Windows Analysis Report
http://racrodisaver.co.in/

Overview

General Information

Sample URL: http://racrodisaver.co.in/
Analysis ID: 1523777
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Detected non-DNS traffic on DNS port

Classification

AV Detection
barindex
Multi AV Scanner detection for domain / URL
Source: racrodisaver.co.in Virustotal: Detection: 13% Perma Link
Multi AV Scanner detection for submitted file
Source: http://racrodisaver.co.in/ Virustotal: Detection: 13% Perma Link
Source: unknown HTTPS traffic detected: 23.53.114.19:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.53.114.19:443 -> 192.168.2.4:49741 version: TLS 1.2
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.4:49634 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.4:57195 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.4:59753 -> 1.1.1.1:53
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 23.53.114.19
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: racrodisaver.co.inConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: racrodisaver.co.inConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://racrodisaver.co.in/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic DNS traffic detected: DNS query: racrodisaver.co.in
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0Date: Wed, 02 Oct 2024 00:11:50 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 62 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 c1 0a c2 30 10 44 ef 82 ff b0 7e 40 9a 56 7a 5c 72 11 05 0f 7a f1 0b 52 77 6d 02 69 22 31 82 fd 7b 13 6d 41 3c 7b f4 b8 b3 6f 86 61 d0 a4 c1 a9 e5 02 0d 6b 52 98 6c 72 ac da ba 85 63 48 b0 0b 77 4f 28 df 22 ca 17 92 d1 2e d0 58 2c 67 f6 89 a3 42 d3 7c 3b b2 82 72 7a 97 ec 0c 4d 97 ef ad 7f c8 a6 5a b7 55 fd 89 c8 39 54 ce 85 56 42 80 86 ab 26 b2 be 87 14 80 ec 4d 77 8e e1 70 da 6f 41 7b 82 8d 89 61 60 b8 44 cb 9e dc 08 1c 63 88 d9 d1 33 08 51 0a fe 23 7e b9 c5 13 7b 1b 44 21 2b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: b00D~@Vz\rzRwmi"1{mA<{oakRlrcHwO(".X,gB|;rzMZU9TVB&MwpoA{a`Dc3Q#~{D!+0
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49638 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49638
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown HTTPS traffic detected: 23.53.114.19:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.53.114.19:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: classification engine Classification label: mal56.win@21/4@4/5
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1992,i,10190382223755918344,14878623388697037759,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://racrodisaver.co.in/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1992,i,10190382223755918344,14878623388697037759,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1523777 URL: http://racrodisaver.co.in/ Startdate: 02/10/2024 Architecture: WINDOWS Score: 56 24 Multi AV Scanner detection for domain / URL 2->24 26 Multi AV Scanner detection for submitted file 2->26 6 chrome.exe 1 2->6         started        9 chrome.exe 2->9         started        process3 dnsIp4 14 192.168.2.4, 138, 443, 49634 unknown unknown 6->14 16 192.168.2.5 unknown unknown 6->16 18 239.255.255.250