home

a.discountwaterfall.info

Pavel Mashkov

Domain Information

Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
OnlineNIC, Inc.

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
discountwaterfall.info

Whois:
2 discountwaterfall.info records

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Optional.PCUtilities.Task.Meta (M), Threat.Win.Reputation.IMP
100.00%

VIPRE Antivirus
Threat.4732184
50.00%

Dr.Web
Win32.Siggen.7
50.00%

Microsoft Security Essentials
Threat.Undefined
50.00%

McAfee
Virus.W32/Virut.n.gen
50.00%

The domain a.discountwaterfall.info has been seen to resolve to the following 5 IP addresses.

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
April 16, 2016

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
April 16, 2016

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
April 16, 2016

52.27.23.115
ec2-52-27-23-115.us-west-2.compute.amazonaws.com
July 1, 2015

52.11.167.137
ec2-52-11-167-137.us-west-2.compute.amazonaws.com
July 1, 2015

File downloads found at URLs served by a.discountwaterfall.info.

1 / 68      (Malware)
http://a.discountwaterfall.info/hp/?q=PAhCWm39o34f5JLFHwoBE7OZva4ah594QnzJWwCyG8ZDLhf/DqdPaRt1yWyKdInStcit gXC/eeRtZIpeYA5JWVizu2tdIsxiwPXhd4AnFN62KvxnJw b2y/738XYpaBy8Eh5cZHOfwsrz3aM212Ztun7Fx/7nx76vA3rsLOvhOUyKmZsd2TBpxNJruuLZHbro80PEw5wwg 2O1QH1dJzoK3nOk9yQPP0QazIjGpMNK4oGM nGy4cNWhCTEyhqvNAQcf4cwztE9tOanRmVopSqikE1YbFI u4EhdOkOO P6SqWxeeNaepH TUpjj4NjpJkyTEv4NOCVpPa4RBgXc4wVFL2YjejCWdfw29p9yBZzVYGrKlzaT0Utm/.../1K4FXCTe Y1uB1zJjt j9sWTJw1y5pwN5RR2b7QZqsWNXc5IWlCnNmZ53msdvjonDnzljrDq0Alskp0RAYq3FgtL9wU1Drm55jOfDtLQJccOEz ZuH5iXTCQPvjiBuFlJkgDeUmsJ8FQaCPl dn4EbFsSRlzKTa6GqtSLPwuZg87EVzWfsPQjYwabfrvjlD4Ya   (assassins creed rogue with crack is here ! [codex version].exe)

5 / 68      (PUP)
http://a.discountwaterfall.info/hp/?q=ZO laFb9vdzxqdefABTWlrtVPasacsKqUUEj9 E8KNOLm2BEPSp4UkxKKGQzXnzGOmYHp WHYqZqWLeukqnytQ2uWBMRzUol3al KNOLGcjDbmidPZvAKmnT2DKeOuS3OaPFfrJT7KQvbAvqC8EOF1BkQlM52NWIHQom1F1Tw9W1ubRcCFrlQ9Tyq8qvnwTvpN9Nq2NNb14xWDNLO5Y6sVV4X1Y2ciExtnIjBnxRlHOiqEyFTNjPngRDpn J9H7VBT49z1kyaHiiLZHShmYGq92BEi8RoG5r y8olWAHWaFvJdj7A0uHA5vfP7a8Relrxcze 2B3QNQHaSraMEPjUnHSB3a7uYJAauwEhf4AL7P7hiSWgDd7NYlRm9R13zZ3DJIf3maLcLyqvBox8HRLRI3wGRrQSKrqu3tzzThfe9NmOg2nSolZbveQzY4N2mSeLx2epGYKvkXzYQlrGWlGxMn6ZBicyQxawuLeYpvMmsMiPPFDqsYnRm6Rmura/eUgzqqeo9/.../MPTUKbwmJG9P7FTMutgU6Tyc jHk  (lights_-_siberia__acoustic_.rar.exe)

The following 2 files have been seen to comunicate with a.discountwaterfall.info in live environments.

TCP » 52.11.167.137:80
download.exe

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.