home

cdn.berrycleanfactory.com

Communigal Communication Ltd

Domain Information

The domain cdn.berrycleanfactory.com registered by Communigal Communication Ltd was initially registered in July of 2015 through GAL COMMUNICATION (COMMUNIGAL) LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
GAL COMMUNICATION (COMMUNIGAL) LTD.

Server location:
Oregon, United States (US)

Create date:
Saturday, July 25, 2015

Expires date:
Monday, July 25, 2016

Updated date:
Saturday, July 25, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
berrycleanfactory.com

Whois:
1 berrycleanfactory.com record

Scanner detections:
Detections  (67% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Optional.BitberrySoftware.L, PUP.Bitberry.Installer (M), PUP.InstallCore.Installer.Installer (M), PUP.InstallCore.FC.Installer (M)
90.00%

Sophos
Install Core Click run software, Install Core Click run software (PUA), PUA 'Install Core Click run software'
30.00%

ESET NOD32
Win32/FileTypeAssistant (variant), Win32/InstallCore.ABK potentially unwanted (variant), Win32/InstallCore.ACQ.gen potentially unwanted (variant)
30.00%

Malwarebytes
PUP.Optional.InstallCore.SID.C
30.00%

Agnitum Outpost
PUA.InstallCore
30.00%

Dr.Web
Trojan.InstallCore.1115, infected with Trojan.InstallCore.1115
30.00%

VIPRE Antivirus
InstallCore
30.00%

G Data
Win32.Application.InstallCore.DI
30.00%

AVG
InstallCore
30.00%

Bkav FE
W32.HfsAdware
20.00%

McAfee
Artemis!B5B0F8A0D82F, Artemis!D50979CB560D
20.00%

K7 AntiVirus
Adware
20.00%

Fortinet FortiGate
Riskware/InstallCore
20.00%

Avira AntiVirus
PUA/InstallCore.diur, PUA/InstallCore.kjh
20.00%

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
20.00%

The domain cdn.berrycleanfactory.com has been seen to resolve to the following 23 IP addresses.

185.53.177.12
August 7, 2016

54.191.246.249
ec2-54-191-246-249.us-west-2.compute.amazonaws.com
June 29, 2016

54.149.195.20
ec2-54-149-195-20.us-west-2.compute.amazonaws.com
June 29, 2016

52.41.114.34
ec2-52-41-114-34.us-west-2.compute.amazonaws.com
June 29, 2016

52.38.209.219
ec2-52-38-209-219.us-west-2.compute.amazonaws.com
June 3, 2016

52.33.165.25
ec2-52-33-165-25.us-west-2.compute.amazonaws.com
June 3, 2016

52.32.12.104
ec2-52-32-12-104.us-west-2.compute.amazonaws.com
June 3, 2016

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 5, 2016

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 5, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
May 5, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
May 5, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
February 3, 2016

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
February 3, 2016

52.35.10.15
ec2-52-35-10-15.us-west-2.compute.amazonaws.com
February 3, 2016

52.25.23.136
ec2-52-25-23-136.us-west-2.compute.amazonaws.com
December 16, 2015

54.191.37.5
ec2-54-191-37-5.us-west-2.compute.amazonaws.com
December 16, 2015

52.34.170.106
ec2-52-34-170-106.us-west-2.compute.amazonaws.com
December 16, 2015

52.24.62.64
ec2-52-24-62-64.us-west-2.compute.amazonaws.com
October 20, 2015

54.149.60.150
ec2-54-149-60-150.us-west-2.compute.amazonaws.com
October 20, 2015

54.148.75.228
ec2-54-148-75-228.us-west-2.compute.amazonaws.com
October 20, 2015

52.11.182.29
ec2-52-11-182-29.us-west-2.compute.amazonaws.com
August 11, 2015

54.186.8.59
ec2-54-186-8-59.us-west-2.compute.amazonaws.com
August 11, 2015

52.24.172.24
ec2-52-24-172-24.us-west-2.compute.amazonaws.com
August 11, 2015

File downloads found at URLs served by cdn.berrycleanfactory.com.

1 / 68      (PUP)
http://cdn.berrycleanfactory.com/c?x=WlC9/fc0MsuiXgPTDTNSXNaCmdCl0dKWJHD0VIOrVsE=&c=clZjui1VFtRwsi9haP8Vo9rnW51qQinwIJxKQ3lJYUlqH NAoCApkxexoI2cUb66p11Hf04OKLrszFZZrfLpNhKISapUE2YUL4Qm3tiKpRqjU0PWR/aDFgzM/m0TLQcIjX7qgV1PDNXiXIpaMsGavQ==&fallback_url=http://www.finaltorrent.com/.../newest.exe&downloadAs=FinalTorrentSetup.exe  (ftsetup.exe)

0 / 68
http://cdn.berrycleanfactory.com/c?x=wCGEcaKms5eYK6c9GcjEj8y5yj5pc5c8E1/K66jnp6E=&c=x/LmoEpPYlrvAqpjqhSIm5IzminyFCnA0gNhAfC0EfH3Kg439abdTGvdm9eBPdhXqv71iQiYY WWVM7vTW PLxjd6p2eKv/ieXSl1Mvg3Cr2pfa4wx2y1qtvpa5A4a6HC0SkXzKo2ttz8XS2g7xTaA==&fallback_url=http://www.finalmediaplayer.com/.../newest.exe&downloadAs=FinalMediaPlayer2014U1Setup.exe  (finalmediaplayer2014u1setup.zip)

1 / 68      (PUP)
http://cdn.berrycleanfactory.com/c?x=P1PaQbhRrmYHcG Omvqrzec0teLJ9Pk0k75ctY575kU=&c=D7SqRdCHJAzGsPLCIN6FdmxaHEftuxCpfCHLyt0WzIMB7VeBH6MC5UA5vuSsXScxiqFJPFXj8dhKo4t6NxLafy0QaoushmRzOrcLot3XZZ9Z3x2AAmD0fTBYi3aVfAddq0WscjECgwvMa 4B9ZbsXw==&fallback_url=http://www.bitzipper.com/.../newest.exe&downloadAs=BitZipper2015Setup.exe  (bztrialsetup.exe)

0 / 68
http://cdn.berrycleanfactory.com/c?x=jPAckN5GUerGsvGEPtvKqiklOJlm/BOWLH7wgAzA4a4=&c=NjkgO7QYSm6TUR6PBajzYPqjc4ORjApSzZagpXLH MRzTTlaUPNlekmWZJVyI8njHvEnQ6nkH063A1pfAq64enSADo3Qcy ekMKSht OQtpQyPEABgthxmPY4lrSFjh8gNF1F X2hcrbFtVsxw2khg==&fallback_url=http://www.freefileviewer.com/.../newest.exe&downloadAs=FreeFileViewerSetup.exe  (freefileviewersetup.zip)

0 / 68
http://cdn.berrycleanfactory.com/c?x=jRsXxK/QdM1u785on8yamipFIko2ycQeFKVvlsONqg0=&c=AbyQjkrcM9NJgfeH3AuIRS6cyoLY2rJTah4O48Z2upWuNYJy7jHg1jWYs/DCSW3OJrFnmaCGp H2YhPXfsA/pzzlsELZUd5QKgsZqt49eEpHRWeMmt8P6/xpCv6lZ6vNNDbNahe7hrbs4FE53 oUtQ==&fallback_url=http://www.freefileviewer.com/.../newest.exe&downloadAs=FreeFileViewerSetup.exe  (freefileviewersetup.zip)

1 / 68      (Adware)
http://cdn.berrycleanfactory.com/c?x=s615QH/W5WfehGgGGdsruBM5MQW6jU6jx5Lt4qTt3B0=&c=0eMxHsMe/7hVfouCkvaLxIqK 2Gk2fv4BQG/0 6TqaNSSqrSprkzo/EdpkSjczPCZP8FKXIaT/G2YCvjTEkX4Q8KvlBFOtTIEUgbYhWdw0l5NlMnrc7OVq1DIxLbGvobqBwrNqmM5yhUywNobir6/w==&fallback_url=http://www.bitzipper.com/.../newest.exe&downloadAs=BitZipper2015Setup.exe  (fd84183db0f163e51c28822f9f34a5ba)

1 / 68      (PUP)
http://cdn.berrycleanfactory.com/c?x=S3nvLjpXI5kFUGU/Pwp TnwkpTTblnzNZLFfn/ijB6A=&c=u IbKh5m1kkjn7mgx0ie5SZ52ZpWroFXu7e7FUFV DV96uB9h0eRyl9YbdSpKRJOpVw N51ih yBiIK4hBWXP1f4hzi/iH8X09xe pmi1TKL/b 0EcirrYtO PGW3KZWcZGK93Wcdc3r D1ZpXrKlg==&fallback_url=http://www.finaltorrent.com/.../newest.exe&downloadAs=FinalTorrentSetup.exe  (ftsetup.exe)

1 / 68      (Adware)
http://cdn.berrycleanfactory.com/c?x=C69Lqmn6Dq4spME/FvTCvwUvKxMsCwNUVtqre4EHKjg=&c=QjXxryQLhvyk9Z10rCNoPzLHlRjqWa77I45fqPgD/hjl895wmdDz3L484swEvKoi3kfPIEG39Vu1H7yHBhABxSC7y dij89tX/lk0MBuZqQ4uPMnkGUgtaVzFV45/vK3Y0OyIRVMb0w7bAyodKmeYQ==&downloadAs=FinalMediaPlayer2014U1Setup.exe&fallback_url=http://www.finalmediaplayer.com/.../newest.exe  (finalmediaplayersetup.exe)

1 / 68      (PUP)
http://cdn.berrycleanfactory.com/c?x=nm1k67LanBJ0kQvDCIQSWnwVz9LYZs6NL O/Ik3y09E=&c=l8Z3lyU0RQhM/YLkRFzswohtediaOkv zmVQvl34u0QznA2NQCIDWh7opyiU6s 8SmNWnbmqyQVHBz3V77zHkJObMpvQ0ZPyxzJht6JsEAPSCnmmWeLT29kJdIQZTDVTx9eGDFTBjntKFXPoARNO3w==&fallback_url=http://www.finaltorrent.com/.../newest.exe&downloadAs=FinalTorrentSetup.exe  (ftsetup.exe)

13 / 68    (Adware)
http://cdn.berrycleanfactory.com/c?x=QrUqIGNPqrx0hcUDrKbrgOChVgywUecSuTB30d6GKF8=&c=oSOkFjRS6FM0PJ4VEvVSvBnjdDXUa8etnzfD0wMxqbgvk6QALRJJlrPamI89Mc b0SSKo8lGJpKe90KsPPCSfIAKq5LhvnusXUdoVldMARhkkeV5PGaby6RvY/uJImz1e0UV4BEBf3YPgyEaeLHBGg==&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe  (e81c372bd08aef6c222093712e9a35b3)

1 / 68      (Adware)
http://cdn.berrycleanfactory.com/c?x=/TX//VZmlH5ho2LDbPc yZAxZZFBPQr0cNHDg69QTRI=&c=rIk7fB0WqQu5qiyawvYWrXqZG1U1Vety140yMPFJO1otlBP4A8AW1dhJErZMm3dKzExb5bDWy36Nyh3/KatSaTdOjOVWX/JJk1wy4zsnVrIfZA9AOSl cvY026C8oGgdp1qQL9bBTjw8lK9vddQG w==&fallback_url=http://www.finaltorrent.com/.../newest.exe&downloadAs=FinalTorrentSetup.exe  (87f46caa8f2b5a92fd2ff7adaefd4af2)

13 / 68    (Adware)
http://cdn.berrycleanfactory.com/c?x=P9gurbf6nWYMQ/9oyr7mbxG8RLWu1OJ6FkyZbBudH64=&c=I9xMd4qQl86aCWbm2r8cQcjIJji650zsDDeXuC//jwg/cZXVHH3TtNQY1jY4iBGuLGuUc1D2j655Dy3WFvdwF/pXQca4g7e3gvPSTHzYrVAdKg4 rKdH68UpI4itTb Y5KCooj7eVo8XGE0psL9LEA==&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe  (b5b0f8a0d82f934940c96810391d1dec)

3 / 68      (PUP)
http://cdn.berrycleanfactory.com/c?x=JgGFA6CD2MUEi J9BoHqJ6NwGHUDmP wkUcahYNF5W4=&c=K7OtJojBY6n7cJKUB8vE/7w47SQ8FlBKdubQy6SGHKzJnuPpkyYb 4m50ltDf PhoUSaQ4HQCDlMINnzPwVJSfmshxSE5HC pg9dKP fWbLWb8Y/41pwF2dPz4NgPw1 NAGN4eF3Pk8pxUSyO/RFwQ==&fallback_url=http://www.freefileviewer.com/.../newest.exe&downloadAs=FreeFileViewerSetup.exe  (3569046_stp.exe)

1 / 68      (Adware)
http://cdn.berrycleanfactory.com/c?x=AKxsRh9xlJbyMjSvOVL4NrOYtrz62kAYRXCAkL4W mQ=&c=55TFApkLm 5Gcah1QQ0JnyrBfQ0/LBR/m 61f2IkQQGNzIOcTqXTJbeiaevHWBJqDwhgechMmk5tsL4d/Ipehn9a4N4F6sYvTf32JOqVQC e0FKvbPyaRz esH3idDh4XH6L0B0HGzj7bRx6RDCN0g==&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe  (8b291470d68f3b06e19a573d7a06c833)

13 / 68    (Adware)
http://cdn.berrycleanfactory.com/c?x=aCiE0F2/6fDw5UhsiEf8ROFz2M09wmToGK MuaSqbp8=&c=rcHIMka2wcZFQdVtwccP6ctBUcsaoHJDZdjGD5OvuLMOjOWaROY1F2ezeD2LChD7HC52Vr0uM8OWrERAM3bPAqtv UGgaNgc/evjTOD9ZNNODvS9i69Qu4bHm9EFR9c2L74wpo97afo24I/KO/xTNw==&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe  (b5b0f8a0d82f934940c96810391d1dec)

0 / 68
http://cdn.berrycleanfactory.com/c?x=MrEKH2RVgUUqMyOsddkbFloYL5gaCIRoqflUQxFX9LU=&c=ZVi6Q7Xazz4C0D/AKmrYno64BC0Y0YukO0k1tHemwcpy2p4TgK/YGUE1fRuwYXDhYlcsDS7AIkAsg4oQ7lB06o20W zQBfaqCMjMZSjE3whOVDdJfEBJ9RC2FvgY9gOdB1OcE9ae8wespMH1ZGtjiw==&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe  (freefileviewersetup.zip)

16 / 68    (PUP)
http://cdn.berrycleanfactory.com/c?x=Mgkg uWxGVHb/m 5P89Bbze/TgwZ7awlnr3vS9NoVtE=&c=/CEHHwLVXUXUN912g6MdEDb8EeLAXFCxsSwTbQqTTJA480TuNczzop7DwTvAYtZ4FL459rg0tyOGwStBNK4Ie0fG3XU9KaRCVB0 lfEQ42tVa1m0LjwyAtqxD97XpA6xwq6R NUWeCg2iZvG2sNoMg==&downloadAs=FreeFileViewerSetup.exe&fallback_url=http://www.freefileviewer.com/.../newest.exe  (freefileviewersetup.zip)

3 / 68      (PUP)
http://cdn.berrycleanfactory.com/c?x=fApM2nJEnEso4TTTJtr6ox lcW8RNvjtacC1ojrrXwk=&c=oOUFXqS1da0n/g9OH0nOYWeLh2iYsqrS/GvBDLuPS7FR/uIVn05o2MZeDNDQNf4KOnEOt7ltBcyZk0PUdc158PkuaUXM r02FB1qdyTFOEUwRe b8U4Zp/UJGKx5frrHmV1/k8IkLMPL3ELgDQlc2Q==&fallback_url=http://www.freefileviewer.com/.../newest.exe&downloadAs=FreeFileViewerSetup.exe  (3569046_stp.exe)

0 / 68
http://cdn.berrycleanfactory.com/c?x=lBUKH2ADta ImGyI3OFYQ4I685I1vp0CQXzKnkbyO18=&c=NkCVuNWUDMor7GoBJUXSicGs/X2/si57WLN2FtRw22 aH8hjK5JTcJt/rT3ElvWi2OIfFUbR2LHmnmKskW/osB3qILpdGmtfcWQyO3/3OAqXmwkYVbvP5pHI7paGgwK/oGe6MWwY2Uiiv3rWa4MD3g==&fallback_url=http://www.freefileviewer.com/.../newest.exe&downloadAs=FreeFileViewerSetup.exe  (freefileviewersetup.zip)

The following 18 files have been seen to comunicate with cdn.berrycleanfactory.com in live environments.

TCP » 52.38.209.219:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.38.209.219:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.38.209.219:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.38.209.219:80
browser.exe (Browser)

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 52.38.209.219:80
3.9.0.128_20140916045038.exe (The KMPlayer by PandoraTV)

TCP » 52.38.209.219:80
e5be.tmp

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

TCP » 52.38.209.219:80
client.exe

TCP » 52.38.209.219:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.38.209.219:80
kmplayer 3.8.0.117 -[www.patoghu.com].exe (The KMPlayer by PandoraTV)

TCP » 52.38.209.219:80
KMPlayer_3.9.0.126.exe (The KMPlayer by PandoraTV)

TCP » 52.38.209.219:80
3.9.0.125_20140702035547.exe (The KMPlayer by PandoraTV)

TCP » 52.38.209.219:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.38.209.219:80
online-guardian-v2.0.9.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.