home

a.bar-job.net

Valeriy Udod

Domain Information

The domain a.bar-job.net registered by Valeriy Udod was initially registered in May of 2015 through DYNADOT, LLC. Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
DYNADOT, LLC

Server location:
Oregon, United States (US)

Create date:
Monday, May 11, 2015

Expires date:
Wednesday, May 11, 2016

Updated date:
Sunday, May 17, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
bar-job.net

Whois:
1 bar-job.net record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP, PUP.Optional.PCUtilities (M)
100.00%

McAfee
Program.MultiPlug-FYT
37.50%

F-Secure
Gen:Variant.Strictor.88463, Gen:Variant.Strictor.88440, Adware.Agent.PQH
37.50%

Emsisoft Anti-Malware
Gen:Variant.Strictor.88463, Gen:Variant.Strictor.88440, Adware.Agent.PQH
37.50%

avast!
Win32:MultiPlug-ZC [PUP]
37.50%

Norman
Gen:Variant.Strictor.88463, Gen:Variant.Strictor.88440, Adware.Agent.PQH
37.50%

Sophos
PUA 'MultiPlug' (of type Adware)
37.50%

ESET NOD32
Win32/Adware.MultiPlug.MF application, Win32/Adware.MultiPlug.MH application
37.50%

MicroWorld eScan
Gen:Variant.Strictor.88463, Gen:Variant.Strictor.88440, Adware.Agent.PQH
37.50%

Malwarebytes
PUP.Optional.MultiPlug
37.50%

Zillya! Antivirus
Adware.MultiPlugGen.Win32.1
37.50%

K7 AntiVirus
Unwanted-Program
37.50%

Arcabit
Trojan.Strictor.D1598F, Trojan.Strictor.D15978, Adware.Agent.PQH
37.50%

Bitdefender
Gen:Variant.Strictor.88463, Gen:Variant.Strictor.88440, Adware.Agent.PQH
37.50%

Avira AntiVirus
TR/Crypt.XPACK.Gen
37.50%

The domain a.bar-job.net has been seen to resolve to the following 8 IP addresses.

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
February 12, 2016

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
February 12, 2016

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
February 12, 2016

52.11.167.137
ec2-52-11-167-137.us-west-2.compute.amazonaws.com
July 1, 2015

52.27.23.115
ec2-52-27-23-115.us-west-2.compute.amazonaws.com
July 1, 2015

54.200.195.191
ec2-54-200-195-191.us-west-2.compute.amazonaws.com
June 19, 2015

54.68.13.248
ec2-54-68-13-248.us-west-2.compute.amazonaws.com
June 19, 2015

54.213.72.9
ec2-54-213-72-9.us-west-2.compute.amazonaws.com
June 19, 2015

File downloads found at URLs served by a.bar-job.net.

1 / 68      (Malware)
http://a.bar-job.net/hp/?q=6xg8/rvk9 5nMOQIKEu3FJJa9fjr/peHzR08gZwGcC3wl0cyMV6EvhVUSfmAdKn7swCX4oaBwN6iG3f/8uhCGPlbXP63J82kEoFzG8TuxVPAm OqPvNMOQzrmFOfejUPcxEV2LpeU5RJl5BCCMtSJDwWlz2QsSqcrMElh8O69raTBqta ZKQ/6CtbOQDYqNh/pqMpnGoWcz 0IfOKKzYw6/NEg6XaIXJ5NLwiQyJT7/JIB2clnb2Cv01w GmeBapxD4RlKxDo0gjvNOKxkwVtSJ3aI8dRBTAU1maKKNmUAiDssll5gYgOLEmEXfDBt3DTB7SUAiXOhSkIdeIo8VhOJM3lSIM 4UkgfFep/5rykZqTF7plC5bmSkQ1jja tPiBduVuqKdGUyqfSykTfXXScjvqse5yeIDRdjjMBM392D1CbxZTe D4i4gwbI2/pbyhhShNsfckPl7ss 5tptPBsxm OqwolTfQw9FYGO Ml5WlHikEnRlrMOXjzfMRSPS4LeN0q6ljojw9a9Eh9tUAiXOudU7wYBJk PNXFyHt3HsLExQjeaMLy42KudHXIb7sjvBmdi NkjCP0oIl8E9MaSRWAIsYxSJDwX0RZ30OjAKe3kdtZoufGvavbhXoDAtsUFc/xv01CPMqDnvm5RLZKaGOSaG7V/.../p3u4R2VwwsI8BGtBgD1i1RDAcYCVeLa8ZBM6KTLx5pH2jUxnoGd3Mis QN4  (dil dhadakne do - 1cd - predvd-rip - hindi - x264 - mp3 - mafiaking - m2tv.exe)

1 / 68      (Malware)
http://a.bar-job.net/hp/?q=4 7P2vz0z3R6n789/XQJ S/rdrv1iwuXE1bRI99jRiJb3LoPxwWRQRn8c8XlW0nwjJ55tQNEy7mCmu1Kgq cbTuVM9K/.../rkGkrBxGzx6CgGr54 gzM9Uzsqj8yJkWae3fd1 egGUrQ  (tcs.softar.rar.exe)

1 / 68      (PUP)
http://a.bar-job.net/hp/?q=f5DKe4ae/ knynikg0fEvXUr3xZg1JNLshdj4Jy14MO6DqbqbpfVk10Qb6KZgN5pnVq/.../HisYr Hp5gKojsJydqsIXaWhYBEbs JzQSZVmRo9r8cunOW72AvBNa0E7EEiv4sHc0joz1zqKoO6niNq9RSbWd5Rpk98s3Uq1szysVVp41  (avg antivirus 2015.exe)

1 / 68      (Malware)
http://a.bar-job.net/hp/?q=A2k79xYFkP5Zz9/XZTKVEYiDB8ySUAdhMGOUoanYqia8vWIjtJEF5zA7fO9oVEj 7nxBsvj/Rq DflYz4BhUJwhyXKS0vWIoY5/8 THl4T40EwPRBn9WJczgNg154iTsI82rpBSl r82EGAIF0PLkLqm6gwvUwSqKP08jvfl2wXT7YLQVcbT5 w9FVAmcuMfgg48o vHDWQJW/Z0ktgm/.../aI9MYt6EDEvNIY7vt4yXFa4iDTDnph5mjy3KzyvQzVE36c4YnuB  (avg antivirus 2015.exe)

23 / 68    (PUP)
http://a.bar-job.net/hp/?q= oCIdhVNnBHYMOQIKEu3ODc7JmZPrh6GFwAo8OpwifNge7arbo4Ajry6s5K3nzVeYnKQI5/8ixSmbq07cw9tUA2 mF fUCg4Jx8ndrySfj H6GIFda1n5y6Z4 AEm1fWK3eyGFXNTAmIia76XC16qB3y6zUCp4cDqCLZ2R33vj0PUAYtAPZAcwTFhu17 MFNbHNmOanqcYdTwv/Wi2xbtOS1wFVrYryO1bfxhuTo7vjDXHbYYdLwLd92s4623nPLXEbzMjGmdhr7e1VqjxJ3LDjxLwZc0ZXw0W81aLyXGn9uQbyTR6iTMBMvPI6btQ1fyQa43z/wbrYnVA0AdnEjqV7FIlopxaFe3qRdP7b0bnDJX4ov9bfN1Qof EA3luEV9r58LUnsx5kyV GlfpmHAR8I9mk9bH9y8m0StdolRXz 4juuI3FN0IQ8t/2cjp8axl1rj/.../i VnGjMmRYe997aRs6gxAoyEzfEZGIPy29dALVdaHim1elcbv MYziuBfMkaGvUWmWIH1kA9zaSCh  (windows 7 ultimate serials (1000% working!!!!).exe)

1 / 68      (Malware)
http://a.bar-job.net/hp/?q=TZFigMXVNHu1aIKEG pgnFNS2tGboRrFJzT6pn62i64Grb Oxpe7geIXf2KdRmzpTFKXesNKLSszvK8ycwK4oGPVPiv V2 ICNW8EryTANXNlOUFdabOcr90w AL5ydWK3es2kMgT66mdK76X1dSNnLy6zv/VvfKqCJ//w6EBj0R/KdqAPUkgKuJU7T7 MFN1GpHR2jcSYdTLuJqnwAbtNYG4skiBryNlM9qOtYD7Y26 rRKodr4CAsh44sZT1S3SiHlIEImi tQLO6X2LMIqsueme9idzjmLQ 4MAk/154MjxZg2y6qqEWjbmJr/x8u8QIuxF3UbsFBY2SWdqpHuttPIb23zZvScda9zxwngyRCSfiLhmIMEctXidYsSH5QUAbo/.../z94NPgsg4hLFdEzfklDf3BbZyqwUr9q3eO1PAlsjr8va8tVj3Sakm6hW11IkE7lNT0nE2YmuoS1rYs0l2iyecZq95xgnCeSGMWrdcv9dWKZsy1wUU845pjt4HVuDwZYYj5vfJdLT2 QOG7uVFgN7bM3jvXEAeWW7moQ1xozCm  (windows 7 ultimate serials (1000% working!!!!).exe)

22 / 68    (PUP)
http://a.bar-job.net/hp/?q=jBS BOVOxZMjABCDWYRL0JVE7YzphgX8hOJj6D06hvfWHiEzGd5AR hFKUz7Yoiu/9VrqnVqhQZuqRGN6LpBhQBF0VvfH9THUkJA5Jm7S3tIphrEkRHC5MoBGhQ8qYy1Vp3vQ/zXpFXDW87FQuk/.../vARZzPPG9mc7O X1UfmRbgEzmb1VB4xfLWr0V4vkPhmrHzAfQS4C7MRAhpUDPbZsoLz dUH5I4So  (hack tool 2015.exe)

22 / 68    (PUP)
http://a.bar-job.net/hp/?q=7tZH7VCVE5EGYhabcd93ZRY2u3qYblDZfahcAClnu/.../KhQYm1 n8WIwxm3MSQ3vfTU90GLtahnqMtPTpsmK 80QRL0BoUD37gan3g1Vfqp51lIcMSXqnhbgwDwBMxkXGZ5kJZnMgA351LwyXiB8meeg2dY6BSvWTgwdUpRNY orKlzbcNSkGQJB1 NRp58zNsALg4OITYQmyr6FHLPncb1UZ7TsgM0ngDyo wOpKdpkUWq7ahNxWIWKm9zzqW0P6OidQect9Aflxtg1KMcQD0PCkcGqAwNEU8X76  (king james speaking bible.exe)

The following 6 files have been seen to comunicate with a.bar-job.net in live environments.

TCP » 52.11.167.137:80
download.exe

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

TCP » 54.213.72.9:80
setup installer.exe (Win by Microsoft)

TCP » 54.213.72.9:80
tmp5600.tmp

TCP » 54.213.72.9:80
tmp61f7.tmp

TCP » 54.68.13.248:80
tmp781a.tmp

URL:
http://a.bar-job.net/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.