{"id":11347,"date":"2019-03-01T20:51:06","date_gmt":"2019-03-02T01:51:06","guid":{"rendered":"https:\/\/www.elteni.com\/?p=11347"},"modified":"2019-03-01T20:51:06","modified_gmt":"2019-03-02T01:51:06","slug":"beyond-the-grave-virus-is-it-a-hoax-or-a-warning-sign","status":"publish","type":"post","link":"https:\/\/www.elteni.com\/insights\/?p=11347","title":{"rendered":"Beyond the Grave virus, is it a hoax or a warning sign?"},"content":{"rendered":"\n

Here\u2019s why we think there is something interesting about the\n\u201cBeyond the Grave Virus\u201d supposedly <\/strong>affecting\nhedge funds. We were curious because there was some chatter about it being a\nhoax. While this can be (very) true, we think it was worth looking in to. Who\nknows, it may possibly be an early exploration expedition and the beginning of\nsomething material to come. Since there is no conclusive data, this is merely some\nhigh-level analysis done to piece together some of the information we found. We\nwanted to provide some general info and also wanted to provide a starting point\nfor anyone else as curious as us to conduct this research.<\/p>\n\n\n\n

Naturally the first thing we did because there wasn’t much information to go on is to look at the domain name associated with this particular event. In doing so, we found that the aksia[dot]co domain name was registered a little less than three months ago on December 4th<\/sup> 2018. It was registered at gandi.net a popular registrar in France.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

We searched for dns records and found that the \u2018A\u2019 record\npointed to IP address 46.226.108.201<\/strong>.\nA quick scan of the server showed there were two ports open, SSH port 22 and HTTP port 80<\/strong>. These are\npretty common ports found on webservers in hosted environments. It is also\ncommon to see these ports used in command and control servers.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

A search on shodan also listed these ports as open and identified\nthat a particular distribution and version of *.nix was running on that machine.\n<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Firstly, IP address 46.226.108.201<\/strong> was found to be hosting the url http[:]\/\/www[dot]aksia[dot]co\/research\/report\/interim that was detected to be a malicious site by only one url scanner. You can browse that here: https:\/\/www.virustotal.com\/en\/domain\/www.aksia.co\/information\/<\/a> or view the image below.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

We conducted some further analysis to find other domains associated with the IP address and came across the domain milos[dot]whoswho (great tld, isn\u2019t it?)<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

When searching for IP addresses associated with milos[dot]whoswho we found that virustotal had a couple of interesting items, specifically IP address 217.70.184.38. <\/strong>IP address 217.144.28.210 also had one interesting item but not as interesting as the other IP. <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Th IP address 217.244.28.210 was associated with the domains below. virustotal listed a file that was analyzed back in March 2015 for this IP. It was found to contain malicious content on 48 of the 56 listed URL scanners.<\/p>\n\n\n\n