home

a.all-statebar.ru

Private Person  (Proxy Registrant)

Domain Information

The domain a.all-statebar.ru is registered by proxy through REGTIME-RU and was originally registered in May of 2015. Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
REGTIME-RU

Server location:
Oregon, United States (US)

Create date:
Monday, May 11, 2015

Expires date:
Wednesday, May 11, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
all-statebar.ru

Whois:
1 all-statebar.ru record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP, PUP.Optional.PCUtilities.Task.Meta (M)
94.44%

McAfee
Program.MultiPlug-FYT
16.67%

ESET NOD32
Win32/Adware.MultiPlug.MF application, Win32/Ramnit.H virus
16.67%

avast!
Win32:FakeDownload-F [PUP], Win32:RmnDrp
16.67%

Zillya! Antivirus
Adware.MultiPlugGen.Win32.1, Virus.Nimnul.Win32.1
16.67%

K7 AntiVirus
Unwanted-Program , Virus
16.67%

Sophos
PUA 'MultiPlug' (of type Adware), Virus 'W32/Ramnit-A'
16.67%

Avira AntiVirus
TR/Crypt.XPACK.Gen, W32/Ramnit.C
16.67%

AhnLab V3 Security
PUP/Win32.MultiPlug, Win32/Ramnit.J
16.67%

Vba32 AntiVirus
suspected of Heur.Malware-Cryptor.Multiplug, Virus.Win32.Nimnul.b
16.67%

IKARUS anti.virus
PUA.Win32.InstalleRex, Virus.Win32.Nimnul
16.67%

Fortinet FortiGate
Riskware/Generic.AC.4386, W32/Ramnit.C
16.67%

AVG
Generic6, Win32/Zbot.G
16.67%

Dr.Web
Trojan.DownLoader13.36098, Win32.Rmnet.8
11.11%

Lavasoft Ad-Aware
Gen:Variant.Zusy.145628, Win32.Ramnit.N
11.11%

The domain a.all-statebar.ru has been seen to resolve to the following 13 IP addresses.

83.222.14.207
May 29, 2016

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
July 16, 2015

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
July 16, 2015

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
July 16, 2015

52.27.23.115
ec2-52-27-23-115.us-west-2.compute.amazonaws.com
July 1, 2015

52.26.142.209
ec2-52-26-142-209.us-west-2.compute.amazonaws.com
July 1, 2015

52.11.167.137
ec2-52-11-167-137.us-west-2.compute.amazonaws.com
July 1, 2015

52.10.67.234
ec2-52-10-67-234.us-west-2.compute.amazonaws.com
July 1, 2015

54.200.195.191
ec2-54-200-195-191.us-west-2.compute.amazonaws.com
June 19, 2015

54.149.241.47
ec2-54-149-241-47.us-west-2.compute.amazonaws.com
June 19, 2015

54.69.228.231
ec2-54-69-228-231.us-west-2.compute.amazonaws.com
June 19, 2015

54.68.13.248
ec2-54-68-13-248.us-west-2.compute.amazonaws.com
June 19, 2015

54.213.72.9
ec2-54-213-72-9.us-west-2.compute.amazonaws.com
June 19, 2015

File downloads found at URLs served by a.all-statebar.ru.

1 / 68      (Malware)
http://a.all-statebar.ru/hp/.../843YE8EH5pTawPGBR 4StIo2mQOtYsxzuk2K7e3GpJUgd7pE2FulXsM8BbxoTmdH5o0TaLDHI0alpgAQJeiGCXq vZ72IcC2EL72wGs6mIQwdyxwGpg6TDAwAvKqDEskC1I2p5zbCS6E6ddSKdJ8k9loch  (tv_online.exe)

1 / 68      (Malware)
http://a.all-statebar.ru/hp/?q=ZEIqm4b3NvK1YSUMOQwG9doyYpvI4iZaAmt2xTJdXDWK8hGuVRdV8u9cSTEJShHhVLid3rHuwDeOFTrkByt2nihWZXLN307G5UXBqkyYQgNGfdxffuLusDyADLN8c/y51ST72OXgAIm/isDJWo9Kyj1KVGp5xSRCGh3x2yQGywLEIOx646GrA4FuxlyksEcwERiVCQse5VPNur3NmP rgye9BxdrogYOU07HhLx6/3XLe7P7bKPakZQJpVOpgC1Bwtzi kCmaRvPGCweCUruBgHKSBvQNn YuZKgvUqd04jHVUbozqSaN49pjq0Oub5DVODs7PYj7sfdG6wSbRFwX4NC8v0BXXdHYHp4oIyTJ33liBSmfIaSGWGWaClX1ndIGjPKmJjWhV/.../EIfH9TC6BX6g1C1izWAIgHhKhHq5esVaamuy7qiEkSCsoAdu1nvAhxDTM  (ver penes enormes y gruesos y cabezones.exe)

1 / 68      (Malware)
http://a.all-statebar.ru/hp/?q=gNn5yUACfaZRkQIKEGrmDVzYMp/xZ9PFDjJaraDFjwYcBJmCWBz1 ZrUI6Mrdw/.../DYxAxJRAxsY7hvBU2paJfj0GVuZJMzAIAHG1cJ7ehmYGHikFJzg Cd6JYQpjCZJ3NRd0H1IV  (download.exe)

1 / 68      (Malware)
http://a.all-statebar.ru/hp/?q=13y0Jvzqw1 GFysurpaIEAuFQF9FSqcGwyiqiwbklkvAJH D4ic43b4M92z EJvJ/pf4EL5vaM8GL1a2RZyXnAxVkIpuKkZ Xl32/AeXBIu5GwGNOlMwV10MAPOIyVrAa7TEBhbSZhrAc7pHzC7hQO7EAiW1sxeOFTK4CM7SrLCz3YfD6gv4EgmjPshWKRa3CpGbV/MMcwUUBL KReAHHFTK2Aa/BToq nyRD5e1tmLNoAnuG c ULd7wvBoMZHZ6ksxiwNXZfcTeYbeOgpv3pEQ4tbXsijoCL/GmMaI93rJMQ7pJjtMaYn859XyGgFMhQ6YWPm0AhHQiZDIflBdfFyKpIgxuUVj1y53jGaTtMQGWQ7jZy7SSflWtVJmbkCohr6o6gLGFyWg7mKYDcbNBkguADe0WuvUZh28U6JwGCZsusfDfl4NzqzwGULemdfDejAKzXs1Z4IY/kPtAB5XUmHeuTWkMzFTSmbwYPU6IyCNSNZ74Bk9HZ5NMTU4KQXzuSEl7FVp3nbcbjEUKYR90jyTKdkWbmzA qu9hnxOlySgQQpuHCBIesTnjRUdxS5tL9EKFe3pFTZSsDftsNBo/EYzaUC9p2LVuu3gqBn05iXGUAho//x15EuZBflXDWOMSSQil3viN/uCU0ocmTEMJBmCtFIvq0aewdbfJ2vJ8ulnCSNmrLCz21a8pFT9P0n0Tf9h5ZYXNWO8zj/.../fv3QPzdOqD1 W pdeR7Or6bX TzvaFaPM3grQtrif D0TMKJQDhH4bXzBR5EKgRwDL x2JVU3EIwpQZLHNhrunWZIOjnVIi SWEtz27VdjZUrvzUpkg48Zc9Zl00jvxkuTgKXDV  (cd acstico luan santana completo.exe)

1 / 68      (Malware)
http://a.all-statebar.ru/hp/?q=YGk79 6SNkDP4vqomj3NZRyqWFPfUZCm/klFu7fon5f8tQGQlf2iIEojxaqziB4svWCZjGByBXEGo3rh6sL2Q7Suy7OpCxz8vF51qMIXz6fBGyTlpMqg90qrlDEj9Coyhv5 dLPKCc082LXkHctWJ53rPLimO5 PzHSsksi/pyZ00Y4lhkuwszwvC3KDDeBEo AFEbFxH/.../HRSalxnTCKMHechVLSenDEub7SFdvleKIQI  (download.exe)

1 / 68      (Malware)
http://a.all-statebar.ru/hp/.../1KWwLyjFUKPgAWD9M6Orj572G9hu2JiyYEEwaI2acu0OCuk2jEZYjpgL8jXcFgrWRzXxCgFDG1SghTkj3Hlu3QU  (fifa15 crack only v1 for update 4-3dm.exe)

1 / 68      (Malware)
http://a.all-statebar.ru/hp/?q=4sMzvsPF9 afe xztvg7mpzp4rE8FmwX1JYEHRxRzGK4pFNbJVnXixWFs9LA27reZyW1zI5BIH6BYkIt91/zDI6XbKRHdlXgMzENr8VWWkZev3GBU0jbPYaf6DgzYojDw4c3bIjq3RKgb3gAKXF8SkBXAbqEFTiwR5SZqZVHsAYJVsnOtJUiw4pY37rhLTT2A2GK9t7f5EbBhrJGoccYWbI14d0IM2PB9wjDskM1/sUp6xhVvKQvWYxVj0bg4mShzCt5WlKXyfFsYiaS Atczp82lGU5NLODiZC9kzCdpM2d9xStgtZy6sFdW0i5QCCrOh1HwILbVQFNcEElGQrsYojOcqFxzpoyVf1wjK/.../gmtV mOFeP4IBqS  (modern family s06e01 hdtv x264 killers mp4.exe)

1 / 68      (Malware)
http://a.all-statebar.ru/hp/?q=3XFigUAU0ggIBCDWYSJTHa1EPaplRx8ycERrKpKca7OfflUiEEAZTqO6Dq23ADenGs6OLTZQZW5uyQNmV7QUvq ABZplXhBJh6rUQ7TwTB4m/oeDfz6WgPUp4CDAvtWE MjnUlnslKLeSfi5NfFqes6QRLjXZX7zD3FMgPD0Uqv5ap9ojaEOn7aI0TQvZv80RpEOI6Ja5ze1sVUsqZVzESsnptozbl8EMkuUxoio93qiKkSX5kPl/m8S7Dcd M wrIeiU3Nl59UOYHieAC2U u7uxb04/lOr4Ew9sXqiwQBNTa3FUDf/Dq811z/.../kPafs1YT8o4vR vNOmIp6Jh7AtNCrdSj  (modern family season 6 episode 1 full.exe)

1 / 68      (Malware)
http://a.all-statebar.ru/hp/?q=NIEmlYhAXFm/ikg012BhNgOoPFRLcR6XcETw sVO aqFqYxRR8OjqIutN0zKfhUUrOUxezpxGCnAarb2YepqSWsETzitFx98OhuleDvjqraCgUCbRhnMFs0cPGebP8kgOTHRlXHbaS6nQnySSUH2kvIKcPG42 HBOKCivA5pBrxn/fdnOcpJcXmCCmwX3n3WSQahsluL6yt15b1z/.../J VQ238HdI8sweP6g 1T28RDoIq1m6GsOhXrRHwxhuDYhl4KA52uYJ4BlZZ8YkYekQy43Df3kKSSPuB267fiNmUA2pgbtss9ExBHUbCMCpsuDrxhbNnngZTe54NXRj4d5iln8qqJPQ2XJRT7XSFWIRWVYbh5cHeIWjG7bw3bBb5I7y66MuAebwKVnslYyHCiQQnFT8tDIrzF  (modern family season 6 episode 1 - the long honeymoon.exe)

1 / 68      (Malware)
http://a.all-statebar.ru/hp/?q=xghCWm23Z5kRMOQIKEu3 7VCr7O9q yXlKKH7qVSdu5uoZBob6KI9cLFcCzJUb3MmD3e2Ur6DNOtJcXojA04J2c/T/ ySum1iWeauTti6hIDPUvrGHBZNnLHtwv6imjtX5KAX5vL2O6f116qeDlWbeS0l8Zf29DUFlG8vbQR/.../7XeCca  (download.exe)

1 / 68      (Malware)
http://a.all-statebar.ru/hp/?q=25VyuxXJyR KIKEG xn910J0lxlNO0VrWlNKZTxkoLwbe mCiKqSmro/tm a zbXqGxQkwXi6sq79F4sc1MU7nx7ViyrqJ0efnWlYhBwI5KwOYHqwO1WZ2F Qt6GCe7CDAkdosZCJTuSFSLmhKpmJZJA/.../VOB76Cdk7YruiivZz8wkWUNZLisGC  (download.exe)

1 / 68      (Malware)
http://a.all-statebar.ru/hp/?q=GNy0Jqoj/OYYspnikgevfAAcq86QsgQ5VyWm5k5YEkaEmVWwn3wEcOmC1LCfia0IBanMycreLTEU/9hOgaEck D8MCTnSe9dBXzR6vJZIb8wqkNlJ2GBtPkJP1snuL5KHNj/9CBUBHIb4i4A0vcCxO/.../qJzCkQtxOE7oH5hzpGMWl4tCY5A2okqIYM I2XGSHZXynMCSADF0v  (warrior 2011.exe)

1 / 68      (Malware)
http://a.all-statebar.ru/hp/?q=RwhCWolAjvS4789/XZIZo7t8zoeduc5kJGIQeje4tNz4q22e2/.../U Y3Or4jvOWRxBbesNTgsW55KhlzldLFWklnwK0wVOk4S0pFXy6hM1vfbUhFHj5rSJcF85IDii70z7j6O8N9U595srtrLw186eD1icvEskDCVeGd4Y clpTLzg rYPbMnDLylMiyWdrH  (warrior 2011.exe)

1 / 68      (PUP)
http://a.all-statebar.ru/hp/?q=R5XF6/tn1B0V9JLFHwo8QovT4yEwtG7HGt7SZ5dOwZerJNQBzCO8Resy1JTR1yjZBu3z8RdYkijqSZOLVLlrDheYCE70Ethm rwwfY7KgRkj5WLNzDT384LhplUzywNGf4/a7RD3h4bFDi 0Os88jmKAe3B0VCaJ8Od0M65jAN5ekxXHIcaqCfShxOMvO3 iyBT8us40haqFoGJ40eLXSDVrV2Q/ZxzC0MpiZP4SFJyllQjrfj3T9LBMzq17EjOsLxsc4ap6UiEhLoogA15dKB06lAfwYfTfw/O68u7naWAZpFLMzLJyN135WnFPSw0AnHK5NCmaq FPHuMq/edl6rf268uyglQSvD6CQ4vptxda3Pgi2h2Z/.../6 QtfWSMRfHLOrGg161bVwFjKB1fjFyrn2atGCajXkmy6kLhphEhBNW27tIBRqdCh1VSRcl9dMVCPKvilg  (microsoft office 365 product key plus crack download.exe)

1 / 68      (PUP)
http://a.all-statebar.ru/hp/?q=bQPupifVWLa0789/XZIZpfl7vyAYxOWBojuqoPQMbVQI7qdvrIHRLZz9HUsxlzaeuRyxhuWvSiRfEhkwxvDviGeKQ5OhZ2UEu91Sfa16v c9MM8Rh4CTsppFnJOpBIKxSaf d65a4U632yPQLsWgYL1kajmsQrfMEwVeEIqjHBDT6GQb HEW qsHNYfrh/fVrNEaKB/kOEBSfDGIqBuwmdFCr/K2/HEZxG7zDgWp7I2fndTSN0/.../xZCL3QP1xLmvrVR2ZJAG4GaOmYFOBAfLYg7YqfIiEZzBLsyNLofojz4  (the ready set - the bad.exe)

39 / 68    (Infected)
http://a.all-statebar.ru/hp/?q=PqdSMS3WEaQbADWYSULNrR7UVXQCwTXHIg0AW66XJgmax3Zh96okoINixduuPRaCouZgZ8jr2NSaFO2dDAngSCySOawY/7GQrElmouYjRUqGhT4NZ9xSuxNihQASot6XQxNmSfp C6UvKZwXFbGPB18xiwYlnv5RmsFOWBHICw3fMYRD/aBwAE9uXcxYzCVoMYR9OBgiG2wXT8RDY9YkxPVpyFDKHN/LLapHkU19EakofCeQmv7TQLFMlzi1wdQBchi1H2h6icgiFbGP72SagSc45hBxkoaB0oi1zHEVGpnhX8 WwT WuwYkj59EcgI3uNVQPzSrKgXDgZyAQKngzG/LPU23JhuuhpYk5JO6lOeQot6YAfFOSDyTNh6YS/6W84Ylmv7TPPO6fKPBf5PAjxZh/7GPkt7UD7O6 JWGmr6XNZI2bN0A94Vo96ok0MgiLZIcjpB IXdMln2cY9z fl4Nx4J3U99v96olxHvJ74vKHEI2aULfAn231JBwdQVpSEOAptWEcjpHLapHmwDKsHWGo EV5KxYbHO6cOT1VYIcsHWGL0VpaI7TzHEURVEMvxZhDdEMiq7StEok2OtsegFNx4JcY7FNIg07MN4NxduuIAQ8fKP7VX5FvSGLv5eaUok/rEZu3XJFr2EA938nniEjDVsWHpjsFq3oQZEEIfLnpwHNgFuM6nbilNCl6GQ5yJzMmEX8o6lYrib5xSerFsvdQOSih993xXhDCCbXMJIv9q5pMEYcGVktHYGMjQ6GjaDB0Jyc WcO0y6vvM0LNBtcSXrEroH7hl6h2bG3xYla6hwnoWlzuEEIREOyhqsEuLXDJxG7O38YIdpaTyYIu4pVpu/uPx1E/vOpMKEU/uBMe9rFFbNWHpiPEmPLzCei6s8ZqZr3x1/.../WZHNh2uIQOA3gzEbJokkTnDAgLIOZiNCI  (- .zip.exe)

13 / 68    (PUP)
http://a.all-statebar.ru/hp/?q=87jAtLi3KFXbIcdefAZ9MsR1Rm35EQOkjyVqSWr83PWN7woe6dgsUfNwF1qXMtaOqZ7dJgJJWRHti BoCvkcdXy1j5e/JUsx6tjdoIZSHUY8M AISgOUoeCXi6KTelDVQKc4ptZ3MV6Ecr1hRBT7b6pXsMMhHue7qVxtinePb/LqYlojDrwLPhA37dPDXtrkbflRgHWeA0RYQmw6Qq8LGxkGpI/qEoEKkyGN OZyulloxFLqZLpCFWI833qbFUtcoh85O68aE2BA5s/K5vI3hqEaFR2HQ1G6Z6kXKS0pHula4UTet18cJZODXbwWmrA0JEnymbtyVshJxpZdLzB70Uwhf4O72/.../nljtbcspv3xS3jdr Nkhxmw7TV9bZVZMbQ 6ManGp9bhF9CfDKqDHUINxpJpzWt beQta7zCszPl9Z8WA  (roy- mp3 songs-128kbps-[team furious].exe)

22 / 68    (PUP)
http://a.all-statebar.ru/hp/?q=t0XF6WqaCnyhfABCDWPQif0J7MeuOqySUAjl1q4NN4VGRK1eymbA3A49GqE9oNYlaeG3BiKqkeh9WVMptb IkAk3msapadiyIzQN9BqHG7mg32VEVIs kEgGloccNVcmbMIy9NmMBMTFUqzIojZcwlrHukPM2RtIHC2PEw5HVDiVx8zNXKei01fkmW2dpqpQgQRA67L8EpFv5JenEegCW8enEmCOlnu296ZMXdAYX04NFHIbQbLssoHBpqjN0yU9ztPU66ohHb JkT1IchdceOffl8EwDn9yPU/Zw0CTHYI8E3IquLnyAxZtDLc29h/Oh/kiRRHzBD5alMpBqmmir908WhdLXO108tc0vfp2IaepHdB6Q7MlCpktVlWggZjdWJF5GmyhgXC7sgWlNEh9jQBWDSWYvuuLZuTts9uIcnZKkYoZvaHsjMyyI56FBytIBSfdr5QT6hokjARc6MqtSimHZUletg7IwnI25/qxxT9XkflQqrVCEEzUHx1mkykBFFzkddPkjv9QkToNcoy9EhNCssnoTaQ9s/.../7YB8dqJ  (office 2013 toolkit and ez activator free download.exe)

The following 9 files have been seen to comunicate with a.all-statebar.ru in live environments.

TCP » 52.11.167.137:80
download.exe

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

TCP » 54.149.241.47:80
papers please v1.0.41 setup.exe

TCP » 54.149.241.47:80
installer_game develop.exe

TCP » 54.213.72.9:80
setup installer.exe (Win by Microsoft)

TCP » 54.213.72.9:80
tmp5600.tmp

TCP » 54.213.72.9:80
tmp61f7.tmp

TCP » 54.68.13.248:80
tmp781a.tmp

TCP » 54.69.228.231:80
download.exe

URL:
http://a.all-statebar.ru/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.