home

a.epic-datachar.com

Timur Radvin

Domain Information

The domain a.epic-datachar.com registered by Timur Radvin was initially registered in May of 2015 through ONLINENIC, INC.. Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
ONLINENIC, INC.

Server location:
Oregon, United States (US)

Create date:
Tuesday, May 12, 2015

Expires date:
Thursday, May 12, 2016

Updated date:
Sunday, May 17, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
epic-datachar.com

Whois:
1 epic-datachar.com record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Optional.PCUtilities.Task.Meta (M), Threat.Win.Reputation.IMP
100.00%

The domain a.epic-datachar.com has been seen to resolve to the following 4 IP addresses.

141.8.226.19
June 3, 2016

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
July 23, 2015

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
July 23, 2015

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
July 23, 2015

File downloads found at URLs served by a.epic-datachar.com.

1 / 68      (Malware)
http://a.epic-datachar.com/hp/?q=m2s1LkDTxZyAcHwysulfz/N3V9cgBPnSPkbp06Y0O3CWEU YnOsxgGLeV7IMqwJxYVqb5SojAhuVAm8Zy7Sh Mls2wzZojFKa5EjuC0uNi ldisxm NPd5jEU/iZrXxBZXTmy1831yzsf0kHt7YzQXNlwYf8hmEcygpMchHRESJcir9ItJEfbppKS9dXbCOrI6 ICXGsKYjQ2CBX3OqtS9dOnw8MCnA/kj4gRsMNA2FMm S1y13BuljlTMtTBke8P1c1HW6GawVybTtJJhgh KyXKa6BI11wJkZWmnHYz9UbgujdCYsBCnFALTEDX0O6CkjvAhrK8MrMVow4k9EVWo5 UWDL01xYGUjkP4j1MXr JyzI8FN4AD1wkzmhzCJAS0culZY78Mf VOG4 LIQdfvoGsUxQKxrXyY CSPsXADIUAjzuS058Eb1HIGQT4CoebBo/i/6h216ObmrI5Dq2baT2HjvejAb5aeOHV wqSQngsGRsFh8tbf/.../Mp9hAy ThO5qOvS712pzzzmuBwZSeedO5wZffaZjvt  (vellimoonga malayalam dvdrip x264 aac 5 1 e-subs-mbrhdrg.exe)

1 / 68      (Malware)
http://a.epic-datachar.com/hp/?q=KYxhIzOQmDDZABCDWYRLcu96GiGBaZVLmz2xPI7SUA0ZN32/.../SvDsbEFwEAbQDjDRE9sc4nsRJ4U6RKg2E8XC0vsD63W9sC3OsZ4mwWgPX6ZSN5HCnc16I66sM5O8iRyjyO3iZoXWe3eNw03sgikt2Jsi4DWZE7sZ4HwFG1N7JZqDqAvUGpnTp4VAJxh8o9P DEYm14VUv1jBSh8  (game setup file.exe)

1 / 68      (PUP)
http://a.epic-datachar.com/hp/?q=kGHk0RFn9jZaGrpnikdz14JqtGgiR20g0DU3huy7G8GW1oCinOwX3n3HMTKbsPzuEz3Vzd37RfCZIETuxC6/VvgGfk730b2E3TaoevdVWoWL6OG7BrxrPox/.../QLxaOWeNmMBRN4MpuIHhJwt7h 2oNQQQ3kRetdVqiYcjXAhxtn6FsUwRvQyIXn lDsYsmqul6QodQ 3rl4agxDJZZTwvJNwC33iLPlR  (the hangover part 2 full.exe)

The following 2 files have been seen to comunicate with a.epic-datachar.com in live environments.

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

URL:
http://a.epic-datachar.com/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.