home

6a0b0voptk.1fichier.com

Yohan TORDJMAN

Domain Information

The domain 6a0b0voptk.1fichier.com registered by Yohan TORDJMAN was initially registered in December of 2009 through ONLINE SAS. Currently this domain has been known to host various forms of malware. The hosted servers are located in Paris, Ile-De-France within France which resides on the RIPE Network Coordination Centre network.
Registrar:
ONLINE SAS

Server location:
Ile-De-France, France (FR)

Create date:
Monday, December 7, 2009

Expires date:
Wednesday, December 7, 2016

Updated date:
Sunday, July 6, 2014

ASN:
AS198792 DSTORAGE DSTORAGE s.a.s.

Root domain:
1fichier.com

Whois:
1 1fichier.com record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Microsoft Security Essentials
Threat.Undefined
100.00%

avast!
SaliCode
100.00%

Emsisoft Anti-Malware
Win32.Sality
100.00%

Dr.Web
Win32.Sector.30
100.00%

VIPRE Antivirus
Threat.4721115
100.00%

McAfee
Virus.W32/Sality.gen.z
100.00%

ESET NOD32
Win32/Sality.NBA virus
100.00%

Lavasoft Ad-Aware
Win32.Sality.3
100.00%

F-Prot
W32/Sality.gen2
100.00%

Kaspersky
Virus.Win32.Sality
100.00%

AVG
Win32/Sality
100.00%

F-Secure
Win32.Sality.3
100.00%

Norman
Win32.Sality.3
100.00%

Sophos
Virus 'Mal/Sality-D'
100.00%

Bkav FE
W32.Sality.PE
100.00%

The domain 6a0b0voptk.1fichier.com has been seen to resolve to the following IP address.

5.39.224.140
www.1fichier.com
November 7, 2015

File downloads found at URLs served by 6a0b0voptk.1fichier.com.

37 / 68    (Infected)
http://6a0b0voptk.1fichier.com/  (tor_portable_multiversion_online.exe)

The following 14 files have been seen to comunicate with 6a0b0voptk.1fichier.com in live environments.

TCP » 5.39.224.140:443
online-guardian-v2.0.9.exe

TCP » 5.39.224.140:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 5.39.224.140:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 5.39.224.140:443
onlineguardian-v2.exe

TCP » 5.39.224.140:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 5.39.224.140:443
online-guardian-v2.0.9.exe

TCP » 5.39.224.140:80
online-guardian-v2.0.9.exe

TCP » 5.39.224.140:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 5.39.224.140:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 5.39.224.140:443
JDownloader2Update.exe (JDownloader Update by AppWork GmbH)

TCP » 5.39.224.140:443
citrio.exe (Citrio by CatalinaGroup)

TCP » 5.39.224.140:443
online-guardian.exe

TCP » 5.39.224.140:80
online-guardian.exe

TCP » 5.39.224.140:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 5.39.224.140:443
autostarter.exe

TCP » 5.39.224.140:443
jdownloaderexp.exe

TCP » 5.39.224.140:443
Fazala.exe (by FelineSoft)

URL:
http://6a0b0voptk.1fichier.com/

SSL certificate subject:
CN=*.1fichier.com, OU=Domain Control Validated - RapidSSL(R), OU=See www.rapidssl.com/resources/cps (c)15, OU=GT91339487

SSL certificate issuer:
CN=RapidSSL SHA256 CA - G3, O=GeoTrust Inc., C=US

Web server:
[Sep 28 2015 11:12:16]

pjointe.com

tenvoi.com

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.