home

skymonk2.bin

Skymonk Solutions Limited

The file skymonk2.bin by Skymonk Solutions Limited has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. While running, it connects to the Internet address v-5-511-d2330-167.webazilla.com on port 80 using the HTTP protocol.
Publisher:
Skymonk Solutions Limited  (signed and verified)

MD5:
653ce05900abfe5002f42ca5d9392072

SHA-1:
c62c6e4d08134d33ba97198365b188e4587ad365

SHA-256:
d3b587810d48fda3128b8481cc5f9087f727668ee44187930e29aa81253f3db9

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/17/2024 12:45:38 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.SkymonkSolutionsLimited.L
14.5.19.1

File size:
354.1 KB (362,640 bytes)

Common path:
C:\users\{user}\appdata\local\skymonk2\skymonk2.bin

Digital Signature
Signed by:
Skymonk Solutions Limited

Authority:
VeriSign, Inc.

Valid from:
4/9/2012 3:00:00 AM

Valid to:
4/10/2015 2:59:59 AM

Subject:
CN=Skymonk Solutions Limited, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Skymonk Solutions Limited, L=Tortola, S=Tortola, C=VG

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
632A5F301191DF03C4933D982BAD525F

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to v-5-326-d3695-85.webazilla.com  (78.140.170.85:80)

TCP (HTTP):
Connects to v-5-520-d2185-103.webazilla.com  (78.140.134.103:80)

TCP (HTTP):
Connects to v-5-511-d2330-167.webazilla.com  (88.85.71.167:80)

TCP (HTTP):
Connects to v-5-511-d2326-163.webazilla.com  (88.85.71.163:80)

TCP (HTTP):
Connects to v-5-510-d2282-180.webazilla.com  (88.85.71.180:80)

TCP (HTTP):
Connects to v-5-510-d2276-174.webazilla.com  (88.85.71.174:80)

TCP (HTTP):
Connects to v-5-510-d2275-173.webazilla.com  (88.85.71.173:80)

TCP (HTTP):
Connects to v-5-326-d3696-86.webazilla.com  (78.140.170.86:80)

TCP (HTTP):
Connects to v-5-20-16-d1972-185.webazilla.com  (78.140.184.185:80)

TCP (HTTP):
Connects to v-5-20-16-d1962-183.webazilla.com  (78.140.184.183:80)

TCP (HTTP):
Connects to v-4-kp25-d1847-147.webazilla.com  (78.140.184.147:80)

TCP (HTTP):
Connects to v-4-kp21-d1911-154.webazilla.com  (78.140.184.154:80)

TCP (HTTP):
Connects to v-4-kp18-d1945-158.webazilla.com  (78.140.184.158:80)

TCP (HTTP):
Connects to mrs02s05-in-f0.1e100.net  (173.194.35.96:80)

TCP (HTTP):
Connects to mil01s18-in-f3.1e100.net  (173.194.113.227:80)

TCP (HTTP):
Connects to mil01s16-in-f6.1e100.net  (173.194.35.6:80)

TCP (HTTP):
Connects to lhr08s04-in-f2.1e100.net  (173.194.41.162:80)

TCP (HTTP):
Connects to fa-in-f139.1e100.net  (173.194.70.139:80)

TCP (HTTP):
Connects to de-in-f113.1e100.net  (74.125.24.113:80)

TCP (HTTP):
Connects to de-in-f102.1e100.net  (74.125.24.102:80)

Remove skymonk2.bin - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.