home

a.myster.info

Astap Bulgakov

Domain Information

Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
TLD Registrar Solutions Ltd. (R724-LRMS)

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
myster.info

Whois:
1 myster.info record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP, PUP.Optional.PCUtilities (M)
100.00%

ESET NOD32
Win32/Adware.MultiPlug.MH application
16.67%

AVG
Adware Generic6.AYXK
16.67%

Emsisoft Anti-Malware
Gen:Variant.Zusy.145618
16.67%

F-Secure
Gen:Variant.Zusy.145618
16.67%

Dr.Web
Trojan.DownLoader13.34946
16.67%

McAfee
Program.MultiPlug-FYT
16.67%

Norman
Gen:Variant.Zusy.145618
16.67%

avast!
Win32:MultiPlug-ZC [PUP]
16.67%

Sophos
PUA 'MultiPlug' (of type Adware)
16.67%

MicroWorld eScan
Gen:Variant.Zusy.145618
16.67%

Zillya! Antivirus
Adware.MultiPlugGen.Win32.1
16.67%

Bitdefender
Gen:Variant.Zusy.145618
16.67%

K7 AntiVirus
Unwanted-Program
16.67%

Lavasoft Ad-Aware
Gen:Variant.Zusy.145618
16.67%

The domain a.myster.info has been seen to resolve to the following 8 IP addresses.

52.27.128.62
ec2-52-27-128-62.us-west-2.compute.amazonaws.com
September 10, 2015

52.27.128.59
ec2-52-27-128-59.us-west-2.compute.amazonaws.com
September 10, 2015

52.27.128.56
ec2-52-27-128-56.us-west-2.compute.amazonaws.com
September 10, 2015

54.69.228.231
ec2-54-69-228-231.us-west-2.compute.amazonaws.com
June 19, 2015

54.68.13.248
ec2-54-68-13-248.us-west-2.compute.amazonaws.com
June 19, 2015

54.213.72.9
ec2-54-213-72-9.us-west-2.compute.amazonaws.com
June 19, 2015

54.200.195.191
ec2-54-200-195-191.us-west-2.compute.amazonaws.com
June 19, 2015

54.149.241.47
ec2-54-149-241-47.us-west-2.compute.amazonaws.com
June 19, 2015

File downloads found at URLs served by a.myster.info.

1 / 68      (Malware)
http://a.myster.info/hp/?q= /RrnbwidWrqUMOQIKsaGnLcJgDvBO8ntSw1tffoy/XsLasZj8J7IEObKCiAmaQRt/.../fv5 wsfQTo  (download.exe)

1 / 68      (PUP)
http://a.myster.info/hp/?q=ktRrn1FuzWtV xztvq0RzV9VhZgZ5pk/Z07IjBlVhpKPybXyp0/yHX8QSGrperAH8vR8jG8Gm5RqFL wDMBWQ7Sz8xeHzxehrG3gcAOlHdZtJbn3wnbGZ6 gZRcbRNp7gX Uwe4vNx9TVXt88AqqZZ /UqKEFg3Kx4rqeW4iI3rp6Et8jogtny/.../ARB5 Ym LTEUE6BemltOvuMnDwZGM14af LUHvxHXStDIeITRczDRFLKa69G5HNilxm rOBDOhoGZmZ86PowO0PAz79q0Pq3vw28q8xo1L6APTnsTDgxmuutjcGe7OFayfZtNhwT  (download.exe)

1 / 68      (Malware)
http://a.myster.info/hp/?q=HaIqm3j5e Ee SUMOQwGYDA3o6Wuy5plnFNcSWyd854JXIJK7gVr7pcEdod0r9fSgimCffft2seQYiHEOxz0APJyZjVjSQx2oOkJ8YRK5jkEE11UqQkNWBGqQmmXh5CqoflX JSIUOZteeda TXLNp/.../hJ6J3rhl4DH3pFKb3BlVGkEbf8WP4yyI0EOVRJwZldn9yk5QDxZXcmzyjwLVhq jEkrQL3r5BCoD3ALaRoH5hZcOBKl4tDTp gwZCIYRKNSlqmHZUQcECS6Z28N  (archimedes-ships-1-7-10.exe)

1 / 68      (Malware)
http://a.myster.info/hp/?q=8JHk0RFy1RfFYSUMOQwH3gMoT4XS7q7GH133eza5VU6J2tanlTqsNW1XkQh/oGNLdYhQ/HfaU/7Y yGWcP4CC8JokIqX7aN6mZASSK4LDNjyaYwOm5qGzH9Hx hFL50sCw4xTcu/.../lOF8JJzEOgGZyLC2uSu62nHbO8IYTQhOwBeGPgzD4g4Lf3  (looking season 1.exe)

1 / 68      (Malware)
http://a.myster.info/hp/?q=QfxhIyTQuRPKrdefABTXOYe 7eO88Q15wrWHPG1XE15pOGUvh6Raredn43eWZf4tksJEvmzr/O7pWAgYLbhXDQ0k/nHwzPSc1cXy37bV1ePWf/2S7IjAUNjZd9cj4vxly94H/.../iN3x0LL1lvFUy KY8HevTalUqPbM zhhgKqSCYZFBg mPs5EXgW4x  (download.exe)

22 / 68    (PUP)
http://a.myster.info/hp/?q=uIJpiAWMsxz12XZTVNGr4wFPbZKUuyv1m8RCT6bCCVxK9mw7AvgSOW0Xhv4uVKXMolB QTQfRA95iRlXZwlIkCtzGUHYLmsYNqog8L3lr3G82JwuSrI16hC/ sCb42lvrBBZCvukbclEX5tDBbiqJ MjHtmW1UMznJcleTKi1oQ9x5GPqYGaFsIkZMIAh5JcnHPaWMm5Ri5pUCqYD6U1tO2fIiKgTYcAjx/Km NWEKe1iXBodBW1TtAPX95Xw98DpB/dDJ2HDlhVathNq2OOTFbFxrRwkBR72Vqjbpq27OtuYdKdHVyLytzgBBwq4TR9QbmsU5/x0c7aKv5GKNTEZDC9g3q1/Q6296iaSfg/N/xKn9n8 v62OyyXwr5bF4NJ41ujfpG21GkHe/Xc/23gbw5LmsKTShfBYuCB7Pq1MrrxGoXmcgSpTeaIa3ich3NFMC0M9o CTcvMFIH2QjpGV7Pnw6gYP kmNOXHLZyT HDPYLtzJhmQJMkmFWqZX3oM0PeaSriaMBRl9/S0o89ifDbUSoSfZ2IZyIaMUD3m8ZWiPqzqmu/.../ohQpGixCeHeRf  (aiseesoft total video converter platinum 7.1.2 crack download.exe)

The following 9 files have been seen to comunicate with a.myster.info in live environments.

TCP » 52.27.128.56:80
updating.exe

TCP » 52.27.128.59:80
download.exe

TCP » 52.27.128.62:80
updating.exe

TCP » 54.149.241.47:80
papers please v1.0.41 setup.exe

TCP » 54.149.241.47:80
installer_game develop.exe

TCP » 54.213.72.9:80
setup installer.exe (Win by Microsoft)

TCP » 54.213.72.9:80
tmp5600.tmp

TCP » 54.213.72.9:80
tmp61f7.tmp

TCP » 54.68.13.248:80
tmp781a.tmp

TCP » 54.69.228.231:80
download.exe

URL:
http://a.myster.info/

Title:
“FunCaptcha Redirect”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.