» a.direct-first.ru
Overview
Analysis
IPs Addresses (1)
Downloads (5)
Website Detail
Related Domains (20)

a.direct-first.ru

Private Person (Proxy Registrant)

Domain Information

The domain a.direct-first.ru is registered by proxy through REGTIME-RU and was originally registered in May of 2015. Currently this domain has been known to host various forms of malware. The hosted servers are located in Moscow, Moscow City within Russia which resides on the RIPE Network Coordination Centre network.

Registrant:

Private Person

Registrar:

REGTIME-RU

Server location:

Moscow City, Russia (RU)

Create date:

Monday, May 11, 2015

Expires date:

Wednesday, May 11, 2016

ASN:

AS25532 MASTERHOST-AS LLC _MASTERHOST_, RU

Root domain:

direct-first.ru

Whois:

1 direct-first.ru record

Scanner detections:

Malware distribution (100% detected)

Scan engine

Details

Detections

Reason Heuristics

Adware.Bundler (M), Threat.Win.Reputation.IMP

100.00%

avast!

Win32:FakeDownload-G [PUP]

20.00%

The domain a.direct-first.ru has been seen to resolve to the following IP address.

83.222.14.207

May 19, 2016

File downloads found at URLs served by a.direct-first.ru.

1 / 68 (Malware)

http://a.direct-first.ru/hp/?q=XvhCWoh5F BqAztvqo1LzDc1i0NZcfcA7p9I3KP9v1cOYXZsOP/IX7iqSGoJQynC8qd2lxYvm5JZ8Fa//PYM7nyA8xkCaJahvErVoO7A HIfD9Su15CxXCSA1oBw8CcD/wwrI/.../fbUln (download.exe)

1 / 68 (Malware)

http://a.direct-first.ru/hp/?q=f29J4bwpJmbGCZTVNP FoU80FDZuh1231JXgZNtS48AlsyQG5gNLUClC nMm3z9tUA2 qchD/wEBpcO8S BMZplWKdddjdA6hRvvDhSiAL37nNyo2D2I q8TBgN3hmyLAOTT6FVufQg1deN6AQGMQWFxjAW9eDoldLZuditvCQldGrlKM3Ib7s15IqBooyCV2wUvGjRHfMMtGTK1YQpHESsyoaLgvfYYVV0e8bxPLF7uyPTuYeB9y1HIXn vZyZsH74MiwNEg/VBCnXoIkdthhuZ wGx1oYzpIlU5DlV1Py9B8N0kph WzmC XdzcspnvPOYkIrfB/iiC/.../SntU3rlmnT51gkRSCEBNuAzjlns3Gu2jNP7PdmuaJF (marius babanu-araboaica by tyg3r.exe)

1 / 68 (Malware)

http://a.direct-first.ru/hp/?q= P laEg7N6YDaKEG xnC 7wsPADupxZsMcV1ArzsdJXuq7Yzo8L649EDK8LEMvbXre0HJVpi1krUJr4sl9Se34A75SpJT6gT6mmCAW7/.../xe8ZFAWDVkkxshVvopDk3NRJ PR3w8XhZU8ZTaLIY5S8wRx720OD71IaHvuCgCMjFUTiq1I3BRPDU4ECa20vIfPgugXAh (download.exe)

1 / 68 (Malware)

http://a.direct-first.ru/hp/?q=ekZH7V9SwIyLJ34567SDd9IjRYj/KMAZu/yXxWJ1PJUvejYVfkXyvGqFpFJyvTAR OR9gTGrxBH4 NpzstoBe5NG3xdhlTuaPuCMcyZPU7vyL4N qZFPDH9jhSonUP uN5ES9JuSOEVOBkeNwLaNrRBwllP Bw8e9GlEYZuTRkpmvTY1Hn ouj/Ttjvg7edhE9QhJLBhXXty6 Q/YXoCmBUmCUvmVosJ flaLdhp2x/VFBo99mCllo9gegwiNGhDnNeXV 9SaofmpDhpIQJSnpqXGC6HkPfeNH/.../hMeALdL6JGwHjLsJZbmPAPLCSzDYx1pB 2A9LB9UD (hamari adhuri kahani hd full.exe)

2 / 68 (PUP)

http://a.direct-first.ru/hp/?q=SgNsrqolnvWAURJLFHqkP lDmyrMysbbBtfbwDRAEu4MiwF7alYzE1FN0RNdFz05HMIPFyx 787FX/MXmINY6W1R9p8neSt6uB2BC3404FrNW17x4gOEIeBWieuGKq0634Mncmc1PFOMJWvAtuaQl85FqAhtkSSc5E3T/zmCJiumcmn5s2249jlfCliuy5lWnvIzsxdl1ziP/zUMBNiXpNCjkkXyaPgkwKgL82b30ZymUSjk0yStd9RnFyP2mVoTkt0vy gk vDVzR2iw5BhpDj8uwY5WL3xU8VxntbLcFJTdrymHM0RWGpmbW7YSZDDLp/.../UkG (hamari adhuri kahani hd full.exe)

URL:

http://a.direct-first.ru/

Web server:

Apache/2.2.22 (Debian)

Related Domains

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.