home

a.castanyepicdata.com

Oleg Bazhenov

Domain Information

The domain a.castanyepicdata.com registered by Oleg Bazhenov was initially registered in May of 2015 through ONLINENIC, INC.. Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
ONLINENIC, INC.

Server location:
Oregon, United States (US)

Create date:
Saturday, May 16, 2015

Expires date:
Monday, May 16, 2016

Updated date:
Monday, May 18, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
castanyepicdata.com

Whois:
1 castanyepicdata.com record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP, Adware.Generic.AT (M), PUP.Optional.PCUtilities (M)
100.00%

F-Secure
Gen:Variant.Adware.Mplug, Gen:Variant.Adware.MPLug
15.38%

ESET NOD32
Win32/Adware.MultiPlug.MI application
15.38%

Lavasoft Ad-Aware
Gen:Variant.Adware.Mplug.47, Gen:Variant.Adware.MPLug.35
15.38%

Avira AntiVirus
TR/Crypt.XPACK.Gen
15.38%

Norman
Gen:Variant.Adware.Mplug.47, Gen:Variant.Adware.MPLug.35
15.38%

MicroWorld eScan
Gen:Variant.Adware.Mplug.47, Gen:Variant.Adware.MPLug.35
15.38%

Arcabit
Trojan.Adware.Mplug.47, Trojan.Adware.MPLug.35
15.38%

Bitdefender
Gen:Variant.Adware.Mplug.47, Gen:Variant.Adware.MPLug.35
15.38%

Emsisoft Anti-Malware
Gen:Variant.Adware.Mplug.47, Gen:Variant.Adware.MPLug.35
15.38%

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
15.38%

AhnLab V3 Security
PUP/Win32.MultiPlug
15.38%

G Data
Gen:Variant.Adware.Mplug.47, Gen:Variant.Adware.MPLug.35
15.38%

Vba32 AntiVirus
suspected of Heur.Malware-Cryptor.Multiplug
15.38%

Fortinet FortiGate
Riskware/Generic.AC.4386
15.38%

The domain a.castanyepicdata.com has been seen to resolve to the following 8 IP addresses.

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
July 12, 2015

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
July 12, 2015

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
July 12, 2015

52.11.167.137
ec2-52-11-167-137.us-west-2.compute.amazonaws.com
July 1, 2015

52.27.23.115
ec2-52-27-23-115.us-west-2.compute.amazonaws.com
July 1, 2015

54.200.195.191
ec2-54-200-195-191.us-west-2.compute.amazonaws.com
June 19, 2015

54.68.13.248
ec2-54-68-13-248.us-west-2.compute.amazonaws.com
June 19, 2015

54.213.72.9
ec2-54-213-72-9.us-west-2.compute.amazonaws.com
June 19, 2015

File downloads found at URLs served by a.castanyepicdata.com.

1 / 68      (PUP)
http://a.castanyepicdata.com/hp/?q=Dpn5yMWSRUF2avqomj3NCmpO1kUrA0zrjwKDrTQeT3rrzagZ5CvhXl1xJZMm51bbf3sxiwUn8u8g6x99fwMFb9JG8Um9UcubPQMifuREU5smXJ J/M4QRlw4M Xv0I5BNOiGaZHGI5YpzI5bXmi1Q6Uv7shcT65UbjH8ufX3tlilhtYWTwoBwp1KLXHJWUe9ie/kXvqNjJQId7pmqmxZqYrk6vpsP9wJIM3eZ5qEGIQUtJLgMTLh15EN2JzPfuU0ObHYbG7oBJJdTFK1GzVGLTrqT3qaoWySUAbAj0qTM/.../ M Adpon7qj1k9laQa9vZ 3wXhnxW0cXc4gcsqdZl6xgE40k1D6zyLzoIK3  (pleasure or pain 720p bluray.exe)

1 / 68      (Malware)
http://a.castanyepicdata.com/hp/?q=3WNsrqqkNEOKs12345WjoSCrNDgdohedDyIh/SkX6EiDfmzUkIdnU1P2UBZLxxOf4bHRKdpwvWv6cNX5enw0wJedEGErbN4lvCR uzVU1TKxxtA3jgLnK7UgA60Y8yWo6ju3iQ3x3xkcP/zWGxVqjp8yaI9E4iZrJKtk xr14wZZeLtakvbf0gip293wdRaRES62tS3JLj9cJswbdyB AhkiLAeDpgn8kilnpFDI63r4NC09BhMoIkAqgADJ2 dvnqzv0oKyPFpIkCyj/X 12E3Se/zZLcz 7s3J8W837ACj0HLVR2uXfiP8gf44U/.../KA0gZygMteKifPd3pvGjfeVWCiRa7AwsIvRJstAIWjaCDa8nXZ sEA8UDVvYBBiCmIFeXprvtVIyTM  (pleasure or pain 720p bluray.exe)

1 / 68      (Malware)
http://a.castanyepicdata.com/hp/?q=tSg8/vwyfcz8ysurpnbYg1 bKOLoRuGRwkxABp3Z/GQ0cuN2VbmUtSAGn FxXflUdU1LO9PZ QOzr 9AKo0WftPjQJuisqaDPf4c4q8J9kF1l/wp2snIyK1GQmDf0KtgM fl3LX500ymyOvqwIlWdwSvK/7Vu2F8z8k/imrLSvafQwojflY0l/pybTP4Po2o1xqEGUi4M2GOYNs27EaKPZIe83V5/lV9t3u1BprFIITecc/KgPOR3t8ceD4ECicdzCy6uOUH07d19d7xXzSanAyYKmMdrvjLfPX1/.../eSC4ac9DpjgAIaGZhawm2y4nFwFGaIjgM5AQWNlr4K8ZLX  (chris brown turn up music.exe)

1 / 68      (Malware)
http://a.castanyepicdata.com/hp/?q=8lhCWm3XQqucdG xztkePI6zLQjvdC5WOpGUv5JkAZjlOWTUNLkkekO8/eaC3pk/MQbCcizD3BC9iQgiP1kJb88adOy7U89cpnfgtpHVAujr6HLnaist6vIJOfBxdlRkY7Tq0YjnUTJng6np2BU5TwOOWAYyycjw9D3jIhZsp3OJP VitZLnHGfY0HmdF/eKWe 9IfiqRo6wivdjefH1HubhXOfX76VFBmFSP3wwDWPRiGufzNMXuqDoVXJk7/.../xA  (jennifer booty.exe)

1 / 68      (Malware)
http://a.castanyepicdata.com/hp/?q=Uxg8/vz0rBJ SUMOQIyxZFTQEcUzC4YsQnN pzjzQ/eWIZ/i3aBPLv3OG2yS4ZQOSjOO3WgShyEI0 FxnRI7kYaBHua/o hCTYBtXP4BUiHSPakLy8qoTIlH0Ss7ogFQi66wxgQXXzhI1ThOYHSvDya/.../LyB rxzUTH8a6OhszUqRUDwYblfoU9W3jyYB76Nl1xycxnNT2YaHwffPUahF UlHbi7jQuCSLJKS1Hdj2fGPPXU   (jennifer aniston.exe)

2 / 68      (PUP)
http://a.castanyepicdata.com/hp/?q=mfcYU7TMrCOabqomjl4tN0t17qw4MsIiSGDFArIbAhhHktbVkdeOvUROjBzsju4Fv7aeI5Vpvw8xlzAOtGmrLZyZWMDVQ4WDquXcRbi/v9I1/kpp1jXk/kkPj7RZqK4i59zgh3OhZKy3kI8OCltzy8s5hhUW7wpobfS1/hcdsLqgCHcTi98ne8E0No19R2oEAjXvKy81mVwggHszbKRMnXcwh/mit0s2M967jIzjV9cH3a80sjM33550yG/.../q4t  (ed sheeran x full.exe)

1 / 68      (Malware)
http://a.castanyepicdata.com/hp/?q=WnjAtLib1vTQKfABCDN7ev/mu 00DHrtz53tfJqckVxLYsmlZGmsWawexoPZPeEaj4RyHNYQ5n/EbBMygLnaxOoPyCkqgGrhPEjnaWpEoKI/UBYOdzx/yvzYnK0tClZz7DR9cjZBkYXfN/L3Y7uno6QglRRA4Phi864C0S DAdqDtJEC hMJFBcNMKT3HhlSH7Sd5XAQdiz 6dQIHolToR1ZqRwNbdTGJhmFRBUPrzmSkhinerrLrzEgvR3GnKlXKx3xT/ePa7Cb7VeC2afpawTKQWufX0TWQbtwrBTrEJ6WrNK4vN7I8yXKJdxNzZwecjEwErGwcmf UpG3PHz0a1b2J5P7SAmNZQm9h4uoGa7u7eKQ6gwlhb40KT5TJfocNgpRbnUoiy8ybxUGeQ11v5h5JRejfb9xLHs3lErWLjsmD4UF70yP8v5e wS17paIgoK/.../rmozmO c9kLRbQyd OTOg7  (the_music_of_smash___season_2_(2013-mp3-256kbps)_.exe)

1 / 68      (Malware)
http://a.castanyepicdata.com/hp/?q=jms1Lif/pNiRU23456YB8EdVNHmzh3LfU1/2mPYDBLTT6v1iLEfiGEJwHMPSGlpncP88P8jzI5r6KM Yu9MJlYop4zcBz3G1fuCCP4UkieAcwD6i9sMLV8OnPBLiyjZ36GYXz2sCiyBrlJXtTae7x/T4rcndCctrI30QTFyLaG4QupXYzsVKJ2T6cnf 0FKhDrxmia6237wwdhr/rzT5qpLg43k Yd2I8w6xyTXHvk5RgsjvJ3bkWOZwd/vnX4pB9fMtfiERhSxcSxulpBWMUv4u0dln8GNinHWEe7ubDvfWwLn1g7wIPrBASM96QbtCJwjwow6yakMaJwYZS3tQEIDqkZt0Qs7o59OvQO5Gi8gbQMANws74oanUszUUY5BYcDVHRTH1AQalxqzxojFNUAngV315xPgdumImUahZrxP9A9dJ1PjvRqgMelQZEk74Ot6XFzZgMBTapO2sdpoWGUYrcTFLwv6Uu66yu/RRyXgVQw0CrbCXF38nOC1budkRtBIbXqb2CvgiL4Ur MFMS8WFpFN1xgLnMHJwycS0vWHtiyTSOpLmdyM117QBHVEV5A8yZ5qF7XJ31JTgAxOMVsBoxIz fl9xqO7aM29cQ47Cqzf/.../yV  ([cd] racionais mcs racionais mcs 2014.exe)

2 / 68      (Malware)
http://a.castanyepicdata.com/hp/?q=OBqd BV AILH0MOQIKs1hXXDyueD31Wq4zGPu/GALwRdRJTaT61Y7qofb7q/rsksdmdFr868SdpXyu65 z3aS9dZfc29lNYK278356XHKdkPa1oj7sgsU7Vj0sgejmR2EqufYvBBcH/ldB7hqWvxDO8iu/r RBVSpY007t0MCMzQdwQBFTzUz7kNp/EU4i8mu7sjVOdhIiEDOazKbkIoX1z9ASblaU4tUmRBsHSiM9dULxUy49I2/pfVoghfBth1FUqf17WuOu3dva12ycM3wjNEAUZZSczXQpYzCQsa7KbLX0ONrf9iWDiqJpBZnSsvixHsXfHAmdz7d2ZxmQ16mLcxEkw8/6RGKSPshCi1LZycQ/2ciwIG7qr3e6kEe8GNeiQgB0ATwwAjeParYhZIV7Vv8oqPU16B9mf0NhS9W3v1swzKD i jbxIrsfh0X7NKwRsOBNlW7hEjH67eKIHiMiTqAP70R8CJYxKnzT4d9PoIhUNCm19KddPNXxZpFIYLqfI 2NxcTe1L6SM2nOXxGCzGUL5IcsybKYzK0zMHOlCGWyweJyLYH FetIScJOKbZZjQxM5TDjHMW2fKnE7N/l6V4H2XlNxObqsw/.../wBmIdWufxG4I1isEzp  (microsoft office proplus 2013 sp1 vl x86 en-us may 2014 activator.exe)

1 / 68      (Malware)
http://a.castanyepicdata.com/hp/?q=/nEmlYk4isqbvqomjl4u1d6V4pH2aS6ioA6XaIPMsCt/ZB1CZ5n4M8ghQQbWwOEz1ibYcgKy NO4Af4AGbhVhQlICARdQ1DdzX rgxOzuZR5GcxSJZVyz5dU6gwSjb4ufDVQfb1l7XaRj7RfMlOsUpMRuKjIqBb6TE56c65K/jtSQrHKoaqlpgSOX5Le3kok/p2O6J6PcA87y2RdQ3cr4/.../Rh8RJizlLxg0FTGshcMNTk14yFPqy  (microsoft office 2013 32bit.exe)

1 / 68      (Malware)
http://a.castanyepicdata.com/hp/?q=E/Iqmed5YIhtl6789/.../ALVVVTuBcGDq6O5Q0XLSw2lz5rj4C76Hi02IxqN8nBU4Zn6lgLkwRbb3jLGE1KNt7jMeD1 5TJ1zczZee5IeeGbEDdMckriTiXiairLo6IfLPNxf3rIdjLNZDdqt6rUpXc2hNO4FdiA8Um4oGcU7vio69Z8e2Tr 5dk8el4dk  (grand.theft.auto.v.update.5.exe)

21 / 68    (PUP)
http://a.castanyepicdata.com/hp/?q=WQg8/ruo45xne56789MfR4UlwxWG18tsu/RYRehpAOA8iZn6Yv4sjTr2ovySMBKRsJj xbcdHVsegqAYGUGSQ/41wx8Jd nsA3M/khrlrB3jYAXFm65b9mtq6GJs7ny58uLdE9P753KdFTFgmPZ9yRHpfalafk7BAliip4DJ9r5eMuWbHTzwYelVtAMoHVHz9cHh12y7E qiHk8buHI12TPwf6/KzCZdnQEO2d93/uCDYHmtDXdhQJD/b2oBfGGx v4uB5qFs9JlYeAKKiInV52AcPqsYudIJMl5IXGN6t0 dQWuxWthjxUyBvuJk0up2JMnpFU7g89iab62Hu64Mip4aqKVe8CY/dAnoaaq2wTuH/071JTVpT6JE7XGLRnu7z8nRGxPU2GDkxseJZVskMloxO9lZ8y4dk6HMjmkeet8Kgs0V5/eRkQ9sH6d642cZO2ccejmZhgzmzfZ6VX 4inPxSSWYwTQSvyrgDt9SA96GgLFPnSVxqs8BIXkXd2Naso3NwY8/.../JB  (smadav 10 crack patch serial key 2015 free download.exe)

17 / 68    (PUP)
http://a.castanyepicdata.com/hp/?q=fSPupifA7MDQcomjlh5pZMqxNhlFtAlE2FM16IoUDmR8DbJ jvolQC3 V/.../16tR7WUExJGqaRFax6CvFHFP5cqiQeKD3D9TsygwMecd Wve9feU  (chappie.2015.720p.brrip.x264-yify.exe)

The following 6 files have been seen to comunicate with a.castanyepicdata.com in live environments.

TCP » 52.11.167.137:80
download.exe

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

TCP » 54.213.72.9:80
setup installer.exe (Win by Microsoft)

TCP » 54.213.72.9:80
tmp5600.tmp

TCP » 54.213.72.9:80
tmp61f7.tmp

TCP » 54.68.13.248:80
tmp781a.tmp

URL:
http://a.castanyepicdata.com/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.