home

a.postumes.com

Dastan Isaev

Domain Information

The domain a.postumes.com registered by Dastan Isaev was initially registered in March of 2015 through TLD REGISTRAR SOLUTIONS LTD. Currently this domain has been known to host various forms of malware. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
TLD REGISTRAR SOLUTIONS LTD

Server location:
Oregon, United States (US)

Create date:
Friday, March 20, 2015

Expires date:
Sunday, March 20, 2016

Updated date:
Tuesday, March 24, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
postumes.com

Whois:
1 postumes.com record

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
Threat.Win.Reputation.IMP
100.00%

Dr.Web
Trojan.DownLoader13.35876, Trojan.DownLoader13.35534
50.00%

AVG
Adware Generic6.AYYI, Adware Generic6.AYYN
50.00%

McAfee
Program.MultiPlug-FWG, MultiPlug-FAC
50.00%

avast!
Win32:MultiPlug-ZC [PUP], Win32:FakeDownload-F [PUP]
50.00%

Sophos
PUA 'MultiPlug' (of type Adware)
50.00%

ESET NOD32
Win32/Adware.MultiPlug.MF application
50.00%

Zillya! Antivirus
Adware.MultiPlugGen.Win32.1
50.00%

K7 AntiVirus
Unwanted-Program
50.00%

Avira AntiVirus
TR/Crypt.XPACK.Gen
50.00%

AhnLab V3 Security
PUP/Win32.MultiPlug
50.00%

Vba32 AntiVirus
suspected of Heur.Malware-Cryptor.Multiplug
50.00%

IKARUS anti.virus
PUA.Win32.InstalleRex
50.00%

Fortinet FortiGate
Riskware/Generic.AC.4386, Riskware/Badur
50.00%

Lavasoft Ad-Aware
Gen:Variant.Zusy.145662
25.00%

The domain a.postumes.com has been seen to resolve to the following 4 IP addresses.

52.27.23.115
ec2-52-27-23-115.us-west-2.compute.amazonaws.com
July 1, 2015

52.26.142.209
ec2-52-26-142-209.us-west-2.compute.amazonaws.com
July 1, 2015

52.11.167.137
ec2-52-11-167-137.us-west-2.compute.amazonaws.com
July 1, 2015

52.10.67.234
ec2-52-10-67-234.us-west-2.compute.amazonaws.com
July 1, 2015

File downloads found at URLs served by a.postumes.com.

1 / 68      (Malware)
http://a.postumes.com/hp/?q=VhNsrqqasmA51JLFHwoB9d02zXom E2SCjON24H57x5GV4/.../Vq8CxZkbhhjTjD4L4cDdcA58zeQGrR4 zA1FS803qqeANRgdgCm11gyfPQuhNcTQJLNwxgiA9TjiZv6bb1cacplsWqON6wGero94d95aO1LttLppz2wYHJw0e5ka15Xdv6MFC1qUrenTxKU4IxqhQl3Joa7C8LMdVrQCbuTbfzTOqQN119cGHPB1JPCeL2S9Xd1Z0euq2dAOxNjVE3Zhc3A4bv5Jbk4OD6fT  (mini-imagenes-sims-3-mega.exe)

1 / 68      (Malware)
http://a.postumes.com/hp/?q=ZCUxCFadvk1HSUMOQIyy14IhvUMNzPNLnPiKs5rG0560Hr7plcrP5WB0tmvc6cQIpu2td11ZAuPYrhTFbl5nuzUPVrZekA4emDxKlKY7dG8AsZHbDanMcbxI7ArbvxUAVNJR1KG3IHa5xrshH BZBlQ6ALh54SEM1jFG/.../LYqCQxvD3ASy6goJNZ3GNMrhPYRX 2ogErm5WNShR56I QeJ4p raER  (download.exe)

16 / 68    (PUP)
http://a.postumes.com/hp/?q=HXLnkDz02dhZ5wysurhOjVzXhOzhPRmuubpGU9WM1G44szTDZ5npA/AYF xDtOT7bK/thQO6drxycES1sxaD6vdiba1/LTEnFoqSt3VSpNF285qw2ZqVHzg3Nx4PaNJDE7RcuH6FrJzxm XGTClYrFN4a sxjuNI/GdpVJyeQWtocw pOgWhJKijUNePrUaVlr9xN2P37D0t8paIyzFzf59Z0oADKQTFpIoWNY P4oi6T8C21Lw4kErKnzmZO3Xx/KuQejeb/j25gb5Fdu4vAhyP8u8mn wBzCIwqLR5Xl2ep2xbWeJNVfavgG3nGtrAw9QDVolCDgLTuS3H1ctpz0geVXJbrE7aZHKZuMlnvTDg6cMZMwYkDiTJlgWA4rB772sdzCtqxKAVLXSy/.../MH3f3Q8oI4dliVmPqkubPZB  (divergent (2014) 720p brrip x264-n3kr4.exe)

22 / 68    (PUP)
http://a.postumes.com/hp/?q=oQ2XTf67/CS 56789/OPNl1kdvyABh6e0N3eV7ShyZLsZfXg7fw2YiKlkxCjXls20cun82zfbojZnwA 3WpRmgIJ7p5JejtvvicCf7FPQMb/cKtHa7IpFE0tTb5cHdjsaICAb5AMLB1FTDLtQrh6YejJrJMIG89Jhn3wCYqgB/3TDm9cdEAPaXHUn4zydRGrZdcvSNmqcPMDUVE8OOgwaPI29rhfebaPO9bU15FC mPIszSaQ48CR4huepDA4EmaGMDLNxfHiAJOPFRG4eW3CCTgqE6w5Ck3Ar rSADSe pGZD5RP1tlZ54aUrwFGhPME9MozCtiDjxCmiSz5eQfcz/MiNh3gsJtOMwU2ZKKVTFH/PmEDtaEKxBkIsPsCSs0Wct/.../fZN 613j0t  (divergent 720p brrip x264-n3kr4.exe)

The following file have been seen to comunicate with a.postumes.com in live environments.

TCP » 52.11.167.137:80
download.exe

URL:
http://a.postumes.com/

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
openresty

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.