home

a.engineer-best.info

Tomer Berel

Domain Information

Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
Dynadot, LLC

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
engineer-best.info

Whois:
2 engineer-best.info records

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP, PUP.Optional.PCUtilities (M)
100.00%

ESET NOD32
Win32/Adware.MultiPlug.MI application
25.00%

Comodo Security
Application.Win32.AdWare.MultiPlug.VA
25.00%

Avira AntiVirus
TR/Crypt.XPACK.Gen
25.00%

AhnLab V3 Security
PUP/Win32.MultiPlug
25.00%

Fortinet FortiGate
Riskware/Generic.AC.4386
25.00%

Microsoft Security Essentials
Threat.Undefined
25.00%

Dr.Web
Trojan.Crossrider1.22656
25.00%

Emsisoft Anti-Malware
Trojan.Agent.BKMB
25.00%

F-Secure
Trojan.Agent.BKMB
25.00%

avast!
Win32:Adware-gen [Adw]
25.00%

Kaspersky
not-a-virus:AdWare.Win32.MultiPlug
25.00%

Norman
Trojan.Agent.BKMB
25.00%

Sophos
PUA 'MultiPlug' (of type Adware)
25.00%

Malwarebytes
PUP.Optional.MultiPlug.SID.A
25.00%

The domain a.engineer-best.info has been seen to resolve to the following 9 IP addresses.

199.59.243.120
May 26, 2016

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
March 3, 2016

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
March 3, 2016

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
March 3, 2016

54.213.72.9
ec2-54-213-72-9.us-west-2.compute.amazonaws.com
June 19, 2015

54.200.195.191
ec2-54-200-195-191.us-west-2.compute.amazonaws.com
June 19, 2015

54.149.241.47
ec2-54-149-241-47.us-west-2.compute.amazonaws.com
June 19, 2015

54.69.228.231
ec2-54-69-228-231.us-west-2.compute.amazonaws.com
June 19, 2015

54.68.13.248
ec2-54-68-13-248.us-west-2.compute.amazonaws.com
June 19, 2015

File downloads found at URLs served by a.engineer-best.info.

1 / 68      (Malware)
http://a.engineer-best.info/hp/?q=HAqd BVGoWVtwysurpaJCrGaH/rELJpiMPlka4orI8 bsx8FhC/Km Lk9Z bnfeBAXcX dbOnVqC9/ bzQ/Fpb0VJFOVYfe7UPHCH7YP0SutOak4TKfbp8WOa0qMRbDn/tavAN1JIUEOyx0W5EJexeRLgWkBWOIO3OuGCB0CKZs9g3oVBH9 oyeaENTF/.../mCQcynRkFuueCaTqSKRm7c pr74  (counter strike 16 game.exe)

1 / 68      (PUP)
http://a.engineer-best.info/hp/?q=K1r3H6DYy6tlEG xztkeg2EEIKa0TWOEEzXND0/GQgFm8251rH L Z4wXuj1dHywxJ5BoQ0Lk8 xLwwQ4FqdWL5HCOl9AQAOOhHRXgVqKxt/qr9TY9TVt9VtDcr/.../ReQfWv1KzcVcSv305plVW9Q6yQQTwXdz2XuUs5xebKmr6Fsm9Cs 4 GCQO7AtCIxhtui8mnsnz9tjSRyOoB8  (download.exe)

1 / 68      (Malware)
http://a.engineer-best.info/hp/?q=VZOtqok6NjM056789/OPoShBIJ7VfoOEEz62jBrGQrW8v/51vA2phPTv1UfhBLo7Has AAZHqQWfMQntzXMAUCOc 1pwRnrHNMn804462y0S/.../ZsCsvchXVQ6tGaMC2c0D  (download.exe)

15 / 68    (PUP)
http://a.engineer-best.info/hp/?q=s7UxCLi2S19lGPRJLFvncz7XTR2aBpMSEW/SvO6eG88eK7/p/65hM1bb4i80VCS0oGYj2GkpaISNo2iEyEkekwVlwObwUEVHSdBka/cLhRj9VHKbxNK3xT GUjHBSVKtlASr6vmSLNVVSvrB82wijjn5yts1eqAcqM20QORiDfSId7QW2 j8qpvsSc5CcX57B1jDQOTDHZwOxTJX6 H5fsLwTxNykImPTdc4U3JB82ydPf1K3Qs1YC/kKx/4QJLuWgI9OnMaBbZuMiHoDjH6u7KtWAOOXlmT FLk6agzYfGxDiRECo0RITEOpN8nhy/.../PCYA3OimmpuNVIpedBx7A4olT9X f3zIGhESQ xO7   (iobit driver booster pro 2.3 serial.exe)

The following 10 files have been seen to comunicate with a.engineer-best.info in live environments.

TCP » 199.59.243.120:80
qvtp.crx

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

TCP » 54.149.241.47:80
papers please v1.0.41 setup.exe

TCP » 54.149.241.47:80
installer_game develop.exe

TCP » 54.213.72.9:80
setup installer.exe (Win by Microsoft)

TCP » 54.213.72.9:80
tmp5600.tmp

TCP » 54.213.72.9:80
tmp61f7.tmp

TCP » 54.68.13.248:80
tmp781a.tmp

TCP » 54.69.228.231:80
download.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.