home

a.baranysupport.com

Oleg Bazhenov

Domain Information

The domain a.baranysupport.com registered by Oleg Bazhenov was initially registered in May of 2015 through ONLINENIC, INC.. Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
ONLINENIC, INC.

Server location:
Oregon, United States (US)

Create date:
Saturday, May 16, 2015

Expires date:
Monday, May 16, 2016

Updated date:
Monday, May 18, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
baranysupport.com

Whois:
1 baranysupport.com record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

The domain a.baranysupport.com has been seen to resolve to the following 4 IP addresses.

141.8.226.19
May 27, 2016

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
July 23, 2015

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
July 23, 2015

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
July 23, 2015

File downloads found at URLs served by a.baranysupport.com.

1 / 68      (Malware)
http://a.baranysupport.com/hp/?q=G9s1Lj78UKr7456789M68PUD cvPbgLeV7JsC320F0erYR/isd0Gzs7TLEkKLXb6I36AGCvo/gWDREbwRaBUF7oOZU8xqizCLzDDzF6w29xdZDyYBAEyc5/c2NSLdtXYPKTESGMpO57p7gUl2M/1fH48DqByTmPD/.../  (castle strike.exe)

1 / 68      (Malware)
http://a.baranysupport.com/hp/?q=gO9J4bxlP4krOvqomj3M55Dcvpb67S8CcIt/kCVi1Ha7B0ge5k5RzxuQawL7XR3iLoMqoPyBsz6NiHUhmYO6Ye0wTpb78omMbojNujHrfWgXLPglhpJSkEdk6sTaBGBbNAnYQ31fT gXZ6LK4Gj1nX34r OiwTTwI /1EDNXowF 1o tSRCRJG4T5xYwN68TATvobJn/.../m3VHahJ0ZLqxexo QDePG  (jurassic world 2015.exe)

1 / 68      (Malware)
http://a.baranysupport.com/hp/?q=63mfzPQtRPsBWYSUMOHp50EUX/owzDc2zTU3AQsSqsgTfFcR8uc2CgoBskTlmWCUKxge8zMwpiGzRyWwxxPLtOn8419iAPUE9hgiDDz/.../80jHFdehpkmiI 2wgXWOHtZmHDefeudbsKN9Oi5XwJaALF77BrPsdGx5Bi qtJYUfWPQGddNXVvkvoyA7icsNrT2CTuGZ6BNde  (operation_flashpoint_dragon_rising.exe)

1 / 68      (Malware)
http://a.baranysupport.com/hp/?q=58PuplXJtdA8AXZTVNGvKkxeo3GAxFEJvW8xhQXzAUMIlu6XbKD1FUqzPLoXZ kMPWJvPGRAeDhAJBYONeI29rBBhWyTP1lk0PvuxQ18Qbx90Ejvo9O4D1jhHu7yCGwgmV257/ZzcwVrkiSeNxkqIO9AV1yKFw6 Vu YZve7lUGoiwTTLGrbpuNSo7MXyWaPMaSDEgjBNkvRNACg8S0NwHEJHt76DEiIrRlJG6Yj4i/kW9XiIRb31eOObDQO8vI8zXRicUDAfx9qnUrY7AeLEeaD6653tPQ8u/G6reHEu/T1P1s8NCa vv4vHBWdr4oB9fGiUoxasoXFHASh Mn088kqiwEPaRpn3C17GgJrrUjg70jrw/BnixJiw/tkabIAMhFY8/QrNKjizs7VsD4PK3OlaqtorTbb6gtUbW0Pme5RJ3m5EGGcdzdh2fqW2sC9fuUrlIpkIzm0qYpxdyYLwGIUOyw2rW1fDdTu1zT2RnK1qBMVjEU Fddo 2jDLtxFIPKOEl5wivent rS2SgCZtcg1E/.../2zHSosGjXQJd1DcyfY8h8 dbb6lgveiAY4Iehkz4t  (microsoft office 2013 direct download for free with activator.exe)

The following 2 files have been seen to comunicate with a.baranysupport.com in live environments.

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

URL:
http://a.baranysupport.com/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.