home

app.gomlab.com

Gretech Corp.

Domain Information

The domain app.gomlab.com registered by Gretech Corp. was initially registered in January of 2008 through GABIA, INC.. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Seattle, Washington within the United States which resides on the Amazon.com, Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
GABIA, INC.

Server location:
Washington, United States (US)

Create date:
Tuesday, January 22, 2008

Expires date:
Sunday, January 22, 2017

Updated date:
Monday, December 7, 2015

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
gomlab.com

Whois:
3 gomlab.com records

Scanner detections:
Detections  (86% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.GRETECH.GretechC.Installer.Meta (L), PUP.Gretech.GretechC.Installer.Meta (L), PUP.Gretech (L)
97.67%

Emsisoft Anti-Malware
Worm.Generic.384701
2.33%

G Data
Win32.Worm.Netsky
2.33%

The domain app.gomlab.com has been seen to resolve to the following 463 IP addresses.

52.85.142.234
server-52-85-142-234.iad12.r.cloudfront.net
September 15, 2016

52.85.142.138
server-52-85-142-138.iad12.r.cloudfront.net
September 15, 2016

52.85.142.87
server-52-85-142-87.iad12.r.cloudfront.net
September 15, 2016

52.85.142.46
server-52-85-142-46.iad12.r.cloudfront.net
September 15, 2016

52.85.142.254
server-52-85-142-254.iad12.r.cloudfront.net
September 15, 2016

52.85.142.244
server-52-85-142-244.iad12.r.cloudfront.net
September 15, 2016

52.85.147.202
server-52-85-147-202.iad12.r.cloudfront.net
September 2, 2016

52.85.147.146
server-52-85-147-146.iad12.r.cloudfront.net
September 2, 2016

52.85.147.118
server-52-85-147-118.iad12.r.cloudfront.net
September 2, 2016

52.85.147.87
server-52-85-147-87.iad12.r.cloudfront.net
September 2, 2016

52.85.147.70
server-52-85-147-70.iad12.r.cloudfront.net
September 2, 2016

52.85.147.65
server-52-85-147-65.iad12.r.cloudfront.net
September 2, 2016

52.85.147.58
server-52-85-147-58.iad12.r.cloudfront.net
September 2, 2016

52.85.147.215
server-52-85-147-215.iad12.r.cloudfront.net
September 2, 2016

52.85.147.75
server-52-85-147-75.iad12.r.cloudfront.net
August 30, 2016

52.85.147.18
server-52-85-147-18.iad12.r.cloudfront.net
August 30, 2016

52.85.147.115
server-52-85-147-115.iad12.r.cloudfront.net
August 27, 2016

52.85.147.48
server-52-85-147-48.iad12.r.cloudfront.net
August 27, 2016

52.85.147.45
server-52-85-147-45.iad12.r.cloudfront.net
August 27, 2016

52.85.147.22
server-52-85-147-22.iad12.r.cloudfront.net
August 27, 2016

52.85.147.246
server-52-85-147-246.iad12.r.cloudfront.net
August 27, 2016

52.85.147.241
server-52-85-147-241.iad12.r.cloudfront.net
August 27, 2016

52.85.147.206
server-52-85-147-206.iad12.r.cloudfront.net
August 27, 2016

52.85.147.142
server-52-85-147-142.iad12.r.cloudfront.net
August 27, 2016

52.84.127.223
server-52-84-127-223.iad16.r.cloudfront.net
August 27, 2016

52.84.127.200
server-52-84-127-200.iad16.r.cloudfront.net
August 27, 2016

52.84.127.162
server-52-84-127-162.iad16.r.cloudfront.net
August 27, 2016

52.84.127.121
server-52-84-127-121.iad16.r.cloudfront.net
August 27, 2016

52.84.127.80
server-52-84-127-80.iad16.r.cloudfront.net
August 27, 2016

52.84.127.79
server-52-84-127-79.iad16.r.cloudfront.net
August 27, 2016

 
Showing 30 of 463 IP Addresses

File downloads found at URLs served by app.gomlab.com.

1 / 68      (PUP)
http://app.gomlab.com/eng/.../GOMPLAYERENSETUP.EXE  (cdb471ee4f1ec135cd891c0570516073)

0 / 68
https://app.gomlab.com/site/.../GOMPLAYERENSETUP.EXE  (facf3ea9-6ded-4f91-5636-6c3aa7852fb9_1d1f0943e3d0c26)

1 / 68      (PUP)
https://app.gomlab.com/site/.../GOMVIDEOCONVERTERSETUP_ENG_ETC.EXE  (d510f4f80d58eb4ff702e29cde8352dd)

1 / 68      (PUP)
https://app.gomlab.com/site/.../GOMPLAYERGLOBALSETUP.EXE  (3d3206b526d3ea1e29d2d80f9a891067)

1 / 68      (PUP)
https://app.gomlab.com/tha/.../GOMPLAYERTHSETUP.EXE  (8fc89f5d9a61bee2b0dc55e31aca5e6c)

0 / 68
https://app.gomlab.com/site/player/.../GOMPLAYERGLOBALSETUP.EXE  (c655c9549fd119fd2dfa61b1be3d161b)

1 / 68      (PUP)
https://app.gomlab.com/eng/.../GOMPLAYERENSETUP.EXE  (grlaunchertempsetup.exe)

1 / 68      (PUP)
https://app.gomlab.com/site/.../GOMAUDIOGLOBALSETUP_ETC.EXE  (grlaunchertempsetup.exe)

1 / 68      (PUP)
http://app.gomlab.com/site/player/.../GOMPLAYERGLOBALSETUP.EXE  (2871602c87916841a21e706f722e13a7)

1 / 68      (PUP)
http://app.gomlab.com/cht/.../GOMPLAYERTWSETUP.EXE  (63b1c83632b7a0cc00ec8bdf7a6abfb4)

1 / 68      (PUP)
http://app.gomlab.com/rus/.../GOMPLAYERRUSETUP.EXE  (65be8cb9d159fa8ff35acc23cf126e3c)

The following 265 files have been seen to comunicate with app.gomlab.com in live environments.

TCP » 54.230.196.62:443
online-guardian-v2.0.9.exe

TCP » 52.85.147.20:443
online-guardian-v2.0.9.exe

TCP » 54.230.163.247:80
upd.exe

TCP » 54.230.196.62:443
onlineguardian-v2.exe

TCP » 54.230.196.39:443
online-guardian.exe

TCP » 54.230.196.62:443
apptrailers.exe

TCP » 54.192.38.74:443
online-guardian-v2.0.9.exe

TCP » 54.230.163.247:80
1stbrowser.exe (1stBrowser by The 1stBrowser Authors)

TCP » 52.85.142.35:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.85.147.74:443
online-guardian-v2.0.9.exe

TCP » 52.85.147.17:443
online-guardian-v2.0.9.exe

TCP » 54.230.196.39:443
onlineguardian-v2.exe

TCP » 54.192.195.11:443
onlineguardian-v2.exe

TCP » 52.85.142.6:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 54.192.195.242:443
online-guardian-v2.0.9.exe

TCP » 54.230.163.247:80
ic-0.6e1ac559f3d578.exe

TCP » 54.230.163.247:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.230.196.62:443
dailywiki.exe

TCP » 54.230.196.39:443
dailywiki.exe

TCP » 54.230.163.247:80
winzipersvc.exe (Winzipper by Winzipper Pvt)

 
Latest 20 of 570 files

URL:
http://app.gomlab.com/

Network:
Amazon Cloudfront

SSL certificate subject:
CN=*.gomlab.com, OU=Development Team, O=Gretech Corp., L=Gangnam-gu, S=Seoul, C=KR

SSL certificate issuer:
CN=thawte SSL CA - G2, O="thawte, Inc.", C=US

Web server:
Apache

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.