:09:34	348 B	808 B	172.64.149.23
c4dkey.vip.cpolar.cn	unknown	2018-12-16	2023-11-12 09:52:23	2023-12-11 18:26:10	970 B	4.0 kB	61.160.195.97
ocsp.global.sheca.com	unknown	1998-12-25	2022-06-20 14:45:50	2023-12-10 12:24:06	704 B	4.4 kB	47.246.44.227
media-jsyz-fy-person.js6oss.ctyunxs.cn	unknown	2021-03-05	2023-09-14 11:22:58	2023-11-03 10:43:35	976 B	10 MB	180.97.176.198

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
media-jsyz-fy-person.js6oss.ctyunxs.cn/PERSONCLOUD/28117d30-9107-454b-a90b-426f716941fe.zip?response-content-disposition=attachment%3Bfilename%3D%22USBRedirector%2BKsa.zip%22%3Bfilename*%3DUTF-8%27%27USBRedirector%252BKsa.zip&x-amz-CLIENTNETWORK=UNKNOWN&x-amz-CLOUDTYPEIN=PERSON&x-amz-CLIENTTYPEIN=PC&Signature=YumYhIGKY%2BKNAYPLAZ37ruwzxCM%3D&AWSAccessKeyId=0Lg7dAq3ZfHvePP8DKEU&x-amz-userLevel=100&Expires=1702315886&x-amz-limitrate=51200&x-amz-FSIZE=10228989&x-amz-UID=788699741&x-amz-UFID=82489195757324990
IP
180.97.176.198
ASN
#146966 China Telecom

File type
Zip archive data, at least v2.0 to extract, compression method=deflate - data
Size
10 MB (10228989 bytes)
Hash
0afec9e9cee175f805382925a30b1fd1
8d9a646a8af2e9079ad17179a9e0507614628fd1
17ac593ef552abd078b644de029cff6dccd1dc6e02afdcb3746f84b6ad82ba69

Archive (4)

Filename

Md5

File type

key.txt

912459aa2a534ac8f553c2b8144f027c

ASCII text, with CRLF line terminators

ksa_win.exe

c42c5792fcfb2108232bd69c49842776

PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections

usbredirector_setup.exe

82ecea455b209901ff8f00a3953a63a4

PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections

usbredirector_setup64.exe

413e7201e28049927120deeec6be2a60

PE32+ executable (GUI) x86-64, for MS Windows, 6 sections

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (6)

	URL	IP	Response	Size
	zerossl.ocsp.sectigo.com/	172.64.149.23		316 B
URL zerossl.ocsp.sectigo.com/ IP 172.64.149.23:0 ASN #13335 CLOUDFLARENET File type data Size 316 B (316 bytes) Hash e4770eb55e11d06d6c6165a1eb4aeb99 0cc844dd2d618c8f0c2fa278eb17ea64983e6fc5 3648b55ae9f7c5ad367ed095f180e0c32aa58f115bbb277c617128467504c7c4 HTTP Headers `POST / HTTP/1.1 Host: zerossl.ocsp.sectigo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 84 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Date: Mon, 11 Dec 2023 17:26:23 GMT Content-Type: application/ocsp-response Content-Length: 316 Connection: keep-alive Last-Modified: Mon, 11 Dec 2023 14:29:22 GMT Expires: Mon, 18 Dec 2023 14:29:21 GMT Etag: "0cc844dd2d618c8f0c2fa278eb17ea64983e6fc5" Cache-Control: max-age=593577,s-maxage=1800,public,no-transform,must-revalidate X-CCACDN-Proxy-ID: mcdpinlb4 X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 833f6ead6a1e712d-OSL`

	c4dkey.vip.cpolar.cn/d/ChinaCloud/Tools/USBRedirector+Ksa.zip	61.160.195.97	302 Found	2.6 kB
URL User Request GET HTTP/1.1 c4dkey.vip.cpolar.cn/d/ChinaCloud/Tools/USBRedirector+Ksa.zip IP 61.160.195.97:80 ASN #4134 Chinanet File type HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document, ASCII text Size 2.6 kB (2578 bytes) Hash d172343539d5d03a5aa3ec14703b8b6c f60589968a7045e3a0c8c6a63af974f0c74a1e28 604093e36aac1a9d3362e3006e8c55086a4ebfc3e89e8ed6d70c26f32410b720 HTTP Headers GET /d/ChinaCloud/Tools/USBRedirector+Ksa.zip HTTP/1.1 Host: c4dkey.vip.cpolar.cn User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/2 404 Not Found content-type: text/html; charset=utf-8 content-length: 2578 date: Mon, 11 Dec 2023 17:26:56 GMT X-Firefox-Spdy: h2`

	c4dkey.vip.cpolar.cn/d/ChinaCloud/Tools/USBRedirector+Ksa.zip	61.160.195.97	302 Found	585 B
URL User Request GET HTTP/1.1 c4dkey.vip.cpolar.cn/d/ChinaCloud/Tools/USBRedirector+Ksa.zip IP 61.160.195.97:80 ASN #4134 Chinanet File type HTML document, ASCII text, with very long lines (583) Size 585 B (585 bytes) Hash 275250d80cd98cbb7352dd7fb0e25e3e a6ff24bdbb3402be0c8e4fb5aa3a8d9672771cfd e4a2dec9f48474b27992cf2c1cf0863e4a40a6f053c9d4b7720480c6b478f751 HTTP Headers `GET /d/ChinaCloud/Tools/USBRedirector+Ksa.zip HTTP/1.1 Host: c4dkey.vip.cpolar.cn User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache` HTTP/1.1 302 Found Cache-Control: max-age=0, no-cache, no-store, must-revalidate Content-Length: 585 Content-Type: text/html; charset=utf-8 Date: Mon, 11 Dec 2023 17:26:26 GMT Location: https://media-jsyz-fy-person.js6oss.ctyunxs.cn/PERSONCLOUD/28117d30-9107-454b-a90b-426f716941fe.zip?response-content-disposition=attachment%3Bfilename%3D%22USBRedirector%2BKsa.zip%22%3Bfilename*%3DUTF-8%27%27USBRedirector%252BKsa.zip&x-amz-CLIENTNETWORK=UNKNOWN&x-amz-CLOUDTYPEIN=PERSON&x-amz-CLIENTTYPEIN=PC&Signature=YumYhIGKY%2BKNAYPLAZ37ruwzxCM%3D&AWSAccessKeyId=0Lg7dAq3ZfHvePP8DKEU&x-amz-userLevel=100&Expires=1702315886&x-amz-limitrate=51200&x-amz-FSIZE=10228989&x-amz-UID=788699741&x-amz-UFID=82489195757324990 Referrer-Policy: no-referrer

	ocsp.global.sheca.com/dvscag5	47.246.44.227		1.5 kB
URL ocsp.global.sheca.com/dvscag5 IP 47.246.44.227:0 ASN #24429 Zhejiang Taobao Network Co.,Ltd File type data Size 1.5 kB (1492 bytes) Hash 05f7b1ab5c22be4b79d0f56998f78e5b c9b88c7d673e4e48178ae2f96b5fd22597365d99 058f48d60919248d7b5b9079a84f8ee1d7e8806e91dd795aa3d49b8b3a79a9aa HTTP Headers `POST /dvscag5 HTTP/1.1 Host: ocsp.global.sheca.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` HTTP/1.1 200 OK Server: Tengine Content-Type: application/ocsp-response Content-Length: 1492 Connection: keep-alive Date: Sun, 10 Dec 2023 18:31:10 GMT Cache-Control: max-age=86400, public, no-transform, must-revalidate Etag: "005f7b1ab5c22be4b79d0f56998f78e5b" Expires: Thu, 14 Dec 2023 18:56:56 GMT Last-Modified: Sat, 09 Dec 2023 18:56:56 GMT Ali-Swift-Global-Savetime: 1702233070 Via: cache21.l2de2[0,0,200-0,H], cache19.l2de2[1,0], cache2.se1[0,10,200-0,H], cache2.se1[12,0] Age: 82517 X-Cache: HIT TCP_HIT dirn:6:121205421 X-Swift-SaveTime: Mon, 11 Dec 2023 01:29:02 GMT X-Swift-CacheTime: 61328 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Timing-Allow-Origin: * EagleId: 2ff62c9617023155874033440e

	ocsp.global.sheca.com/dvscag5	47.246.44.228		1.5 kB
URL ocsp.global.sheca.com/dvscag5 IP 47.246.44.228:0 ASN #24429 Zhejiang Taobao Network Co.,Ltd File type data Size 1.5 kB (1490 bytes) Hash da9b1cf80efc8bae6f22f07b14791d8e 5560965bbf58ea121c21d3d6d1957d6672643ec6 7cdb5f2a5290430e862f1071cfa19dab20c105345cf7f81216dfc442f703b868 HTTP Headers `POST /dvscag5 HTTP/1.1 Host: ocsp.global.sheca.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` HTTP/1.1 200 OK Server: Tengine Content-Type: application/ocsp-response Content-Length: 1490 Connection: keep-alive Date: Mon, 11 Dec 2023 17:26:27 GMT Cache-Control: max-age=86400, public, no-transform, must-revalidate Etag: "0da9b1cf80efc8bae6f22f07b14791d8e" Expires: Fri, 15 Dec 2023 19:26:05 GMT Last-Modified: Sun, 10 Dec 2023 19:26:05 GMT Ali-Swift-Global-Savetime: 1702315587 Via: cache21.l2de2[479,479,200-0,M], cache16.l2de2[482,0], cache1.se1[505,505,200-0,M], cache1.se1[507,0] X-Cache: MISS TCP_MISS dirn:-2:-2 X-Swift-SaveTime: Mon, 11 Dec 2023 17:26:27 GMT X-Swift-CacheTime: 86400 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Timing-Allow-Origin: * EagleId: 2ff62c9517023155872425951e

	media-jsyz-fy-person.js6oss.ctyunxs.cn/PERSONCLOUD/28117d30-9107-454b-a90b-426f716941fe.zip?response-content-disposition=attachment%3Bfilename%3D%22USBRedirector%2BKsa.zip%22%3Bfilename*%3DUTF-8%27%27USBRedirector%252BKsa.zip&x-amz-CLIENTNETWORK=UNKNOWN&x-amz-CLOUDTYPEIN=PERSON&x-amz-CLIENTTYPEIN=PC&Signature=YumYhIGKY%2BKNAYPLAZ37ruwzxCM%3D&AWSAccessKeyId=0Lg7dAq3ZfHvePP8DKEU&x-amz-userLevel=100&Expires=1702315886&x-amz-limitrate=51200&x-amz-FSIZE=10228989&x-amz-UID=788699741&x-amz-UFID=82489195757324990	180.97.176.198	200 OK	10 MB
URL User Request GET HTTP/1.1 media-jsyz-fy-person.js6oss.ctyunxs.cn/PERSONCLOUD/28117d30-9107-454b-a90b-426f716941fe.zip?response-content-disposition=attachment%3Bfilename%3D%22USBRedirector%2BKsa.zip%22%3Bfilename%3DUTF-8%27%27USBRedirector%252BKsa.zip&x-amz-CLIENTNETWORK=UNKNOWN&x-amz-CLOUDTYPEIN=PERSON&x-amz-CLIENTTYPEIN=PC&Signature=YumYhIGKY%2BKNAYPLAZ37ruwzxCM%3D&AWSAccessKeyId=0Lg7dAq3ZfHvePP8DKEU&x-amz-userLevel=100&Expires=1702315886&x-amz-limitrate=51200&x-amz-FSIZE=10228989&x-amz-UID=788699741&x-amz-UFID=82489195757324990 IP 180.97.176.198:443 ASN #146966 China Telecom Certificate IssuerUniTrust Subject.js6oss.ctyunxs.cn Fingerprint2F:B1:03:1F:FD:17:68:E9:E8:17:4B:F9:D4:4A:CE:F1:38:D3:4D:DF ValidityMon, 20 Nov 2023 06:58:13 GMT - Fri, 20 Dec 2024 15:59:59 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate - data Size 10 MB (10228989 bytes) Hash 0afec9e9cee175f805382925a30b1fd1 8d9a646a8af2e9079ad17179a9e0507614628fd1 17ac593ef552abd078b644de029cff6dccd1dc6e02afdcb3746f84b6ad82ba69 HTTP Headers GET /PERSONCLOUD/28117d30-9107-454b-a90b-426f716941fe.zip?response-content-disposition=attachment%3Bfilename%3D%22USBRedirector%2BKsa.zip%22%3Bfilename%3DUTF-8%27%27USBRedirector%252BKsa.zip&x-amz-CLIENTNETWORK=UNKNOWN&x-amz-CLOUDTYPEIN=PERSON&x-amz-CLIENTTYPEIN=PC&Signature=YumYhIGKY%2BKNAYPLAZ37ruwzxCM%3D&AWSAccessKeyId=0Lg7dAq3ZfHvePP8DKEU&x-amz-userLevel=100&Expires=1702315886&x-amz-limitrate=51200&x-amz-FSIZE=10228989&x-amz-UID=788699741&x-amz-UFID=82489195757324990 HTTP/1.1 Host: media-jsyz-fy-person.js6oss.ctyunxs.cn User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/1.1 200 OK Server: XOS Date: Mon, 11 Dec 2023 17:26:27 GMT Content-Type: application/octet-stream Content-Length: 10228989 Connection: keep-alive Accept-Ranges: bytes Last-Modified: Sat, 08 Apr 2023 12:50:19 GMT x-rgw-object-type: Normal ETag: "dce45dfeffc4b0cc81a064a9da38f0f4-0" Content-Disposition: attachment;filename="USBRedirector+Ksa.zip";filename=UTF-8''USBRedirector%2BKsa.zip x-amz-request-id: tx0000308c58-0065774643 x-amz-bucket-owner: bssUser100000000409 x-amz-op-type: GET_OBJ x-amz-user-account: bssUser100000000409 x-amz-storage-class: STANDARD

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (4)

Detections

JavaScript (0)

HTTP Transactions (6)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers