home

bkhvplfjf4h52vf.yeffet.ru

CORLEON GROUP LTD

Domain Information

The domain bkhvplfjf4h52vf.yeffet.ru registered by CORLEON GROUP LTD was initially registered in July of 2014 through REGRU-RU. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Amsterdam, Noord-Holland within Netherlands which resides on the RIPE Network Coordination Centre network.
Registrar:
REGRU-RU

Server location:
Noord-Holland, Netherlands (NL)

Create date:
Tuesday, July 1, 2014

Expires date:
Wednesday, July 1, 2015

ASN:
AS59711 FORTUNIX-AS Fortunix Networks L.P.,GB

Root domain:
yeffet.ru

Whois:
1 yeffet.ru record

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.CORLEONGROUP.BB
100.00%

ESET NOD32
Win32/InstallMonstr.Q potentially unwanted application
100.00%

Dr.Web
Trojan.InstallMonster.242
100.00%

avast!
Win32:InstallMonstr-DY [PUP]
100.00%

VIPRE Antivirus
Threat.4845009
100.00%

MicroWorld eScan
Gen:Variant.Symmi.26453
100.00%

K7 AntiVirus
Trojan
100.00%

Bitdefender
Gen:Variant.Symmi.26453
100.00%

Agnitum Outpost
Riskware.Agent
100.00%

Emsisoft Anti-Malware
Gen:Variant.Symmi.26453
100.00%

F-Secure
Gen:Variant.Symmi.26453
100.00%

Sophos
Install Monster
100.00%

F-Prot
W32/A-8a9d1dfb
100.00%

Avira AntiVirus
APPL/InstallMonster.Gen
100.00%

G Data
Gen:Variant.Symmi.26453
100.00%

The domain bkhvplfjf4h52vf.yeffet.ru has been seen to resolve to the following IP address.

5.149.254.180
November 10, 2014

File downloads found at URLs served by bkhvplfjf4h52vf.yeffet.ru.

19 / 68    (Adware)
http://bkhvplfjf4h52vf.yeffet.ru/.../file_out.php?data=WV84CQtLETMPB1MKFlBUDF1fRD1cWARfFghZXwkHChlGDFEKFkZKCRoKQ1gDA1gSXEdMFQIeHwBcRRZCW1VRCV1FVBEbVAtKG1VZFkweXgdCGSFfRlZUIWpwZz1yRANAXFpbFmdiRQtBUz1oAh1KBEoTCxEPAVgSR1pMAGdYVEAOX1gFBwUMXksLB1gXVBBfQ0BdFxoKQ1gDDEBzXEFXCF0TCxEPDlgSRF9ZEV5eQg8XDREKAAkaMlFfB0AORVgHDhFbCk1fRBBMFFlDDgECR2pkEllGDFMFDhFRFmdCXQNHQj1DV0FdAFYTCwAPBllDDgcCR1ZQXQcXDREKBgQCR3teQgdZcjBxY2x_F1lBWAtWRT1jQVpMAGdpBkAORVgEDhFMHEhUEllGDFcKFkBdEU1BEllGDFYKFkBRH10TCwsPBllDDgIPXxpGVQBYVxFEUUF7BExUVw1HT0ALRwkJXxoDEllGDFUKFkZLAEpuWQYXDREKAAkaUQ8GBUAORVgEDhFMDFVUEllcDFMEBAcMVQ0HAlcORVgHDhFKAF5UQgdHFFlDDgYJXxpZRBZFDE0fWUdLC11FVBEbVAtKG3BXF11ddDB0YT13RlJIDVFSQz1mQwtEUWxgUxZBWBIXDREKAgkaFk1TbwtRFFlZDgMDFgIGCkBGQwBvXVcKRwNYClIORVgBBQkaCkhUQgNBWRBvXVcaXksLAVgXBUALSU4,&nocache=436b4301fbdf7ddfe95cb4ef581e2a10  (coreldraw_graphics_suite_x6.exe)

URL:
http://bkhvplfjf4h52vf.yeffet.ru/

Web server:
nginx/1.4.2 (PHP/5.4.17)

bl-up.ru

drykwem.ru

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.