» www.reqwhwlg.com
Overview
Analysis
IPs Addresses (10)
Downloads (9)
Network (3)
Website Detail
Related Domains (45)

www.reqwhwlg.com

YinSi BaoHu Yi KaiQi (Hidden by Whois Privacy Protection Service)

Domain Information

The domain www.reqwhwlg.com registered by YinSi BaoHu Yi KaiQi (Hidden by Whois Privacy Protection Service) was initially registered in June of 2015 through HICHINA ZHICHENG TECHNOLOGY LTD.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Dallas, Texas within the United States which resides on the SoftLayer Technologies Inc. network.

Registrant:

YinSi BaoHu Yi KaiQi (Hidden by Whois Privacy Protection Service)

Registrar:

HICHINA ZHICHENG TECHNOLOGY LTD.

Server location:

Texas, United States (US)

Create date:

Wednesday, June 17, 2015

Expires date:

Friday, June 17, 2016

Updated date:

Wednesday, June 17, 2015

ASN:

AS36351 SOFTLAYER - SoftLayer Technologies Inc.,US

Root domain:

reqwhwlg.com

Whois:

1 reqwhwlg.com record

Scanner detections:

Detections (78% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.Elex.337Technology (M), PUP.ELEX.337Technology (M)

87.50%

Vba32 AntiVirus

suspected of Trojan.Downloader.gen.h, Downloader.Elex

62.50%

ESET NOD32

Win32/ELEX.EO potentially unwanted (variant), Win32/Toolbar.TNT2.I potentially unwanted

50.00%

G Data

Win32.Application.Elex, Win32.Application.Agent.UMEK3M, Win32.Application.Agent.I2A2RF

37.50%

Malwarebytes

FraudTool.YAC

37.50%

NANO AntiVirus

Riskware.Win32.BrowseFox.dvamdx

37.50%

Kaspersky

not-a-virus:NetTool.Win32.NetFilter

37.50%

Dr.Web

Adware.Mutabaha.85

37.50%

Fortinet FortiGate

Riskware/NetFilter

37.50%

Panda Antivirus

Generic Suspicious

37.50%

McAfee

Artemis!320C81D2C840, Artemis!D2995E48FE6E

25.00%

Zillya! Antivirus

Tool.NetFilter.Win32.6841

25.00%

K7 AntiVirus

Adware

25.00%

VIPRE Antivirus

NetFilter

25.00%

Baidu Antivirus

Adware.Win32.ELEX

12.50%

The domain www.reqwhwlg.com has been seen to resolve to the following 10 IP addresses.

75.126.4.203

cb.04.7e4b.ip4.static.sl-reverse.com

February 1, 2016

75.126.4.202

75.126.4.202-static.reverse.softlayer.com

February 1, 2016

75.126.4.201

c9.04.7e4b.ip4.static.sl-reverse.com

February 1, 2016

75.126.4.200

75.126.4.200-static.reverse.softlayer.com

February 1, 2016

75.126.4.199

c7.04.7e4b.ip4.static.sl-reverse.com

February 1, 2016

75.126.4.198

c6.04.7e4b.ip4.static.sl-reverse.com

February 1, 2016

75.126.4.197

c5.04.7e4b.ip4.static.sl-reverse.com

February 1, 2016

75.126.4.196

c4.04.7e4b.ip4.static.sl-reverse.com

February 1, 2016

75.126.4.195

75.126.4.195-static.reverse.softlayer.com

February 1, 2016

75.126.4.194

c2.04.7e4b.ip4.static.sl-reverse.com

February 1, 2016

File downloads found at URLs served by www.reqwhwlg.com.

1 / 68 (Adware)

http://www.reqwhwlg.com/Public/softs/dsk/6.7.58/.../iDeskContain.exe (desk365_update_v6.7.58.exe)

1 / 68 (Adware)

http://www.reqwhwlg.com/Public/softs/dsk/6.7.61/.../iDeskContain.exe (desk365_update_v6.7.61.exe)

0 / 68

http://www.reqwhwlg.com/Public/softs/lim3/9284/.../wzp.exe (05ab66e35e18430da9b202f0cc282ec2)

1 / 68 (Adware)

http://www.reqwhwlg.com/Public/softs/dsk/6.7.64/.../iDeskContain.exe (desk365_update_v6.7.64.exe)

14 / 68 (Adware)

http://www.reqwhwlg.com/Public/softs/dsk/6.7.69/.../iDeskContain.exe (desk365_update_v6.7.69.exe)

9 / 68 (Adware)

http://www.reqwhwlg.com/Public/softs/dsk/6.7.76/.../iDeskContain.exe (desk365_update_v6.7.76.exe)

3 / 68 (Adware)

http://www.reqwhwlg.com/Public/softs/dsk/6.7.64/.../iDlFunc.exe (desk365_update_v6.7.64.exe)

3 / 68 (inconclusive)

http://www.reqwhwlg.com/Public/softs/wz/1.5.108/.../wzp2yac_out.exe (25ccadd3c0b567c69123fffb8010e65b)

15 / 68 (Adware)

http://www.reqwhwlg.com/Public/softs/dsk/6.7.71/.../iDeskContain.exe (desk365_update_v6.7.71.exe)

The following 3 files have been seen to comunicate with www.reqwhwlg.com in live environments.

TCP » 75.126.4.195:80

wprotectmanager.exe (wmp control by Cherished Technololgy LIMITED)

TCP » 75.126.4.200:80

yacdl.exe (px ins by px ins ltd)

TCP » 75.126.4.202:80

wprotectmanager.exe (wmp control by Cherished Technololgy LIMITED)

URL:

http://www.reqwhwlg.com/

Title:

“升级系统管理”

Web server:

nginx (ThinkPHP)

Related Domains

30 of 45 related domains

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.