home

b.find-data.ru

Private Person  (Proxy Registrant)

Domain Information

The domain b.find-data.ru is registered by proxy through REGTIME-RU and was originally registered in May of 2015. Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
REGTIME-RU

Server location:
Oregon, United States (US)

Create date:
Monday, May 11, 2015

Expires date:
Wednesday, May 11, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
find-data.ru

Whois:
1 find-data.ru record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
75.00%

avast!
Win32:MultiPlug-AAE [PUP]
25.00%

Malwarebytes
PUP.Optional.MultiPlug
25.00%

Zillya! Antivirus
Adware.MultiPlugGen.Win32.3
25.00%

K7 AntiVirus
Adware
25.00%

NANO AntiVirus
Trojan.Win32.Crossrider1.dsuuwo
25.00%

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
25.00%

Rising Antivirus
PE:AdWare.Win32.MultiPlug.ah!1075358322
25.00%

Fortinet FortiGate
W32/Generic.AC.4386
25.00%

AVG
Generic6
25.00%

The domain b.find-data.ru has been seen to resolve to the following 4 IP addresses.

83.222.14.207
June 6, 2016

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
July 23, 2015

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
July 23, 2015

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
July 23, 2015

File downloads found at URLs served by b.find-data.ru.

1 / 68      (Malware)
http://b.find-data.ru/hp/?q=1KcYUBVFXG/8n xztvgAPJJaPlvzEssZCmZawuUZxFpginn85sGOD4MBLDBNYtUdtPudtpGPblS6XHR4ELyYegiFeIBXxKLUL7LNYhU2tGP8vuN/fmjCe3K0z7o3IatwAqV9sq2uKjQmYCko0cjCSuPyFXEUBWVxwdu1x/.../CY4PJTQOme3T7Gs0HSeUAMDlHdNptwWHY4yfYj4dHo7m9a0owWhUvIy2M4UuKBxXSuIhjzzkE1jelg7u6uF2BmtNd6USTomu5O94EVnq95w6WA9WI3dNaZHWMqCfw4mTbNev1nwjrZtiQD3VUDBPJO9rWNjuvkzID7  (download.exe)

1 / 68      (Malware)
http://b.find-data.ru/hp/?q=bg09XlWIdQ9 L45678UdgfkDIly1zl8 P/xAEYLwJabApNqzMDLA2Q0wjYBodRYv6bsbcU27B2vu12313V6yQ4oBycswAAYsg/KfOQue8ZMfUCPnbgxJ AP/WMDNn8zumLVa/t8EDjV2gbMC44UvflfcVWWtUnvejAWNCYqwDhpDcMSCe8N0tvxLGgLPI7KkML GRuaUWv7UyANwzmFNwXwyMq0RWOGCzNNduqKT/.../eMDnTU3  (arma 3-reloaded.exe)

1 / 68      (Malware)
http://b.find-data.ru/hp/?q=4yIqm3i0Yo4MN56789MfQywS9dOyFUZ8VIsV7NIEv4SWSGoKYpkHWx5QyqF1Wi3goHMqCPGIKGY/m1ntLCcSB 6IOX2jOAJdbDR/UrGvnlnzLPgneG2ILElI9VIdBGBaI3wMQXqXPD4PTFW9AlUGe/5StmnSfHkGQmkcKJL/wC q9gEB2YuiOknQbOVx6irVi Xk Tagk9/.../mJnNdF164rKONnFqm1gvp2LW mr  (mp3juices.cc_downloader.exe)

9 / 68      (PUP)
http://b.find-data.ru/hp/?q=dzlBDzMOLdXBcEG xziXNcaWsenQk9mD8slrrVD0V867q3uL9PH8Ev4tSBz 6gsZBEvIejCuBltzxOCGnXAJihl/d1rL1JNoMaeQIwd/B2URIyZeRsX9 5CwEob4UpGAg6cAXGoy3/7Y6S/HlQ1wiv0AnHQJ krhSaaMWdsCKM1xfu3A3Oq5kEmaCYcYQQbMiYxd0llXjxmODlDSX8DI4i/SaL2dvHZllzf C7GvmZKZp0gnDNyqoOiEkBhbOeB0T8xoY/1/WLhqi4N73azldLZxbQnnQcKXOu39P3mhy8RHYOvJCvepT/DI7s1inN9e8fXEEGPAm KgtgWO9ex9UAEWnJVdXYKI0mLzXwHGsyeBW0Yjfl6IDhT8eg5nSLOFVzpGN0zGuSyyfTcciQzaRYqDx4 iyPTD2IxcwwqivT/.../D3qFBd1MGXqQp zTATNaeot9iNBwZT2BWlH7YKdoKQfcj3MtX3EjK8SpgNxyi4ViwxJtBfdwPk0hh  (windows 7 ultimate 64 bit pre activated by c4rl05 iso.exe)

The following 2 files have been seen to comunicate with b.find-data.ru in live environments.

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

URL:
http://b.find-data.ru/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.