Report - zandronum.com/downloads/testing/3.0/ZandroDev3.0-160229-1221windows.zip

Report Overview

Visited public
2024-09-18 03:26:26
Tags
URL
zandronum.com/downloads/testing/3.0/ZandroDev3.0-160229-1221windows.zip
Finishing URL
about:privatebrowsing
IP / ASN
45.56.67.39
#63949 Akamai Connected Cloud
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
zandronum.com	unknown	2012-05-30	2014-05-05 16:56:59	2024-04-18 14:12:58	525 B	4.2 MB	45.56.67.39
r11.o.lencr.org	unknown	2020-06-29	2024-06-07 07:43:57	2024-09-17 18:12:27	654 B	1.8 kB	23.36.76.226
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-09-17 18:12:05	1.6 kB	4.4 kB	23.36.76.226

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
zandronum.com/downloads/testing/3.0/ZandroDev3.0-160229-1221windows.zip
IP
45.56.67.39
ASN
#63949 Akamai Connected Cloud

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
4.2 MB (4230075 bytes)
Hash
95275297eebc9e0acd7296abde75f7c7
c9ca27e5e7ba564879159286e1c0ce8d17792e1b
7fc141042d8507fd78feb5c5ae020dba6b25902a9cbd9c995925a53372347ef6

Archive (4)

Filename

Md5

File type

fmodex.dll

788d2837a82c1810d2c6916375acc6ef

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections

skulltag_actors.pk3

3f945ab474ecc59ed2fe10e899908130

Zip archive data, at least v2.0 to extract, compression method=deflate

zandronum.exe

2c421ffb8db6890130b2ab2f9b566db9

PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections

zandronum.pk3

c437ca537dc5cec132caae0fcd308cb6

Zip archive data, at least v2.0 to extract, compression method=deflate

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	meth_get_eip

JavaScript (0)

HTTP Transactions (8)

	URL	IP	Response	Size
	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash a4e61c096fb8a0f28561b209588076fe 84634c409a230cba663826d593379499fce545a8 17f85499c27b8bafbc202dc51cd5e7fa80be0988a0d820dbf8a4c81344f26da9 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "17F85499C27B8BAFBC202DC51CD5E7FA80BE0988A0D820DBF8A4C81344F26DA9" Last-Modified: Tue, 17 Sep 2024 12:20:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=17140 Expires: Wed, 18 Sep 2024 08:11:34 GMT Date: Wed, 18 Sep 2024 03:25:54 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash b4ddabe3dc0fdf5ea3a82a9aebbb01c6 bfbff7cc66b83f1e16d8739a987f175866a6de68 73c53b2f9ea6cb310eb9df3e6d917f4649a2c2470b3ae7ee1e4bbb7102550016 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "73C53B2F9EA6CB310EB9DF3E6D917F4649A2C2470B3AE7EE1E4BBB7102550016" Last-Modified: Sun, 15 Sep 2024 21:19:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=15057 Expires: Wed, 18 Sep 2024 07:36:51 GMT Date: Wed, 18 Sep 2024 03:25:54 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 946bd983da8ed3f6d5c12abcab5273e0 eaf94210f1202240080722b9f0a78aa64b6cc1b3 f772e410f6d95169a72a7473bf8ff96f7c642b0e8cd820c34b9debdfc367c44e HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "F772E410F6D95169A72A7473BF8FF96F7C642B0E8CD820C34B9DEBDFC367C44E" Last-Modified: Tue, 17 Sep 2024 14:37:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=4869 Expires: Wed, 18 Sep 2024 04:47:04 GMT Date: Wed, 18 Sep 2024 03:25:55 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash a31eb23bb83183cf82d06967d5e3f31e 803053eed17ab1e4d902c93d5f20ae6e930c89e4 116549023fd841d0418e44c97968a7f84c98b643b76ce6b9a94ca70446de13f1 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "116549023FD841D0418E44C97968A7F84C98B643B76CE6B9A94CA70446DE13F1" Last-Modified: Tue, 17 Sep 2024 14:38:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=5210 Expires: Wed, 18 Sep 2024 04:52:45 GMT Date: Wed, 18 Sep 2024 03:25:55 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash d7797a1388130634532149b4e1fb0d11 c55969a1885b5dbcdf039b466f2260b0e76814ca 2ee2abd8cadea1431d08f6d04abd7017a8d8c57ffb92d102a5a60c8c32899f3f HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "2EE2ABD8CADEA1431D08F6D04ABD7017A8D8C57FFB92D102A5A60C8C32899F3F" Last-Modified: Tue, 17 Sep 2024 19:53:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=12799 Expires: Wed, 18 Sep 2024 06:59:14 GMT Date: Wed, 18 Sep 2024 03:25:55 GMT Connection: keep-alive`

	zandronum.com/downloads/testing/3.0/ZandroDev3.0-160229-1221windows.zip	45.56.67.39	200 OK	4.2 MB
URL User Request GET HTTP/1.1 zandronum.com/downloads/testing/3.0/ZandroDev3.0-160229-1221windows.zip IP 45.56.67.39:443 ASN #63949 Akamai Connected Cloud Certificate IssuerLet's Encrypt Subjectauth.zandronum.com Fingerprint6E:60:B9:CF:16:07:42:9A:BC:74:D9:C8:AE:6F:90:45:8E:32:0C:7D ValidityMon, 05 Aug 2024 20:57:13 GMT - Sun, 03 Nov 2024 20:57:12 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 4.2 MB (4230075 bytes) Hash 95275297eebc9e0acd7296abde75f7c7 c9ca27e5e7ba564879159286e1c0ce8d17792e1b 7fc141042d8507fd78feb5c5ae020dba6b25902a9cbd9c995925a53372347ef6 HTTP Headers GET /downloads/testing/3.0/ZandroDev3.0-160229-1221windows.zip HTTP/1.1 Host: zandronum.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 03:25:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 01 Mar 2016 19:48:36 GMT ETag: "408bbb-52d020d11ad00" Accept-Ranges: bytes Content-Length: 4230075 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/zip`

	r11.o.lencr.org/	23.36.76.226		504 B
URL r11.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 45c440d4cead985bd4f1f69f84162f7b 1251ec50f9cfdb548fe2e0fef4cbb146fd92a56b 91127a16631d0d606cac9cac289cf04f0ccb542d3f8954ef4bc5caaef374c238 HTTP Headers `POST / HTTP/1.1 Host: r11.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "91127A16631D0D606CAC9CAC289CF04F0CCB542D3F8954EF4BC5CAAEF374C238" Last-Modified: Tue, 17 Sep 2024 14:39:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10880 Expires: Wed, 18 Sep 2024 06:27:17 GMT Date: Wed, 18 Sep 2024 03:25:57 GMT Connection: keep-alive`

	r11.o.lencr.org/	23.36.76.226		504 B
URL r11.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 45c440d4cead985bd4f1f69f84162f7b 1251ec50f9cfdb548fe2e0fef4cbb146fd92a56b 91127a16631d0d606cac9cac289cf04f0ccb542d3f8954ef4bc5caaef374c238 HTTP Headers `POST / HTTP/1.1 Host: r11.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "91127A16631D0D606CAC9CAC289CF04F0CCB542D3F8954EF4BC5CAAEF374C238" Last-Modified: Tue, 17 Sep 2024 14:39:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10880 Expires: Wed, 18 Sep 2024 06:27:17 GMT Date: Wed, 18 Sep 2024 03:25:57 GMT Connection: keep-alive`

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (4)

Detections

JavaScript (0)

HTTP Transactions (8)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers