home

www.qassa.pl

Domain Information

Server location:
Flevoland, Netherlands (NL)

Root domain:
qassa.pl

Scanner detections:
Malware distribution  (100% detected)

Scan engine
Details
Detections

Dr.Web
infected with Trojan.Siggen6.24132
100.00%

avast!
Win32:Malware-gen
100.00%

Quick Heal
Trojan.Generic.r4
100.00%

Trend Micro House Call
TROJ_GE.1253F634
100.00%

Kaspersky
HEUR:Trojan.Win32.Generic
100.00%

AhnLab V3 Security
Trojan/Win32.HDC
100.00%

The domain www.qassa.pl has been seen to resolve to the following 4 IP addresses.

194.48.214.59
hw3.hcbmedia.nl
November 17, 2014

194.48.214.69
hw2.hcbmedia.nl
November 17, 2014

194.48.214.68
hw1.hcbmedia.nl
November 17, 2014

194.48.214.64
hw4.hcbmedia.nl
November 17, 2014

File downloads found at URLs served by www.qassa.pl.

6 / 68      (Malware)
https://www.qassa.pl/.../discountfinder.php?p=download  (qassa+.exe)

The following 4 files have been seen to comunicate with www.qassa.pl in live environments.

TCP » 194.48.214.64:443
citrio.exe (Citrio by CatalinaGroup)

TCP » 194.48.214.64:80
gcextension.crx

TCP » 194.48.214.68:80
gcextension.crx

TCP » 194.48.214.69:80
gcextension.crx

moneymilioner.pl

moneymiljonair.nl

moneymillionnaire.fr

qassa.nl

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.