home

a.engineer-web.ru

Private Person  (Proxy Registrant)

Domain Information

The domain a.engineer-web.ru is registered by proxy through REGTIME-RU and was originally registered in May of 2015. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
REGTIME-RU

Server location:
Oregon, United States (US)

Create date:
Wednesday, May 13, 2015

Expires date:
Friday, May 13, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
engineer-web.ru

Whois:
1 engineer-web.ru record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

F-Secure
Gen:Variant.Adware.Mplug
66.67%

Emsisoft Anti-Malware
Gen:Trojan.Heur.JP.muW@a0n2Zcni, Gen:Variant.Adware.Mplug.47, Gen:Trojan.Heur.JP.muW@ai!ED4ji, Gen:Trojan.Heur.JP.muW@aCokUGki
66.67%

ESET NOD32
Win32/Adware.MultiPlug.MI application
66.67%

Lavasoft Ad-Aware
Gen:Trojan.Heur.JP.muW@a0n2Zcni, Gen:Variant.Adware.Mplug.47
66.67%

Norman
Gen:Variant.Adware.Mplug.47
66.67%

MicroWorld eScan
Gen:Variant.Adware.Mplug.47
66.67%

Arcabit
Trojan.Adware.Mplug.47
66.67%

Bitdefender
Gen:Variant.Adware.Mplug.47
66.67%

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
66.67%

Avira AntiVirus
TR/Crypt.XPACK.Gen
66.67%

AhnLab V3 Security
PUP/Win32.MultiPlug
66.67%

G Data
Gen:Variant.Adware.Mplug.47
66.67%

Vba32 AntiVirus
suspected of Heur.Malware-Cryptor.Multiplug
66.67%

Fortinet FortiGate
Riskware/Generic.AC.4386
66.67%

The domain a.engineer-web.ru has been seen to resolve to the following 13 IP addresses.

83.222.14.207
June 6, 2016

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
February 16, 2016

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
February 16, 2016

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
February 16, 2016

52.26.142.209
ec2-52-26-142-209.us-west-2.compute.amazonaws.com
July 1, 2015

52.11.167.137
ec2-52-11-167-137.us-west-2.compute.amazonaws.com
July 1, 2015

52.10.67.234
ec2-52-10-67-234.us-west-2.compute.amazonaws.com
July 1, 2015

52.27.23.115
ec2-52-27-23-115.us-west-2.compute.amazonaws.com
July 1, 2015

54.68.13.248
ec2-54-68-13-248.us-west-2.compute.amazonaws.com
June 19, 2015

54.213.72.9
ec2-54-213-72-9.us-west-2.compute.amazonaws.com
June 19, 2015

54.200.195.191
ec2-54-200-195-191.us-west-2.compute.amazonaws.com
June 19, 2015

54.149.241.47
ec2-54-149-241-47.us-west-2.compute.amazonaws.com
June 19, 2015

54.69.228.231
ec2-54-69-228-231.us-west-2.compute.amazonaws.com
June 19, 2015

File downloads found at URLs served by a.engineer-web.ru.

1 / 68      (Malware)
http://a.engineer-web.ru/hp/?q=nki6sRFzKh/m9/XZTVEssFKZNHJchLNzWmIcNG7SO3O1 sn8fcUERuYk4W2SvTqtrB6KfdJxI4wcGn/hzhaV6w74J7XeCnWNVt0xPY vDgrJ6jMRf5Xp1Q8vWpdzSdc/MlOuNC tuEWnNwujrdharFVylHSUTabaqQ0zFf/w4d/Je3vho/dMFGH6RuR eM93aK/.../CYuctF1PRnpYyP80r 7aR8h6ZRevUIjCbonP 3KM5JB95m9vkaPSgDCzzeZ2SNPyI2GjvUMy6NuZMYTLsgndO  (nfs most wanted.iso.exe)

1 / 68      (Malware)
http://a.engineer-web.ru/hp/?q=G2PupkDSrSNc5wysurhPj7s7oNZ8VMNLscDA0T/Kjx 4hpvI7s7Am5ASC/IopQfrilHjmCPRpP7LEWWNtr7YwPRQcF3W4skLvqEcRczD /Pcd0jFU1EiH5YzUKPBWqS7N1dSetTSBoFz8gipEtxgLzI1z9TU43XU9SaOSZKVLcvMX11xr jy81TL77G/.../7xdblWPNCWfwLLg4Vw2oBsjIQlLuTq5fFxNXHFRHe1CF mE0jFv57zCZI cUwU fhReIIwFK126kuzIdP1JJS2ySPtira8YqNzKOmKM4KqH2SuQ0EIOdsdzCWu2TDhNGhZ54X8p 33WIu 55R0qrofCXHhYix3q29  (in cammino per santiago full.exe)

21 / 68    (PUP)
http://a.engineer-web.ru/hp/?q=/GHk0RFscuW2ERJLFHqjT6NPd22gd6MK63z Btd9dG4r/IeiY9SzWciAwhO esLK3Ybz3QL1g4Vz22H16RDoUGwCJ / wvaPP9wK4cM7z/3PT142tfgMfnqZ IEOXx6ufCQKrB9oQxFndnMhCmT1ppUhCUTxV7UkkwEJsubbAhvqCsr2f9MV0BntPVPfMhrKiwLNHb2cjxIAq0qlO7Loat0PzE/tk D74FzEteYjZd3i6rKDWPQADfbfAuYoGGK4qYxxF2D 8GIO 3uLfjMjLmuJYg/4O5HmQ2DhsIemGxkrSexN2QeMcyTlh3HGQ/yYoI8kKMZBeCDTBoXzwye/xnGD4LDhXhpcIpjv4iSzjFKo/.../Lr69JnmsXb4ZEecSKQO3rDvXDbghtS5UZ0Va7AisXmm 9gQnbYmLbceCmuAfBhaBtCRU19kuo2YeoxYF  (kaspersky pure v9.0.0.192 incl. license and patch-ind.exe)

21 / 68    (PUP)
http://a.engineer-web.ru/hp/?q=zb2XT549Te4vMOQIKEu3dSobDvawuUidOzCsrXw0k0If96AomrA6iHlmM8a/WwZ8Sg1orAGywHJGI1ozpOrvJYpFORaaJ fpAxEPTGh4YIJyqMsooZI4pWJElVae7gC o6XeYXVR7Q6efgX3H S5ggDgf7kisuhRwVdGmb4Mm ObG0nJe8Jd/pLolm9gdkShy8HRwoh6X4gSHv2wEXzZwXDpQOqRRZxaIlA3/qb5ifjS2234lEvDck4aSlRA7apHR2iUOU8J/.../IHAoWYJnPKsb1BUPfZuiCaVpaIZyHKNwcZRPKTKpUrCy7diCVUq39MHXepCYq7BTzdCTO282yTmXbduoYfwN2Nqrq0nnZKvaBcvcKPeDE5fHqmgoHxZ9cgKvMH 21W3VkWNEUyNqo4XPvWItro  (kaspersky pure v9.0.0.192 incl. license and patch-ind.exe)

21 / 68    (PUP)
http://a.engineer-web.ru/hp/?q=XbBQcohAX E/412345Wjqj6Y/Vf9PK0EL2wX0RZoIZbfDhZrulhQEYlp8DdYycogAL9oy66pBa1eRhtmW0tRL27wgPgU3A2eEQUrH5eNx8AW vhBawYPHbBTK9jDzd76 MmT8dUwPUU5BrwtCmvFOLFCQiaLbK9EDb7VtcxYzCKU4gExxrMXfK7Sa2s6nfkqlzeapHxZs9F1vjns0z4zgjONuqLWZI25c1KCmYZsJ0Zas DN2xkXLHWHZMPt1jm0s9FiB9wkonN7gGFDsPu3C/eb6vfvusqKmqUajgYVU9X7tilMjLEkkVqKtZXJm2gdIVXJ3h 6/.../qH8KXrrClfuN4NCeqGRz1hW6xIibHg1FiTo 1zXq4BdFXh95NZByhb4PtZtfndprXkozE4CbQmd7Ppns0 EhvT4qTHbkHmvnNLEWa0AbZXwCva6wu  (kaspersky pure v9.0.0.192 incl. license and patch-ind.exe)

22 / 68    (PUP)
http://a.engineer-web.ru/hp/?q=aHs1Lj7TANACDWYSUMFuDZL21jkLBOk/a48eRUJZWNU/lC5K1SCMuGlW2nT1P1r6ZO8UfMNSmUHcTa0lNbn5yKtBJjiw09JnGx vLqtF/tLuApGy0iTAEGgYAjBo2fbh9i 3Nt7pEL8eFJMr4BdhX5J3dmfbtsK8t8/K qsFazUNFOpKbBcpCF pAxOvX8XVHR51MSvnM2yMHnRJMClWCf0wAU/ soZY3dgmOanyPGWL5 dUBtdGtt/L3n3L75KoTXH34i6N4BqZSjhdF ojfl8mMHQ8tDGwzo859SfhqlXla8U9VtabRVuyv/F6p8hVcGgXBhUQ6v42iofuYu/.../ntutMOO4 vnH9JmV9FggCb5zA6FrBUYVhmuaPUfou2D  (download temple run 2 android game for pc.exe)

The following 9 files have been seen to comunicate with a.engineer-web.ru in live environments.

TCP » 52.11.167.137:80
download.exe

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

TCP » 54.149.241.47:80
papers please v1.0.41 setup.exe

TCP » 54.149.241.47:80
installer_game develop.exe

TCP » 54.213.72.9:80
setup installer.exe (Win by Microsoft)

TCP » 54.213.72.9:80
tmp5600.tmp

TCP » 54.213.72.9:80
tmp61f7.tmp

TCP » 54.68.13.248:80
tmp781a.tmp

TCP » 54.69.228.231:80
download.exe

URL:
http://a.engineer-web.ru/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.