» ip.installpack.net
Overview
Analysis
IPs Addresses (3)
Downloads (15)
Network (7)
Website Detail
Related Domains (17)

ip.installpack.net

WHOISGUARD, INC. (Proxy Registrant)

Domain Information

The domain ip.installpack.net is registered by proxy through ENOM, INC. and was originally registered in July of 2015. Currently this domain has been known to host various forms of malware. The hosted servers are located in Gunzenhausen, Bayern within Germany which resides on the RIPE Network Coordination Centre network.

Registrant:

WHOISGUARD, INC.

Registrar:

ENOM, INC.

Server location:

Bayern, Germany (DE)

Create date:

Friday, July 3, 2015

Expires date:

Monday, July 3, 2017

Updated date:

Friday, July 3, 2015

ASN:

AS24940 HETZNER-AS Hetzner Online AG,DE

Root domain:

installpack.net

Whois:

1 installpack.net record

Scanner detections:

Malware distribution (100% detected)

Scan engine

Details

Detections

Reason Heuristics

(M), Adware.Downloader.Alexande.Installer.Meta (M)

100.00%

Rising Antivirus

JS:Trojan.DL-Generic/JS!1.A4A8 [F]

6.67%

The domain ip.installpack.net has been seen to resolve to the following 3 IP addresses.

85.10.200.21

85-10-200-21.clients.your-server.de

April 22, 2016

85.10.196.94

static.85-10-196-94.clients.your-server.de

April 22, 2016

178.63.40.158

static.158.40.63.178.clients.your-server.de

April 22, 2016

File downloads found at URLs served by ip.installpack.net.

1 / 68 (PUP)

http://ip.installpack.net/InstallPack.exe (installpack_bb38a.exe)

1 / 68 (Malware)

http://ip.installpack.net/InstallPack.exe (installpack_n_4828b.exe)

1 / 68 (PUP)

http://ip.installpack.net/InstallPack.exe (installpack_7cbe9.exe)

1 / 68 (PUP)

http://ip.installpack.net/InstallPack.exe (installpack_d87e1.exe)

1 / 68 (Malware)

http://ip.installpack.net/InstallPack.exe (installpack_n_dc1ff.exe)

1 / 68 (PUP)

http://ip.installpack.net/InstallPack.exe (installpack_n_f6399.exe)

1 / 68 (Malware)

http://ip.installpack.net/InstallPack.exe (installpack_n_8d5d7.exe)

1 / 68 (Malware)

http://ip.installpack.net/InstallPack.exe (installpack_n_da2a6.exe)

1 / 68 (Malware)

http://ip.installpack.net/InstallPack.exe (installpack_n_0596c.exe)

1 / 68 (Malware)

http://ip.installpack.net/InstallPack.exe (installpack_n_f1b53.exe)

1 / 68 (Malware)

http://ip.installpack.net/InstallPack.exe (installpack_n_cefe7.exe)

1 / 68 (Malware)

http://ip.installpack.net/InstallPack.exe (installpack_n_67f4a.exe)

2 / 68 (Malware)

http://ip.installpack.net/InstallPack.exe (installpack_n_eec6c.exe)

1 / 68 (Malware)

http://ip.installpack.net/InstallPack.exe (installpack_n_a4b38.exe)

1 / 68 (Malware)

http://ip.installpack.net/InstallPack.exe (installpack_n_ebc3e.exe)

The following 7 files have been seen to comunicate with ip.installpack.net in live environments.

TCP » 85.10.196.94:80

SoftobaseUpdater_2.0.exe (Softobase Updater)

TCP » 178.63.40.158:80

UCBrowser.exe (UC Browser by UCWeb)

TCP » 85.10.196.94:80

UCBrowser.exe (UC Browser by UCWeb)

TCP » 85.10.196.94:80

installpack.exe

TCP » 85.10.200.21:80

directx_9.10.11.exe

TCP » 85.10.200.21:80

UCBrowser.exe (UC Browser by UCWeb)

TCP » 178.63.40.158:80

installpack.exe

TCP » 178.63.40.158:80

installpack.exe

TCP » 85.10.196.94:80

installpack.exe

TCP » 85.10.196.94:80

installpack.exe

TCP » 85.10.200.21:80

SoftobaseClient.exe (SoftobaseClient by Microsoft)

URL:

http://ip.installpack.net/

Web server:

nginx/1.8.0

Related Domains

besplatnyeprogrammy.ru

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.