home

www.megacleancapital.com

Domain Information

Server location:
Washington, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
megacleancapital.com

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

avast!
Win32:Malware-gen
100.00%

ESET NOD32
Win32/InstallCore.AFV potentially unwanted (variant)
50.00%

AhnLab V3 Security
PUP/Win32.Downloader
50.00%

Qihoo 360 Security
HEUR/QVM20.1.Malware.Gen
50.00%

ESET NOD32
Win32/InstallCore.AFV potentially unwanted application
50.00%

The domain www.megacleancapital.com has been seen to resolve to the following 16 IP addresses.

52.84.125.73
server-52-84-125-73.iad16.r.cloudfront.net
May 24, 2016

52.84.125.56
server-52-84-125-56.iad16.r.cloudfront.net
May 24, 2016

52.84.125.19
server-52-84-125-19.iad16.r.cloudfront.net
May 24, 2016

52.84.125.242
server-52-84-125-242.iad16.r.cloudfront.net
May 24, 2016

52.84.125.176
server-52-84-125-176.iad16.r.cloudfront.net
May 24, 2016

52.84.125.146
server-52-84-125-146.iad16.r.cloudfront.net
May 24, 2016

52.84.125.135
server-52-84-125-135.iad16.r.cloudfront.net
May 24, 2016

52.84.125.116
server-52-84-125-116.iad16.r.cloudfront.net
May 24, 2016

52.85.131.167
server-52-85-131-167.iad53.r.cloudfront.net
April 12, 2016

52.85.131.155
server-52-85-131-155.iad53.r.cloudfront.net
April 12, 2016

52.85.131.114
server-52-85-131-114.iad53.r.cloudfront.net
April 12, 2016

52.85.131.51
server-52-85-131-51.iad53.r.cloudfront.net
April 12, 2016

52.85.131.30
server-52-85-131-30.iad53.r.cloudfront.net
April 12, 2016

52.85.131.235
server-52-85-131-235.iad53.r.cloudfront.net
April 12, 2016

52.85.131.206
server-52-85-131-206.iad53.r.cloudfront.net
April 12, 2016

52.85.131.196
server-52-85-131-196.iad53.r.cloudfront.net
April 12, 2016

File downloads found at URLs served by www.megacleancapital.com.

2 / 68      (PUP)
http://www.megacleancapital.com/.../installer.exe  (47138ab30e449c2cf411de296e384e2c)

4 / 68      (PUP)
http://www.megacleancapital.com/.../installer.exe  (888c0d76f47041abe7c5e013c5112f8c)

The following 15 files have been seen to comunicate with www.megacleancapital.com in live environments.

TCP » 52.84.125.146:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 52.85.131.30:443
browser.exe (Browser)

TCP » 52.84.125.116:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.176:443
citrio.exe (Citrio by CatalinaGroup)

TCP » 52.84.125.242:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 52.84.125.146:443
UCBrowser.exe (by UCWeb)

TCP » 52.84.125.19:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.116:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.73:443
megacubo.exe (Megacubo by www.megacubo.net)

TCP » 52.84.125.73:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.56:443
online-guardian-v2.0.9.exe

TCP » 52.84.125.19:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.116:80
browser.exe (Browser)

TCP » 52.84.125.19:443
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.84.125.19:443
online-guardian-v2.0.9.exe

TCP » 52.84.125.73:80
OrbitDM.exe (Orbit Downloader by Orbitdownloader.com)

TCP » 52.84.125.116:80
Trezaa.Service.exe (Trezaa.Service by Microsoft)

TCP » 52.84.125.146:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.84.125.19:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.84.125.19:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

 
Latest 20 of 36 files

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.