Report - goldensoft.org/download/AutoClicker.exe

Report Overview

Visitedpublic

2024-07-10 16:03:47

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
goldensoft.org	501926	2008-04-03	2012-10-25 16:21:59	2024-04-12 21:31:32	493 B	872 kB	104.21.80.178
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-07-09 18:12:41	2.9 kB	8.0 kB	23.33.119.57

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-07-10	medium	goldensoft.org/download/AutoClicker.exe	files - file ~tmp01925d3f.exe
2024-07-10	medium	goldensoft.org/download/AutoClicker.exe	meth_get_eip
2024-07-10	medium	goldensoft.org/download/AutoClicker.exe	Identifies compiled AutoIT script (as EXE).

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

goldensoft.org/download/AutoClicker.exe

IP / ASN

104.21.80.178

#13335 CLOUDFLARENET

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

Size871 kB (871368 bytes)

MD5e42d679a626463742b553794dea6f62b

SHA1789c25a360342fd431dccbf01b831c36aa229317

SHA256e4a3b0ce536c0996082311077ac65a096d9e6bbf404c6e6a155ecefb32e864c5

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	meth_get_eip
Public InfoSec YARA rules	malware	Identifies compiled AutoIT script (as EXE).

JavaScript (0)

HTTP Transactions (10)

URL IP Response Size

r10.o.lencr.org/

23.33.119.57

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-08

Last Seen2024-08-19

Times Seen34939

Size504 B (504 bytes)

MD5b34ca6af54e2b9fea57d418f5d1928f7

SHA1510b69f4470789a573217726d6f1a3d6ee765460

SHA25641e6a348aac9e9db44bfa14b3aa29d411f4489b375ae1f1be6b0d280af98541d

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "41E6A348AAC9E9DB44BFA14B3AA29D411F4489B375AE1F1BE6B0D280AF98541D"
Last-Modified: Mon, 08 Jul 2024 01:53:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3445
Expires: Wed, 10 Jul 2024 17:00:46 GMT
Date: Wed, 10 Jul 2024 16:03:21 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.57

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-09

Last Seen2024-08-19

Times Seen16077

Size504 B (504 bytes)

MD5e08576e0904dc9903a9c20fa9e3d15b8

SHA174feff76140500fd4a61e89c7e9d8d0a60df1183

SHA256ee690bacddf55fd12ae0c9c39e330e0a1a18776b9edc91b4aa6c5bae28824f1e

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "EE690BACDDF55FD12AE0C9C39E330E0A1A18776B9EDC91B4AA6C5BAE28824F1E"
Last-Modified: Tue, 09 Jul 2024 15:28:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6522
Expires: Wed, 10 Jul 2024 17:52:03 GMT
Date: Wed, 10 Jul 2024 16:03:21 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.57

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-10

Last Seen2024-08-19

Times Seen39709

Size504 B (504 bytes)

MD5e7492695b5254a3a63fcffb4f1ee8cec

SHA10361713c6d8129210245347284c7c6babfd28fb7

SHA2565d1bc1c01894fd88a0d4680490977488d6458bb58a98ace24ef8aa103538bc1f

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5D1BC1C01894FD88A0D4680490977488D6458BB58A98ACE24EF8AA103538BC1F"
Last-Modified: Tue, 09 Jul 2024 23:47:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21472
Expires: Wed, 10 Jul 2024 22:01:14 GMT
Date: Wed, 10 Jul 2024 16:03:22 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.57

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-09

Last Seen2024-08-19

Times Seen12065

Size504 B (504 bytes)

MD59b556e25e514a3cd5829bc4d938e5517

SHA185eeba07dc1438e7433ce7a145500164d842d5db

SHA25622f599883dc87540746708049ea46ec4eb88c81c924ba145a58bebd5ee3199cb

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "22F599883DC87540746708049EA46EC4EB88C81C924BA145A58BEBD5EE3199CB"
Last-Modified: Tue, 09 Jul 2024 16:21:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2408
Expires: Wed, 10 Jul 2024 16:43:30 GMT
Date: Wed, 10 Jul 2024 16:03:22 GMT
Connection: keep-alive

GET goldensoft.org/download/AutoClicker.exe

104.21.80.178

200 OK

871 kB

URL User Request GET HTTPS

goldensoft.org/download/AutoClicker.exe

IP / ASN

104.21.80.178

#13335 CLOUDFLARENET

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

First Seen2023-09-04

Last Seen2025-06-12

Times Seen65

Size871 kB (871368 bytes)

MD5e42d679a626463742b553794dea6f62b

SHA1789c25a360342fd431dccbf01b831c36aa229317

SHA256e4a3b0ce536c0996082311077ac65a096d9e6bbf404c6e6a155ecefb32e864c5

Certificate Info

IssuerGoogle Trust Services

Subjectgoldensoft.org

FingerprintAA:B2:29:58:05:20:E2:9F:72:3E:67:5F:65:45:93:69:8C:04:9F:6D

ValiditySat, 29 Jun 2024 02:15:33 GMT - Fri, 27 Sep 2024 02:15:32 GMT

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	meth_get_eip
Public InfoSec YARA rules	malware	Identifies compiled AutoIT script (as EXE).

HTTP Headers

GET /download/AutoClicker.exe HTTP/1.1
Host: goldensoft.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 10 Jul 2024 16:03:22 GMT
content-type: application/octet-stream
content-length: 871368
last-modified: Thu, 30 Jun 2022 04:02:10 GMT
etag: "62bd2042-d4bc8"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 19452
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uXNNel5BrWQSroV398m2vds34vDO1xuytkl4uVSCJKfR0oUIgSQ8DK3LNIf8f%2BftLDTwvRTCbyMigvpHbaKfORGzHsDRs8yB0%2FRIoAOs5%2B7AK%2BT9L5pcN2vtafVtzTqv2A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8a11c8921f7b569c-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

r10.o.lencr.org/

23.33.119.27

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.33.119.27

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-08

Last Seen2024-08-19

Times Seen36963

Size504 B (504 bytes)

MD5d7b2c37e4b6c062d80ad32046f42d3d8

SHA1131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c

SHA256317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2"
Last-Modified: Mon, 08 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11264
Expires: Wed, 10 Jul 2024 19:11:08 GMT
Date: Wed, 10 Jul 2024 16:03:24 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.27

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.33.119.27

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-08

Last Seen2024-08-19

Times Seen36963

Size504 B (504 bytes)

MD5d7b2c37e4b6c062d80ad32046f42d3d8

SHA1131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c

SHA256317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2"
Last-Modified: Mon, 08 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11264
Expires: Wed, 10 Jul 2024 19:11:08 GMT
Date: Wed, 10 Jul 2024 16:03:24 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.27

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.33.119.27

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-08

Last Seen2024-08-19

Times Seen36963

Size504 B (504 bytes)

MD5d7b2c37e4b6c062d80ad32046f42d3d8

SHA1131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c

SHA256317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2"
Last-Modified: Mon, 08 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11264
Expires: Wed, 10 Jul 2024 19:11:08 GMT
Date: Wed, 10 Jul 2024 16:03:24 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.27

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.33.119.27

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-08

Last Seen2024-08-19

Times Seen36963

Size504 B (504 bytes)

MD5d7b2c37e4b6c062d80ad32046f42d3d8

SHA1131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c

SHA256317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2"
Last-Modified: Mon, 08 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11264
Expires: Wed, 10 Jul 2024 19:11:08 GMT
Date: Wed, 10 Jul 2024 16:03:24 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.27

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.33.119.27

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-07-08

Last Seen2024-08-19

Times Seen36963

Size504 B (504 bytes)

MD5d7b2c37e4b6c062d80ad32046f42d3d8

SHA1131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c

SHA256317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2"
Last-Modified: Mon, 08 Jul 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11264
Expires: Wed, 10 Jul 2024 19:11:08 GMT
Date: Wed, 10 Jul 2024 16:03:24 GMT
Connection: keep-alive