Windows Analysis Report
http://72.52.178.23

Overview

General Information

Sample URL: http://72.52.178.23
Analysis ID: 1369309
Infos:

Detection

Score: 64
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Creates files inside the system directory

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection

barindex
Source: http://72.52.178.23/page/bouncy.php?&bpae=GbhGd60Gokx7j3Nkf30UpJQC1cuCU7SbZp5LNuxHN8T2Z8ZjELvD1zRc563zHAdDVTDoOIC5SDCGz%2F0P%2FaME0WiJ%2Fkr9FgtKDR4Y4MLYhNfO1YdohjV7D9uwsUZJh2qiTOKFeOmG3DQ9ckKmD1y001bByAf%2BAgG1swbCKS7E9SScFBoLZBKLBBmtvHJfvelG8U86hb3DJfOkb2iAKuvLELN4%2B1xnQ0%2BDPL5MIktAGRkQF77L%2FC1S7GXX%2FyCvzgEhyU97BmmgjDHIMFwVEWm3pO3ijUYZ3kSGk1Hitc4Uq1J670W38vCP1uhsdwzW%2B3zaIwBw4brHNm%2FE9N9NFkwZigkLIwK4S7vsPuD3IOEhLc5o3V3uX9q2ZrdcKA79CIr9NQj1RPjHBWAowOR9&redirectType=js&inIframe=false&inPopUp=false Avira URL Cloud: Label: malware
Source: http://72.52.178.23/ Virustotal: Detection: 6% Perma Link
Source: http://72.52.178.23 Virustotal: Detection: 6% Perma Link
Source: https://simcast.com/?d=72.52.178.23&pcid=48&rid=112&a=0 HTTP Parser: No favicon
Source: unknown HTTPS traffic detected: 23.38.184.71:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.38.184.71:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 72.52.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 72.52.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 72.52.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 72.52.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 72.52.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 72.52.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 72.52.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 72.52.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 72.52.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.38.184.71
Source: unknown TCP traffic detected without corresponding DNS query: 208.111.176.64
Source: unknown TCP traffic detected without corresponding DNS query: 208.111.176.64
Source: unknown TCP traffic detected without corresponding DNS query: 72.52.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 72.52.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 72.52.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 72.52.178.23
Source: unknown TCP traffic detected without corresponding DNS query: 208.111.176.64
Source: unknown TCP traffic detected without corresponding DNS query: 208.111.176.64
Source: unknown TCP traffic detected without corresponding DNS query: 208.111.176.0
Source: unknown TCP traffic detected without corresponding DNS query: 208.111.176.0
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /?d=72.52.178.23&pcid=48&rid=112&a=0 HTTP/1.1Host: simcast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: http://72.52.178.23/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: simcast.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://simcast.com/?d=72.52.178.23&pcid=48&rid=112&a=0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 72.52.178.23Connection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /page/bouncy.php?&bpae=GbhGd60Gokx7j3Nkf30UpJQC1cuCU7SbZp5LNuxHN8T2Z8ZjELvD1zRc563zHAdDVTDoOIC5SDCGz%2F0P%2FaME0WiJ%2Fkr9FgtKDR4Y4MLYhNfO1YdohjV7D9uwsUZJh2qiTOKFeOmG3DQ9ckKmD1y001bByAf%2BAgG1swbCKS7E9SScFBoLZBKLBBmtvHJfvelG8U86hb3DJfOkb2iAKuvLELN4%2B1xnQ0%2BDPL5MIktAGRkQF77L%2FC1S7GXX%2FyCvzgEhyU97BmmgjDHIMFwVEWm3pO3ijUYZ3kSGk1Hitc4Uq1J670W38vCP1uhsdwzW%2B3zaIwBw4brHNm%2FE9N9NFkwZigkLIwK4S7vsPuD3IOEhLc5o3V3uX9q2ZrdcKA79CIr9NQj1RPjHBWAowOR9&redirectType=js&inIframe=false&inPopUp=false HTTP/1.1Host: 72.52.178.23Connection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://72.52.178.23/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: unknown DNS traffic detected: queries for: clients2.google.com
Source: unknown HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk
Source: global traffic HTTP traffic detected: HTTP/1.1 503 Service Unavailablecontent-length: 107cache-control: no-cachecontent-type: text/htmlconnection: close
Source: global traffic HTTP traffic detected: HTTP/1.1 503 Service Unavailablecontent-length: 107cache-control: no-cachecontent-type: text/htmlconnection: close
Source: chromecache_40.2.dr String found in binary or memory: https://simcast.com/?d=72.52.178.23&pcid=48&rid=112&a=0
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 23.38.184.71:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.38.184.71:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\chrome_BITS_3328_311186701 Jump to behavior
Source: classification engine Classification label: mal64.win@17/4@8/8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1856,i,5136222906406858517,3430780100129382080,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://72.52.178.23
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1856,i,5136222906406858517,3430780100129382080,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs