home

a.artaggregator.biz

Fabian Mesku

Domain Information

The domain a.artaggregator.biz registered by Fabian Mesku was initially registered in May of 2015 through DYNADOT LLC. Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
DYNADOT LLC

Server location:
Oregon, United States (US)

Create date:
Monday, May 18, 2015

Expires date:
Tuesday, May 17, 2016

Updated date:
Wednesday, May 27, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
artaggregator.biz

Whois:
1 artaggregator.biz record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP, PUP.Optional.PCUtilities (M), Adware.Generic.AT (M)
100.00%

avast!
Win32:MultiPlug-AAE [PUP], Win32:FakeDownload-G [PUP]
22.22%

Dr.Web
Trojan.Crossrider1.36852
11.11%

Emsisoft Anti-Malware
Gen:Variant.Adware.Mplug.47
11.11%

ESET NOD32
Win32/Adware.MultiPlug.MI application
11.11%

F-Secure
Gen:Variant.Adware.Mplug
11.11%

Lavasoft Ad-Aware
Gen:Variant.Adware.Mplug.47
11.11%

Norman
Gen:Variant.Adware.Mplug.47
11.11%

MicroWorld eScan
Gen:Variant.Adware.Mplug.47
11.11%

Zillya! Antivirus
Adware.MultiPlugGen.Win32.3
11.11%

K7 AntiVirus
Unwanted-Program
11.11%

Arcabit
Trojan.Adware.Mplug.47
11.11%

Bitdefender
Gen:Variant.Adware.Mplug.47
11.11%

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
11.11%

Avira AntiVirus
TR/Crypt.XPACK.Gen
11.11%

The domain a.artaggregator.biz has been seen to resolve to the following 6 IP addresses.

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
February 28, 2016

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
February 28, 2016

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
February 28, 2016

54.213.72.9
ec2-54-213-72-9.us-west-2.compute.amazonaws.com
June 19, 2015

54.200.195.191
ec2-54-200-195-191.us-west-2.compute.amazonaws.com
June 19, 2015

54.68.13.248
ec2-54-68-13-248.us-west-2.compute.amazonaws.com
June 19, 2015

File downloads found at URLs served by a.artaggregator.biz.

3 / 68      (PUP)
http://a.artaggregator.biz/hp/?q=gcXF6Wq0v owXrpnikds4GdOKSikP7wpfKwpMXrtWNJmH7YRDAOEEcXGMBMDpGCsLAY75bUL9Gu vqf W5Ro16o DnN4OiLg nxZLgKDpTjE9B80oY nQ0oYb815rzarhr2EP8G1xW7MFwWPS21gyOuKa4ZYyQicmZMjZ5naHo268t7ikXRCT6aXLgLNvaoa1p6eKZ4sp/rxrOHRIcauS6U36udaSLeQtTPZ9pIAvMdUa7TEnrZ83pUsGLHkmZ H6zTd7CBTxMCbNDYzj0NiQbtWbpfwohOpVEALWOgEZgEjATjWEEY CSPJ9Otmb0tSkJIrgHiq6xF8MIt/4ee9RJwPL0vIejC /.../h3icnsg7o54QzB3mo7JchQX0MQjLcYSz1AC2g 61uZ3bq2wmSRjdbJCBFVI6hX8jHctUhdoMrVrHm2S1e oyJJyiibBAXLCbcgI176VWCrdBlYxqVsV1nKySM9cOO2  (connectify pro crack 2015,plus lifetime license key.exe)

1 / 68      (Malware)
http://a.artaggregator.biz/hp/?q=qQNsrrubfrq9923456Y86KrPyaeNVsl0oGnlit5RP10hC4wnJJzYh15QUA6zt7Z5sfLVw4K/r FHV0GaKV1CQBgAG33xM1Lhdhs37/JW yJaH1dVWo/MLQqV7H9Jgye/.../3qxm DfhLwuYJ4pAZehle8OhwOOFZlgPM83ZZdeWhkht65ypHRIcbOVXMTsX5CGUHAKCbJSxS0rXunGEz6Fn9hiR7wbr13xVutT6erTI2BaP mLgmvLKS0s9sD11WM1jmyha0zSmh1PrqEFTpLenoxuIffjIZhc7qtJAWju5Bw680HY3fKdNClcnyZ6gmD8C64jzPOnI6Rqm7YYX8GhmYLFxXkaBlVH79TTH3Ue7hff9euMB  (dios mo, pero qu te hemos hecho_.exe)

1 / 68      (Malware)
http://a.artaggregator.biz/hp/?q=nlYGAS3AB75qtZTVNP E3lnsyYSh Mvhm/NL4cmPlFHRRddmLWvJYegWvdfbupFzKPElcOjE0owfrJJliva n54K1hYVwZHU/.../TYdjpqmTnNWBu  (lea simanjuntak - menangis semalam.exe)

1 / 68      (Malware)
http://a.artaggregator.biz/hp/?q=YEWEfBMFEm8Sng0123CbdU1l/5cIWw9ikJzXl/Hc4D/sqxBo 7JekmQbqtpGE0euKWlODmzv yJN3laWV8SLrJ3A1AqI811prG15NLH1mfaKz1rNlAxvS7jM1G4gVDv sR8fPn7iy1hShvRioZlZuu8v9b4HO33juGgGIZU7wuZjD1Bbe52EpexfH8Xk3RfU5FDo66NLR2vkxfntxnm8/.../OaLhwI  (download.exe)

1 / 68      (Malware)
http://a.artaggregator.biz/hp/?q=K Otqn08yK35vKEG xnC4E5xOxSbsQ8ncAME85 oYH6wGCqMq3ZVbEZPHfDgiXx 2fvnztPFRjlfo8HLlCl2lXGsHVyrDSdCY8i9nPT9sxKaNeW6x34d10ejo5/KFQsmNs3e2qsX3zJnwVZnZTW4w55pGC 2BfoCaZK4/.../Tq1C156BC6qDcuxOvJY1  (download.exe)

1 / 68      (PUP)
http://a.artaggregator.biz/hp/?q=gy4TNUAS1nzAGjlhab7yyfBbu4w4s nlnHMueAGJyDXq5672Ii65xI51uojrX4jB r4dzONLIHUla5/kZh3GKMzIY43ieY/4UAUOYTtquArw4/iqa5i1LZ 7EInPGeBJ2RcjOpANeV26aWjv4iAvd LZxkbfc6CYZmqq 9Bl1YGlOuTnMqKxBVIYg3dN7qu2n4i9x5P3caLml2qcFEi3VkVeGFpg 96A2nShzCJs3VsliACa8a4TOWywsf2cnHMvfHJchQY5BpRyvCv5KS2T3AeRxIHGnPzYtiJclzlX6xDPejvIA6Rxd/0ZDAk5LuOf0yW04GW4/.../PSb3qZfnH0GzVGtTMwC1FaGMM PLcHT1yVNWmb vCTq4NT9SSR5D5EG4CsQVAy  (street fighter 2 game download for pc.exe)

1 / 68      (Malware)
http://a.artaggregator.biz/hp/?q=gy4TNUAS1nzAGjlhab7yyfBbu4w4s nlnHMueAGJyDXq5672Ii65xI51uojrX4jB r4dzONLIHUla5/kZh3GKMzIY43ieY/4UAUOYTtquArw4/iqa5i1LZ 7EInPGeBJ2RcjOpANeV26aWjv4iAvd LZxkbfc6CYZmqq 9Bl1YGlOuTnMqKxBVIYg3dN7qu2n4i9x5P3caLml2qcFEi3VkVeGFpg 96A2nShzCJs3VsliACa8a4TOWywsf2cnHMvfHJchQY5BpRyvCv5KS2T3AeRxIHGnPzYtiJclzlX6xDPejvIA6Rxd/0ZDAk5LuOf0yW04GW4/.../PSb3qZfnH0GzVGtTMwC1FaGMM PLcHT1yVNWmb vCTq4NT9SSR5D5EG4CsQVAy  (street fighter 2 game download for pc.exe)

1 / 68      (PUP)
http://a.artaggregator.biz/hp/?q=HP8R3lYJ /.../mQxJMp94b04DMp3F6A4toOJ8OrxZlxltEkNTZwgEqIxAh3cwmpMKnP5oJ6 aGtl6fVsJBZsqyhu3BdXu2MQDoxZ9UHJfZmJVBjDfJZO4jiEND8ykOKozc0F7QkAKADZzaIH1gslLI3 1  (cs_condition_zero.zip.exe)

18 / 68    (PUP)
http://a.artaggregator.biz/hp/?q=OgbWSecALsOShrpnikdsas/PEYShuLoBZ0lxzd0C0e00N3LNlQrxqfBlCmnYXWFsguPyEahyPoXj /rgvNQ8c3euFuL2wCsfjYYziROdKVTGNTAj MTHlMSORizdiequ FI4BfPf58DzNQKIB7AVC0dTaEwvs0i 2Ujfsd qC8tYCUYV0HRRSrxOq81ZdSdesXvZjNJran7zRAAmukCfjmSdDBMs3nxMU4CQkzoPwQ WllCgzLzoynHvI0g4DgCLvJcjM267cDMc1s6sn/hOKGqIHo3WRkQdWu Qy5JJ1Vz/C7eALYyWKEfEj/1So5hKjRdBurDUYvTkE0gQ/PhUN6ZcnLXdiDcOthBNDxIrYrmJVznrPbBmsAepvdNlCQIcIuWj/iSqYDu9Qr UZVeoK5ZOpkgE1JMOysLO8eAlfhSM6p0W9zm23z/QEftoR5GEad7sMFiXV/PnSWwkKUmpVKlk 6Go2dMoxFvukcoPfEoxqA7wtnHX2uKHbvqh8vxQODqs1QTMLmaWdibKyXDRC0lUoaQ4jCn87qrfUkw5lZqXPAKwAe1SmxX8xbOKa0uLNkajPQevKQa6 WK6LVjZHb19eQ8pfNCH01sB 10JTxOxvQUrliC8AyvZy7mOwgm/1xt9TJp/mHfGQIhNOeYQwQF0ig3Gx/.../opwLal5a0FCBX2o4snPR1Cbuztw5uRNiNSbg94q9nF4tgfpHYiGaPGGx2PLB  (download.exe)

The following 6 files have been seen to comunicate with a.artaggregator.biz in live environments.

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

TCP » 54.213.72.9:80
setup installer.exe (Win by Microsoft)

TCP » 54.213.72.9:80
tmp5600.tmp

TCP » 54.213.72.9:80
tmp61f7.tmp

TCP » 54.68.13.248:80
tmp781a.tmp

URL:
http://a.artaggregator.biz/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.