hxxp://n Endpoints All Search OTX Login | Sign Up DOMAIN freebitco[.]in Add to Pulse Pulses 6 Passive DNS 284 URLs 1K Files 4 Analysis Overview Verdict Whitelisted IP Address 104[.]22[.]6[.]169 , 104[.]22[.]7[.]169 , 172[.]67[.]6[.]49 Location United States ASN AS13335 cloudflare Nameservers dina[.]ns[.]cloudflare[.]com[.] , tom[.]ns[.]cloudflare[.]com[.] WHOIS Registrar[:] eNom, Inc[.] (R46-AFIN), Creation Date[:] Unknown Related Pulses OTX User-Created Pulses (6) Related Tags 16 Related Tags channelofficial , osverwindows , osspsp1 , isnetfw2true , isupgradefalse , keycode1591 , j1579079770442 , type , s603 , tenus , IOT Reset Attack , Trafficmanager[.]net , Dominionvotingmachines[.]com , Ballotpedia[.]org , VoteTravis[.]com , Activote[.]net Less Indicator Facts 1 malicious files hosted 4 malicious files communicating Running webserver 25 subdomains Resolves to 3 IPs SPF record Present in Umbrella Present in Majestic Antivirus Detections Backdoor[:]Win32/Tofsee!rfn , Win[.]Packed[.]Generickdz-9874565-0 , Win32[:]Malware-gen , Win32[:]Trojan-gen AV Detection Ratio 4 / 4 External Resources Whois, UrlVoid, VirusTotal Analysis Related Pulses Comments (0) Whois Show 10 entries Search[:] RECORD VALUE Emails support@freebitco[.]in Name Interglobal Limited Name Servers TOM[.]NS[.]CLOUDFLARE[.]COM City Belize City Country BZ Dnssec Unsigned Domain Name FREEBITCO[.]IN Expiration Date 2025-10-10T19[:]29[:]11 Name Servers DINA[.]NS[.]CLOUDFLARE[.]COM Registrar eNom, Inc[.] (R46-AFIN) SHOWING 1 TO 10 OF 13 ENTRIES 1 2 NEXT Passive DNS Show 10 entries Search[:] STATUS HOSTNAME QUERY TYPE ADDRESS FIRST SEEN LAST SEEN ASN COUNTRY Whitelisted sirv[.]freebitco[.]in A 172[.]67[.]6[.]49 2021-09-09 06[:]03 2023-02-26 03[:]48 AS13335 cloudflare country flag United States Whitelisted sirv[.]freebitco[.]in A 104[.]22[.]6[.]169 2021-09-09 06[:]03 2023-02-26 03[:]48 AS13335 cloudflare country flag United States Whitelisted sirv[.]freebitco[.]in A 104[.]22[.]7[.]169 2021-09-09 06[:]03 2023-02-26 03[:]48 AS13335 cloudflare country flag United States Whitelisted nocookie[.]freebitco[.]in A 104[.]22[.]7[.]169 2020-09-28 05[:]58 2020-09-28 05[:]58 AS13335 cloudflare country flag United States Whitelisted nocookie[.]freebitco[.]in A 104[.]22[.]6[.]169 2020-09-28 05[:]58 2020-09-28 05[:]58 AS13335 cloudflare country flag United States Whitelisted nocookie[.]freebitco[.]in A 172[.]67[.]6[.]49 2020-09-28 05[:]58 2020-09-28 05[:]58 AS13335 cloudflare country flag United States Whitelisted www[.]ipv6[.]freebitco[.]in A 172[.]67[.]6[.]49 2020-09-01 08[:]14 2020-09-01 08[:]18 AS13335 cloudflare country flag United States Whitelisted www[.]ipv6[.]freebitco[.]in A 104[.]22[.]6[.]169 2020-09-01 08[:]14 2020-09-01 08[:]18 AS13335 cloudflare country flag United States Whitelisted www[.]ipv6[.]freebitco[.]in A 104[.]22[.]7[.]169 2020-09-01 08[:]14 2020-09-01 08[:]18 AS13335 cloudflare country flag United States Whitelisted captchas[.]freebitco[.]in A 104[.]22[.]6[.]169 2020-09-01 08[:]09 2023-02-26 03[:]45 AS13335 cloudflare country flag United States SHOWING 1 TO 10 OF 284 ENTRIES 1 2 3 4 5 [.][.][.] 29 NEXT Associated Urls Show 10 entries DATE CHECKED URL HOSTNAME SERVER RESPONSE IP ADDRESS GOOGLE SAFE BROWSING ANTIVIRUS RESULTS Mar 30, 2023 hxxps://freebitco[.]in/?bet= freebitco[.]in 200 104[.]22[.]6[.]169 Mar 10, 2023 hxxps://freebitco[.]in/?r=453292 freebitco[.]in 200 104[.]22[.]7[.]169 Mar 10, 2023 hxxp://freebitco[.]in/?r=453292 freebitco[.]in 200 172[.]67[.]6[.]49 Mar 9, 2023 hxxps://freebitco[.]in/?r=41029244 freebitco[.]in 200 172[.]67[.]6[.]49 Mar 1, 2023 hxxps://freebitco[.]in/btc_addressthientamtl19 freebitco[.]in 200 104[.]22[.]7[.]169 Feb 26, 2023 hxxps://sirv[.]freebitco[.]in/1574253604_qV3999Sg[.]png sirv[.]freebitco[.]in 200 104[.]22[.]7[.]169 Feb 26, 2023 hxxps://static1[.]freebitco[.]in/favicon[.]png%20 static1[.]freebitco[.]in 200 104[.]22[.]6[.]169 Feb 26, 2023 hxxps://static1[.]freebitco[.]in/images/100[.]png%20 static1[.]freebitco[.]in 200 104[.]22[.]7[.]169 Feb 26, 2023 hxxps://captchas[.]freebitco[.]in/cgi-bin/captcha_generator?client=freebitcoin&random=XMqr3oYoHwLrTD89KQAbRcJnpnvACSaK%20 captchas[.]freebitco[.]in 200 104[.]22[.]6[.]169 Feb 26, 2023 hxxps://freebitco[.]in/cgi-bin/api[.]pl?op=signup_visit&r=18690029&tag=null&csrf_token=%20 freebitco[.]in 200 104[.]22[.]6[.]169 SHOWING 1 TO 10 OF 1,793 ENTRIES 1 2 3 4 5 [.][.][.] 180 NEXT Associated Files Show 10 entries DATE HASH AVAST AVG CLAMAV MSDEFENDER Jul 14, 2021 61ca90e9f57cecba124a64a61dc1ea7419bf73aa9eaf2e0588e273f5d6aa33e9 Win[.]Packed[.]Generickdz-9874565-0 Dec 17, 2018 eb7949888a3739b4f38b91bcbbb6e556e914d09b0a3646fff4ccc22dc9dcf081 Win32[:]Trojan-gen Dec 15, 2018 a1b9e572d512370c7a28283f0027427f5896698df363e32be7d925e77333aa67 Win32[:]Malware-gen Nov 26, 2018 718e415c0ce10362bb4bb089e13a393eb3635dbf982c18a5c0677834b0bb4283 Win32[:]Trojan-gen Backdoor[:]Win32/Tofsee!rfn SHOWING 1 TO 4 OF 4 ENTRIES HTTP Scans Show 10 entries Search[:] RECORD VALUE 443 Body DOCTYPE html if IE 8 html class= no js lt ie9 lang= en endif if gt IE 8 html class= no js lang= en endif head meta charset= utf 8 meta http equiv= content type content= text/html charset=utf 8 script src= /cdn cgi/apps/head/gUhj1EGh0R2kyI9wfTVciuyeAFY[.]js /script link rel= icon type= image/png href= [//]static1[.]freebitco[.]in/favicon[.]png meta name= viewport content= width=device width meta name= description content= Win upto 200 in Bitcoins every hour no strings attached Multiply your bitcoins free weekly lottery with big prizes 50 referral commissions and much more meta name= keywords content= bitcoin free bitcoin faucet bitcoin faucet win bitcoin dice bitcoin dice get free bitcoins win free bitcoins bitcoin wallet earn bitcoin invest bitcoin bitcoin mining lottery bitcoin lottery title FreeBitco[.]in Free Bitcoin Wallet Faucet Lottery and Dice /title script src= [//]www[.]google[.]com/recaptcha/api[.]js async defer /script link href= [//]fonts[.]googleapis[.]com/css family=Prosto One Open Sans[:]300 400 600 700 Lato[:]400 400italic 700 700italic 900 900italic 300 300italic 100italic 100 rel= stylesheet type= text/css link rel= stylesheet href= [//]static1[.]freebitco[.]in/min/combined1426453789[.]css type= text/css script src= [//]static2[.]freebitco[.]in/min/combined1393766573[.]js /script script src= [//]static3[.]freebitco[.]in/min/combined2 1456059004[.]js /script link rel= stylesheet href= [//]static7[.]freebitco[.]in/min/main1512582355[.]css type= text/css script var max win amount = 20 var token name = var tcGiQefA = var latest lottery round = 0 var um2VHVjSZ = i0ia0UG5NOolHP63CH44NaiS8 var ad left = 0 var show sky = 0 var mobile device = 0 var socket password = 92a06c658e64f99b923b618dd602690809ceadc3fe6a2b3e012001ffe9c48d8d var socket userid = 35[.]161[.]55[.]221 var request us int = 15 var free rp = 2 parseInt var ref rp = 1 parseInt var multiply rp = 1 parseInt var rp promo active = 0 var m w fee = 0 var i w fee = 0 var min bonus amount = parseFloat 0 [.]toFixed 8 var max deposit bonus = parseFloat 0 [.]toFixed 8 var min withdraw = parseFloat 0[.]0003 [.]toFixed 8 var hash match = /script script src= [//]static4[.]freebitco[.]in/min/main1515591621[.]js /script script [.]ajaxSetup data[:] csrf token[:] [.]cookie csrf token beforeSend[:] function xhr xhr[.]setRequestHeader x csrf token [.]cookie csrf token [.]extend redirectPost[:] function location args var form = [.]each args function key value form = input type= hidden name= key value= value form action= location method= POST form /form [.]appendTo body [.]submit document [.]ready function if body [.]innerWidth 763 deposit withdraw container [.]addClass deposit withdraw container mobile deposit withdraw container [.]removeClass deposit withdraw container add lottery table mobile style [.]addClass lottery table mobile style captchasnet captcha info span mobile [.]addClass captchasnet captcha info span mobile [.]reward table box left size change [.]addClass reward table box left mobile [.]reward table box left size change [.]removeClass reward table box left [.]reward table box right size change [.]addClass reward table box right mobile [.]reward table box right size change [.]removeClass reward table box right reward table box left size change [.]addClass border bottom none hide show roll history mobile [.]show bet history table [.]hide lottery first amount [.]addClass br 0 5 lottery second third div [.]removeClass br 5 5 lottery second container div [.]removeClass br right 1px lottery second div [.]removeClass br 5 else deposit withdraw container [.]addClass deposit withdraw container deposit withdraw container [.]removeClass deposit withdraw container mobile add lottery table mobile style [.]removeClass lottery table mobile style captchasnet captcha info span mobile [.]removeClass captchasnet captcha info span mobile [.]reward table box left size change [.]addClass reward table box left [.]reward table box left size change [.]removeClass reward table box left mobile [.]reward table box right size change [.]addClass reward table box right [.]reward table box right size change [.]removeClass reward table box right mobile reward table box left size change [.]removeClass border bottom none hide show roll history mobile [.]hide bet history table [.]show lottery first amount [.]removeClass br 0 5 lottery second third div [.]addClass br 5 5 lottery second container div [.]removeClass br right 1px lottery second div [.]removeClass br 5 signup token [.]val 236ae68b1f0e GenerateCaptchasNetCaptcha captchasnet forgot password captcha 0 / spinner spin slot [.]click function var slotimages = /images/slot1[.]jpg /images/slot2[.]jpg /images/slot3[.]png /images/slot4[.]png /images/slot5[.]png var keeponrolling = setInterval function [.]slot image holder [.]each function var slot image= this [.]attr src var i=slotimages[.]indexOf slot image if i==slotimages[.]length 1 i=0 else i=i 1 var x=i var src=slotimages x this [.]attr src src 200 / /script style type= text/css user claimed deposit bonus display[:] block background color[:] 6dffd4 color[:] 000 important padding[:] 10px 0 font size[:] 14px bonus account balance color[:] green font weight[:] bold [.]deposit withdraw container mobile position[:]absolute top[:] 100px width[:]100 margin[:] 0 auto left[:]0 right[:]0 text align[:] center [.]captchasnet captcha info span mobile width[:] 290px margin left[:] 265px [.]prize rank cell height[:] 40px padding[:] 10px font weight[:] bold [.]prize amount cell height[:] 58px font size[:] 18px padding[:] 20px 0 font weight[:] bold background[:] 002b3a [.]font amount 1 font size[:] 1[.]45em padding[:] 15px color[:] ffe766 [.]font amount 2 3 font size[:] 1[.]25em color[:] e8e8e8 [.]font amount 4 5 6 font size[:] 1[.]1em color[:] ff9a36 [.]font amount 7 8 9 font size[:] 0[.]95em color[:] 40ff7f [.]prize row div padding[:] 0 box shadow[:] 0 5px 20px rgba 0 0 0 0[.]49 height[:]100px [.]prize first row div border[:] 1px solid f3cd00 border bottom[:] none [.]prize second row div border[:] 1px solid a9a7a7 border bottom[:] none [.]prize third row div border[:] 1px solid d87310 border bottom[:] none [.]prize fourth row div border[:] 1px solid 0a9c3b border radius[:]5px ul[.]tabs li a font size[:] 12px [.]top bar section li a[:]not [.]button padding[:] 0 6px [.]login signup form div float[:]left padding left[:]5px padding right[:]5px [.]homepage stats box div padding right[:]5px padding left[:]5px float[:]right [.]freebitcoin responsive right width[:] 160px height[:] 600px margin right[:] 5px [.]freebitcoin responsive left [.]freebitcoin inner large sky width[:] 160px height[:] 600px [.]bottom responsive ad height[:]300px width[:]728px media min width[:] 1400px ul[.]tabs li a font size[:] 13px [.]top bar section li a[:]not [.]button padding[:] 0 12px media max width[:]1399px ul[.]tabs li a font size[:] 12px [.]top bar section li a[:]not [.]button padding[:] 0 6px media min width[:] 1240px [.]freebitcoin responsive left width[:] 300px height[:] 600px margin left[:] 5px [.]fbtc right sky margin right[:] 105px media min width[:] 1360px media min width[:] 1px ytplayer width[:] 400px height[:]200px media min width[:] 728px ytplayer width[:] 400px height[:]200px media min width[:] 1024px ytplayer width[:] 500px height[:]390px media min width[:] 1280px ytplayer width[:] 600px height[:]390px [.]contain to grid width[:] 100 media only screen and min width[:] 40[.]063em [.]row max width[:] 72[.]5em [.]contain to grid [.]top bar max width[:] 80em margin[:] 0 auto margin bottom[:] 0 [.]lottery rules list li padding[:]5px media only screen and max width[:] 1023px [.]epom ads display[:] none box ad middle position[:]relative [.]new border shadow position[:]relative webkit box shadow[:]0 250px 100px rgba 0 0 0 0[.]3 moz box shadow[:]0 250px 100px rgba 0 0 0 0[.]3 box shadow[:]0 250px 100px rgba 0 0 0 0[.]3 html body width[:] 100 margin[:] 0px padding[:] 0px overflow x[:] hidden [.]adjust margin top[:] 0[.]1em [.]center text align[:]center [.]contain to grid width[:] 100 media only screen and min width[:] 40[.]063em [.]row max width[:] 72[.]5em [.]top bar height[:] 45px line height[:] 45px [.]top bar [.]name h1 line height[:] 45px font size[:] 2[.]0625rem margin[:] 0 [.]top bar section li[:]not [.]has form a[:]not [.]button padding[:] 0 15px line height[:] 45px [.]top bar section li[.]active[:]not [.]has form a[:]not [.]button padding[:] 0 15px line height[:] 45px color[:] white [.]contain to grid [.]top bar max width[:] 72[.]5em margin[:] 0 auto margin bottom[:] 0 media max width[:] 768px [.]top bar section li[.]active[:]not [.]has form a[:]not [.]button padding[:] 10px 10px [.]top bar section li[:]not [.]has form a[:]not [.]button padding[:] 10px 10px h5 word spacing[:]0[.]15em [.]tick background[:] url /images/tickmark[.]png no repeat 0 0px padding[:] 0px 0 0 35px text align[:]left margin bottom[:]15px [.]formposition margin top[:]40px media only screen and max width[:] 40em [.]formposition margin top[:]0 [.]signup page whats bitcoin main p color[:] 0D302C text align[:]left home bitcoin ul color[:] 0D302C btcprice a[:]hover background color[:] 111 cursor[:] default font weight[:]bold /style /head body div class= large 12 fixed div class= large 10 columns contain to grid nav class= top bar ul class= title area li class= name h1 a href= span style= color[:] 97FF6B free /span bitcoin /a /h1 /li li class= toggle topbar menu icon data dropdown= drop1 id= menu drop a href= menu span /span /a /li /ul section class= top bar section ul class= right tabs li class= divider /li li id= link home a href= javascript[:]void 0 HOME /a /li li class= divider /li li id= link features a href= javascript[:]void 0 FEATURES /a /li li class= divider /li li id= link bitcoin a href= javascript[:]void 0 BITCOIN /a /li li class= divider /li li class= signup menu button a href= javascript[:]void 0 SIGN UP /a /li li class= divider /li li class= login menu button a href= javascript[:]void 0 LOGIN /a /li li class= divider /li li id= btcprice a href= javascript[:]void 0 span style= color[:]orange 1 BITCOIN /span = span id= btc usd price st[.][.][.]less 443 Header HTTP/2 200 date[:] Tue 06 Mar 2018 17[:]20[:]42 GMT content type[:] text/html charset=ISO 8859 1 set cookie[:] cfduid=d4fbf11825967c283f59f2daa519de44c1520356842 expires=Wed 06 Mar 19 17[:]20[:]42 GMT path=/ domain=[.]freebitco[.]in HttpOnly Secure vary[:] Accept Encoding set cookie[:] csrf token=qudV0zRR2aEr path=/ cache control[:] max age=0 private no store no cache must revalidate expires[:] Tue 06 Mar 2018 17[:]20[:]42 GMT vary[:] User Agent expect ct[:] max age=604800 report uri= hxxps://report uri[.]cloudflare[.]com/cdn cgi/beacon/expect ct server[:] cloudflare cf ray[:] 3f767e9a8bef2a1f SEA

Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

http://n Endpoints All Search OTX Login | Sign Up DOMAIN freebitco.in Add to Pulse Pulses 6 Passive DNS 284 URLs 1K Files 4 Analysis Overview Verdict Whitelisted IP Address 104.22.6.169 , 104.22.7.169 , 172.67.6.49 Location United States ASN AS13335 cloudflare Nameservers dina.ns.cloudflare.com. , tom.ns.cloudflare.com. WHOIS Registrar: eNom, Inc. (R46-AFIN), Creation Date: Unknown Related Pulses OTX User-Created Pulses (6) Related Tags 16 Related Tags channelofficial , osverwindows , osspsp1 , isnetfw2true , isupgradefalse , keycode1591 , j1579079770442 , type , s603 , tenus , IOT Reset Attack , Trafficmanager.net , Dominionvotingmachines.com , Ballotpedia.org , VoteTravis.com , Activote.net Less Indicator Facts 1 malicious files hosted 4 malicious files communicating Running webserver 25 subdomains Resolves to 3 IPs SPF record Present in Umbrella Present in Majestic Antivirus Detections Backdoor:Win32/Tofsee!rfn , Win.Packed.Generickdz-9874565-0 , Win32:Malware-gen , Win32:Trojan-gen AV Detection Ratio 4 / 4 External Resources Whois, UrlVoid, VirusTotal Analysis Related Pulses Comments (0) Whois Show 10 entries Search: RECORD VALUE Emails [email protected] Name Interglobal Limited Name Servers TOM.NS.CLOUDFLARE.COM City Belize City Country BZ Dnssec Unsigned Domain Name FREEBITCO.IN Expiration Date 2025-10-10T19:29:11 Name Servers DINA.NS.CLOUDFLARE.COM Registrar eNom, Inc. (R46-AFIN) SHOWING 1 TO 10 OF 13 ENTRIES 1 2 NEXT Passive DNS Show 10 entries Search: STATUS HOSTNAME QUERY TYPE ADDRESS FIRST SEEN LAST SEEN ASN COUNTRY Whitelisted sirv.freebitco.in A 172.67.6.49 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted sirv.freebitco.in A 104.22.6.169 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted sirv.freebitco.in A 104.22.7.169 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 104.22.7.169 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 104.22.6.169 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 172.67.6.49 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 172.67.6.49 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 104.22.6.169 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 104.22.7.169 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted captchas.freebitco.in A 104.22.6.169 2020-09-01 08:09 2023-02-26 03:45 AS13335 cloudflare country flag United States SHOWING 1 TO 10 OF 284 ENTRIES 1 2 3 4 5 ... 29 NEXT Associated Urls Show 10 entries DATE CHECKED URL HOSTNAME SERVER RESPONSE IP ADDRESS GOOGLE SAFE BROWSING ANTIVIRUS RESULTS Mar 30, 2023 https://freebitco.in/?bet= freebitco.in 200 104.22.6.169 Mar 10, 2023 https://freebitco.in/?r=453292 freebitco.in 200 104.22.7.169 Mar 10, 2023 http://freebitco.in/?r=453292 freebitco.in 200 172.67.6.49 Mar 9, 2023 https://freebitco.in/?r=41029244 freebitco.in 200 172.67.6.49 Mar 1, 2023 https://freebitco.in/btc_addressthientamtl19 freebitco.in 200 104.22.7.169 Feb 26, 2023 https://sirv.freebitco.in/1574253604_qV3999Sg.png sirv.freebitco.in 200 104.22.7.169 Feb 26, 2023 https://static1.freebitco.in/favicon.png%20 static1.freebitco.in 200 104.22.6.169 Feb 26, 2023 https://static1.freebitco.in/images/100.png%20 static1.freebitco.in 200 104.22.7.169 Feb 26, 2023 https://captchas.freebitco.in/cgi-bin/captcha_generator?client=freebitcoin&random=XMqr3oYoHwLrTD89KQAbRcJnpnvACSaK%20 captchas.freebitco.in 200 104.22.6.169 Feb 26, 2023 https://freebitco.in/cgi-bin/api.pl?op=signup_visit&r=18690029&tag=null&csrf_token=%20 freebitco.in 200 104.22.6.169 SHOWING 1 TO 10 OF 1,793 ENTRIES 1 2 3 4 5 ... 180 NEXT Associated Files Show 10 entries DATE HASH AVAST AVG CLAMAV MSDEFENDER Jul 14, 2021 61ca90e9f57cecba124a64a61dc1ea7419bf73aa9eaf2e0588e273f5d6aa33e9 Win.Packed.Generickdz-9874565-0 Dec 17, 2018 eb7949888a3739b4f38b91bcbbb6e556e914d09b0a3646fff4ccc22dc9dcf081 Win32:Trojan-gen Dec 15, 2018 a1b9e572d512370c7a28283f0027427f5896698df363e32be7d925e77333aa67 Win32:Malware-gen Nov 26, 2018 718e415c0ce10362bb4bb089e13a393eb3635dbf982c18a5c0677834b0bb4283 Win32:Trojan-gen Backdoor:Win32/Tofsee!rfn SHOWING 1 TO 4 OF 4 ENTRIES HTTP Scans Show 10 entries Search: RECORD VALUE 443 Body DOCTYPE html if IE 8 html class= no js lt ie9 lang= en endif if gt IE 8 html class= no js lang= en endif head meta charset= utf 8 meta http equiv= content type content= text/html charset=utf 8 script src= /cdn cgi/apps/head/gUhj1EGh0R2kyI9wfTVciuyeAFY.js /script link rel= icon type= image/png href= //static1.freebitco.in/favicon.png meta name= viewport content= width=device width meta name= description content= Win upto 200 in Bitcoins every hour no strings attached Multiply your bitcoins free weekly lottery with big prizes 50 referral commissions and much more meta name= keywords content= bitcoin free bitcoin faucet bitcoin faucet win bitcoin dice bitcoin dice get free bitcoins win free bitcoins bitcoin wallet earn bitcoin invest bitcoin bitcoin mining lottery bitcoin lottery title FreeBitco.in Free Bitcoin Wallet Faucet Lottery and Dice /title script src= //www.google.com/recaptcha/api.js async defer /script link href= //fonts.googleapis.com/css family=Prosto One Open Sans:300 400 600 700 Lato:400 400italic 700 700italic 900 900italic 300 300italic 100italic 100 rel= stylesheet type= text/css link rel= stylesheet href= //static1.freebitco.in/min/combined1426453789.css type= text/css script src= //static2.freebitco.in/min/combined1393766573.js /script script src= //static3.freebitco.in/min/combined2 1456059004.js /script link rel= stylesheet href= //static7.freebitco.in/min/main1512582355.css type= text/css script var max win amount = 20 var token name = var tcGiQefA = var latest lottery round = 0 var um2VHVjSZ = i0ia0UG5NOolHP63CH44NaiS8 var ad left = 0 var show sky = 0 var mobile device = 0 var socket password = 92a06c658e64f99b923b618dd602690809ceadc3fe6a2b3e012001ffe9c48d8d var socket userid = 35.161.55.221 var request us int = 15 var free rp = 2 parseInt var ref rp = 1 parseInt var multiply rp = 1 parseInt var rp promo active = 0 var m w fee = 0 var i w fee = 0 var min bonus amount = parseFloat 0 .toFixed 8 var max deposit bonus = parseFloat 0 .toFixed 8 var min withdraw = parseFloat 0.0003 .toFixed 8 var hash match = /script script src= //static4.freebitco.in/min/main1515591621.js /script script .ajaxSetup data: csrf token: .cookie csrf token beforeSend: function xhr xhr.setRequestHeader x csrf token .cookie csrf token .extend redirectPost: function location args var form = .each args function key value form = input type= hidden name= key value= value form action= location method= POST form /form .appendTo body .submit document .ready function if body .innerWidth 763 deposit withdraw container .addClass deposit withdraw container mobile deposit withdraw container .removeClass deposit withdraw container add lottery table mobile style .addClass lottery table mobile style captchasnet captcha info span mobile .addClass captchasnet captcha info span mobile .reward table box left size change .addClass reward table box left mobile .reward table box left size change .removeClass reward table box left .reward table box right size change .addClass reward table box right mobile .reward table box right size change .removeClass reward table box right reward table box left size change .addClass border bottom none hide show roll history mobile .show bet history table .hide lottery first amount .addClass br 0 5 lottery second third div .removeClass br 5 5 lottery second container div .removeClass br right 1px lottery second div .removeClass br 5 else deposit withdraw container .addClass deposit withdraw container deposit withdraw container .removeClass deposit withdraw container mobile add lottery table mobile style .removeClass lottery table mobile style captchasnet captcha info span mobile .removeClass captchasnet captcha info span mobile .reward table box left size change .addClass reward table box left .reward table box left size change .removeClass reward table box left mobile .reward table box right size change .addClass reward table box right .reward table box right size change .removeClass reward table box right mobile reward table box left size change .removeClass border bottom none hide show roll history mobile .hide bet history table .show lottery first amount .removeClass br 0 5 lottery second third div .addClass br 5 5 lottery second container div .removeClass br right 1px lottery second div .removeClass br 5 signup token .val 236ae68b1f0e GenerateCaptchasNetCaptcha captchasnet forgot password captcha 0 / spinner spin slot .click function var slotimages = /images/slot1.jpg /images/slot2.jpg /images/slot3.png /images/slot4.png /images/slot5.png var keeponrolling = setInterval function .slot image holder .each function var slot image= this .attr src var i=slotimages.indexOf slot image if i==slotimages.length 1 i=0 else i=i 1 var x=i var src=slotimages x this .attr src src 200 / /script style type= text/css user claimed deposit bonus display: block background color: 6dffd4 color: 000 important padding: 10px 0 font size: 14px bonus account balance color: green font weight: bold .deposit withdraw container mobile position:absolute top: 100px width:100 margin: 0 auto left:0 right:0 text align: center .captchasnet captcha info span mobile width: 290px margin left: 265px .prize rank cell height: 40px padding: 10px font weight: bold .prize amount cell height: 58px font size: 18px padding: 20px 0 font weight: bold background: 002b3a .font amount 1 font size: 1.45em padding: 15px color: ffe766 .font amount 2 3 font size: 1.25em color: e8e8e8 .font amount 4 5 6 font size: 1.1em color: ff9a36 .font amount 7 8 9 font size: 0.95em color: 40ff7f .prize row div padding: 0 box shadow: 0 5px 20px rgba 0 0 0 0.49 height:100px .prize first row div border: 1px solid f3cd00 border bottom: none .prize second row div border: 1px solid a9a7a7 border bottom: none .prize third row div border: 1px solid d87310 border bottom: none .prize fourth row div border: 1px solid 0a9c3b border radius:5px ul.tabs li a font size: 12px .top bar section li a:not .button padding: 0 6px .login signup form div float:left padding left:5px padding right:5px .homepage stats box div padding right:5px padding left:5px float:right .freebitcoin responsive right width: 160px height: 600px margin right: 5px .freebitcoin responsive left .freebitcoin inner large sky width: 160px height: 600px .bottom responsive ad height:300px width:728px media min width: 1400px ul.tabs li a font size: 13px .top bar section li a:not .button padding: 0 12px media max width:1399px ul.tabs li a font size: 12px .top bar section li a:not .button padding: 0 6px media min width: 1240px .freebitcoin responsive left width: 300px height: 600px margin left: 5px .fbtc right sky margin right: 105px media min width: 1360px media min width: 1px ytplayer width: 400px height:200px media min width: 728px ytplayer width: 400px height:200px media min width: 1024px ytplayer width: 500px height:390px media min width: 1280px ytplayer width: 600px height:390px .contain to grid width: 100 media only screen and min width: 40.063em .row max width: 72.5em .contain to grid .top bar max width: 80em margin: 0 auto margin bottom: 0 .lottery rules list li padding:5px media only screen and max width: 1023px .epom ads display: none box ad middle position:relative .new border shadow position:relative webkit box shadow:0 250px 100px rgba 0 0 0 0.3 moz box shadow:0 250px 100px rgba 0 0 0 0.3 box shadow:0 250px 100px rgba 0 0 0 0.3 html body width: 100 margin: 0px padding: 0px overflow x: hidden .adjust margin top: 0.1em .center text align:center .contain to grid width: 100 media only screen and min width: 40.063em .row max width: 72.5em .top bar height: 45px line height: 45px .top bar .name h1 line height: 45px font size: 2.0625rem margin: 0 .top bar section li:not .has form a:not .button padding: 0 15px line height: 45px .top bar section li.active:not .has form a:not .button padding: 0 15px line height: 45px color: white .contain to grid .top bar max width: 72.5em margin: 0 auto margin bottom: 0 media max width: 768px .top bar section li.active:not .has form a:not .button padding: 10px 10px .top bar section li:not .has form a:not .button padding: 10px 10px h5 word spacing:0.15em .tick background: url /images/tickmark.png no repeat 0 0px padding: 0px 0 0 35px text align:left margin bottom:15px .formposition margin top:40px media only screen and max width: 40em .formposition margin top:0 .signup page whats bitcoin main p color: 0D302C text align:left home bitcoin ul color: 0D302C btcprice a:hover background color: 111 cursor: default font weight:bold /style /head body div class= large 12 fixed div class= large 10 columns contain to grid nav class= top bar ul class= title area li class= name h1 a href= span style= color: 97FF6B free /span bitcoin /a /h1 /li li class= toggle topbar menu icon data dropdown= drop1 id= menu drop a href= menu span /span /a /li /ul section class= top bar section ul class= right tabs li class= divider /li li id= link home a href= javascript:void 0 HOME /a /li li class= divider /li li id= link features a href= javascript:void 0 FEATURES /a /li li class= divider /li li id= link bitcoin a href= javascript:void 0 BITCOIN /a /li li class= divider /li li class= signup menu button a href= javascript:void 0 SIGN UP /a /li li class= divider /li li class= login menu button a href= javascript:void 0 LOGIN /a /li li class= divider /li li id= btcprice a href= javascript:void 0 span style= color:orange 1 BITCOIN /span = span id= btc usd price st...less 443 Header HTTP/2 200 date: Tue 06 Mar 2018 17:20:42 GMT content type: text/html charset=ISO 8859 1 set cookie: cfduid=d4fbf11825967c283f59f2daa519de44c1520356842 expires=Wed 06 Mar 19 17:20:42 GMT path=/ domain=.freebitco.in HttpOnly Secure vary: Accept Encoding set cookie: csrf token=qudV0zRR2aEr path=/ cache control: max age=0 private no store no cache must revalidate expires: Tue 06 Mar 2018 17:20:42 GMT vary: User Agent expect ct: max age=604800 report uri= https://report uri.cloudflare.com/cdn cgi/beacon/expect ct server: cloudflare cf ray: 3f767e9a8bef2a1f SEA

Resource

win10v2004-20230221-en

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

http://n Endpoints All Search OTX Login | Sign Up DOMAIN freebitco.in Add to Pulse Pulses 6 Passive DNS 284 URLs 1K Files 4 Analysis Overview Verdict Whitelisted IP Address 104.22.6.169 , 104.22.7.169 , 172.67.6.49 Location United States ASN AS13335 cloudflare Nameservers dina.ns.cloudflare.com. , tom.ns.cloudflare.com. WHOIS Registrar: eNom, Inc. (R46-AFIN), Creation Date: Unknown Related Pulses OTX User-Created Pulses (6) Related Tags 16 Related Tags channelofficial , osverwindows , osspsp1 , isnetfw2true , isupgradefalse , keycode1591 , j1579079770442 , type , s603 , tenus , IOT Reset Attack , Trafficmanager.net , Dominionvotingmachines.com , Ballotpedia.org , VoteTravis.com , Activote.net Less Indicator Facts 1 malicious files hosted 4 malicious files communicating Running webserver 25 subdomains Resolves to 3 IPs SPF record Present in Umbrella Present in Majestic Antivirus Detections Backdoor:Win32/Tofsee!rfn , Win.Packed.Generickdz-9874565-0 , Win32:Malware-gen , Win32:Trojan-gen AV Detection Ratio 4 / 4 External Resources Whois, UrlVoid, VirusTotal Analysis Related Pulses Comments (0) Whois Show 10 entries Search: RECORD VALUE Emails [email protected] Name Interglobal Limited Name Servers TOM.NS.CLOUDFLARE.COM City Belize City Country BZ Dnssec Unsigned Domain Name FREEBITCO.IN Expiration Date 2025-10-10T19:29:11 Name Servers DINA.NS.CLOUDFLARE.COM Registrar eNom, Inc. (R46-AFIN) SHOWING 1 TO 10 OF 13 ENTRIES 1 2 NEXT Passive DNS Show 10 entries Search: STATUS HOSTNAME QUERY TYPE ADDRESS FIRST SEEN LAST SEEN ASN COUNTRY Whitelisted sirv.freebitco.in A 172.67.6.49 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted sirv.freebitco.in A 104.22.6.169 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted sirv.freebitco.in A 104.22.7.169 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 104.22.7.169 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 104.22.6.169 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 172.67.6.49 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 172.67.6.49 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 104.22.6.169 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 104.22.7.169 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted captchas.freebitco.in A 104.22.6.169 2020-09-01 08:09 2023-02-26 03:45 AS13335 cloudflare country flag United States SHOWING 1 TO 10 OF 284 ENTRIES 1 2 3 4 5 ... 29 NEXT Associated Urls Show 10 entries DATE CHECKED URL HOSTNAME SERVER RESPONSE IP ADDRESS GOOGLE SAFE BROWSING ANTIVIRUS RESULTS Mar 30, 2023 https://freebitco.in/?bet= freebitco.in 200 104.22.6.169 Mar 10, 2023 https://freebitco.in/?r=453292 freebitco.in 200 104.22.7.169 Mar 10, 2023 http://freebitco.in/?r=453292 freebitco.in 200 172.67.6.49 Mar 9, 2023 https://freebitco.in/?r=41029244 freebitco.in 200 172.67.6.49 Mar 1, 2023 https://freebitco.in/btc_addressthientamtl19 freebitco.in 200 104.22.7.169 Feb 26, 2023 https://sirv.freebitco.in/1574253604_qV3999Sg.png sirv.freebitco.in 200 104.22.7.169 Feb 26, 2023 https://static1.freebitco.in/favicon.png%20 static1.freebitco.in 200 104.22.6.169 Feb 26, 2023 https://static1.freebitco.in/images/100.png%20 static1.freebitco.in 200 104.22.7.169 Feb 26, 2023 https://captchas.freebitco.in/cgi-bin/captcha_generator?client=freebitcoin&random=XMqr3oYoHwLrTD89KQAbRcJnpnvACSaK%20 captchas.freebitco.in 200 104.22.6.169 Feb 26, 2023 https://freebitco.in/cgi-bin/api.pl?op=signup_visit&r=18690029&tag=null&csrf_token=%20 freebitco.in 200 104.22.6.169 SHOWING 1 TO 10 OF 1,793 ENTRIES 1 2 3 4 5 ... 180 NEXT Associated Files Show 10 entries DATE HASH AVAST AVG CLAMAV MSDEFENDER Jul 14, 2021 61ca90e9f57cecba124a64a61dc1ea7419bf73aa9eaf2e0588e273f5d6aa33e9 Win.Packed.Generickdz-9874565-0 Dec 17, 2018 eb7949888a3739b4f38b91bcbbb6e556e914d09b0a3646fff4ccc22dc9dcf081 Win32:Trojan-gen Dec 15, 2018 a1b9e572d512370c7a28283f0027427f5896698df363e32be7d925e77333aa67 Win32:Malware-gen Nov 26, 2018 718e415c0ce10362bb4bb089e13a393eb3635dbf982c18a5c0677834b0bb4283 Win32:Trojan-gen Backdoor:Win32/Tofsee!rfn SHOWING 1 TO 4 OF 4 ENTRIES HTTP Scans Show 10 entries Search: RECORD VALUE 443 Body DOCTYPE html if IE 8 html class= no js lt ie9 lang= en endif if gt IE 8 html class= no js lang= en endif head meta charset= utf 8 meta http equiv= content type content= text/html charset=utf 8 script src= /cdn cgi/apps/head/gUhj1EGh0R2kyI9wfTVciuyeAFY.js /script link rel= icon type= image/png href= //static1.freebitco.in/favicon.png meta name= viewport content= width=device width meta name= description content= Win upto 200 in Bitcoins every hour no strings attached Multiply your bitcoins free weekly lottery with big prizes 50 referral commissions and much more meta name= keywords content= bitcoin free bitcoin faucet bitcoin faucet win bitcoin dice bitcoin dice get free bitcoins win free bitcoins bitcoin wallet earn bitcoin invest bitcoin bitcoin mining lottery bitcoin lottery title FreeBitco.in Free Bitcoin Wallet Faucet Lottery and Dice /title script src= //www.google.com/recaptcha/api.js async defer /script link href= //fonts.googleapis.com/css family=Prosto One Open Sans:300 400 600 700 Lato:400 400italic 700 700italic 900 900italic 300 300italic 100italic 100 rel= stylesheet type= text/css link rel= stylesheet href= //static1.freebitco.in/min/combined1426453789.css type= text/css script src= //static2.freebitco.in/min/combined1393766573.js /script script src= //static3.freebitco.in/min/combined2 1456059004.js /script link rel= stylesheet href= //static7.freebitco.in/min/main1512582355.css type= text/css script var max win amount = 20 var token name = var tcGiQefA = var latest lottery round = 0 var um2VHVjSZ = i0ia0UG5NOolHP63CH44NaiS8 var ad left = 0 var show sky = 0 var mobile device = 0 var socket password = 92a06c658e64f99b923b618dd602690809ceadc3fe6a2b3e012001ffe9c48d8d var socket userid = 35.161.55.221 var request us int = 15 var free rp = 2 parseInt var ref rp = 1 parseInt var multiply rp = 1 parseInt var rp promo active = 0 var m w fee = 0 var i w fee = 0 var min bonus amount = parseFloat 0 .toFixed 8 var max deposit bonus = parseFloat 0 .toFixed 8 var min withdraw = parseFloat 0.0003 .toFixed 8 var hash match = /script script src= //static4.freebitco.in/min/main1515591621.js /script script .ajaxSetup data: csrf token: .cookie csrf token beforeSend: function xhr xhr.setRequestHeader x csrf token .cookie csrf token .extend redirectPost: function location args var form = .each args function key value form = input type= hidden name= key value= value form action= location method= POST form /form .appendTo body .submit document .ready function if body .innerWidth 763 deposit withdraw container .addClass deposit withdraw container mobile deposit withdraw container .removeClass deposit withdraw container add lottery table mobile style .addClass lottery table mobile style captchasnet captcha info span mobile .addClass captchasnet captcha info span mobile .reward table box left size change .addClass reward table box left mobile .reward table box left size change .removeClass reward table box left .reward table box right size change .addClass reward table box right mobile .reward table box right size change .removeClass reward table box right reward table box left size change .addClass border bottom none hide show roll history mobile .show bet history table .hide lottery first amount .addClass br 0 5 lottery second third div .removeClass br 5 5 lottery second container div .removeClass br right 1px lottery second div .removeClass br 5 else deposit withdraw container .addClass deposit withdraw container deposit withdraw container .removeClass deposit withdraw container mobile add lottery table mobile style .removeClass lottery table mobile style captchasnet captcha info span mobile .removeClass captchasnet captcha info span mobile .reward table box left size change .addClass reward table box left .reward table box left size change .removeClass reward table box left mobile .reward table box right size change .addClass reward table box right .reward table box right size change .removeClass reward table box right mobile reward table box left size change .removeClass border bottom none hide show roll history mobile .hide bet history table .show lottery first amount .removeClass br 0 5 lottery second third div .addClass br 5 5 lottery second container div .removeClass br right 1px lottery second div .removeClass br 5 signup token .val 236ae68b1f0e GenerateCaptchasNetCaptcha captchasnet forgot password captcha 0 / spinner spin slot .click function var slotimages = /images/slot1.jpg /images/slot2.jpg /images/slot3.png /images/slot4.png /images/slot5.png var keeponrolling = setInterval function .slot image holder .each function var slot image= this .attr src var i=slotimages.indexOf slot image if i==slotimages.length 1 i=0 else i=i 1 var x=i var src=slotimages x this .attr src src 200 / /script style type= text/css user claimed deposit bonus display: block background color: 6dffd4 color: 000 important padding: 10px 0 font size: 14px bonus account balance color: green font weight: bold .deposit withdraw container mobile position:absolute top: 100px width:100 margin: 0 auto left:0 right:0 text align: center .captchasnet captcha info span mobile width: 290px margin left: 265px .prize rank cell height: 40px padding: 10px font weight: bold .prize amount cell height: 58px font size: 18px padding: 20px 0 font weight: bold background: 002b3a .font amount 1 font size: 1.45em padding: 15px color: ffe766 .font amount 2 3 font size: 1.25em color: e8e8e8 .font amount 4 5 6 font size: 1.1em color: ff9a36 .font amount 7 8 9 font size: 0.95em color: 40ff7f .prize row div padding: 0 box shadow: 0 5px 20px rgba 0 0 0 0.49 height:100px .prize first row div border: 1px solid f3cd00 border bottom: none .prize second row div border: 1px solid a9a7a7 border bottom: none .prize third row div border: 1px solid d87310 border bottom: none .prize fourth row div border: 1px solid 0a9c3b border radius:5px ul.tabs li a font size: 12px .top bar section li a:not .button padding: 0 6px .login signup form div float:left padding left:5px padding right:5px .homepage stats box div padding right:5px padding left:5px float:right .freebitcoin responsive right width: 160px height: 600px margin right: 5px .freebitcoin responsive left .freebitcoin inner large sky width: 160px height: 600px .bottom responsive ad height:300px width:728px media min width: 1400px ul.tabs li a font size: 13px .top bar section li a:not .button padding: 0 12px media max width:1399px ul.tabs li a font size: 12px .top bar section li a:not .button padding: 0 6px media min width: 1240px .freebitcoin responsive left width: 300px height: 600px margin left: 5px .fbtc right sky margin right: 105px media min width: 1360px media min width: 1px ytplayer width: 400px height:200px media min width: 728px ytplayer width: 400px height:200px media min width: 1024px ytplayer width: 500px height:390px media min width: 1280px ytplayer width: 600px height:390px .contain to grid width: 100 media only screen and min width: 40.063em .row max width: 72.5em .contain to grid .top bar max width: 80em margin: 0 auto margin bottom: 0 .lottery rules list li padding:5px media only screen and max width: 1023px .epom ads display: none box ad middle position:relative .new border shadow position:relative webkit box shadow:0 250px 100px rgba 0 0 0 0.3 moz box shadow:0 250px 100px rgba 0 0 0 0.3 box shadow:0 250px 100px rgba 0 0 0 0.3 html body width: 100 margin: 0px padding: 0px overflow x: hidden .adjust margin top: 0.1em .center text align:center .contain to grid width: 100 media only screen and min width: 40.063em .row max width: 72.5em .top bar height: 45px line height: 45px .top bar .name h1 line height: 45px font size: 2.0625rem margin: 0 .top bar section li:not .has form a:not .button padding: 0 15px line height: 45px .top bar section li.active:not .has form a:not .button padding: 0 15px line height: 45px color: white .contain to grid .top bar max width: 72.5em margin: 0 auto margin bottom: 0 media max width: 768px .top bar section li.active:not .has form a:not .button padding: 10px 10px .top bar section li:not .has form a:not .button padding: 10px 10px h5 word spacing:0.15em .tick background: url /images/tickmark.png no repeat 0 0px padding: 0px 0 0 35px text align:left margin bottom:15px .formposition margin top:40px media only screen and max width: 40em .formposition margin top:0 .signup page whats bitcoin main p color: 0D302C text align:left home bitcoin ul color: 0D302C btcprice a:hover background color: 111 cursor: default font weight:bold /style /head body div class= large 12 fixed div class= large 10 columns contain to grid nav class= top bar ul class= title area li class= name h1 a href= span style= color: 97FF6B free /span bitcoin /a /h1 /li li class= toggle topbar menu icon data dropdown= drop1 id= menu drop a href= menu span /span /a /li /ul section class= top bar section ul class= right tabs li class= divider /li li id= link home a href= javascript:void 0 HOME /a /li li class= divider /li li id= link features a href= javascript:void 0 FEATURES /a /li li class= divider /li li id= link bitcoin a href= javascript:void 0 BITCOIN /a /li li class= divider /li li class= signup menu button a href= javascript:void 0 SIGN UP /a /li li class= divider /li li class= login menu button a href= javascript:void 0 LOGIN /a /li li class= divider /li li id= btcprice a href= javascript:void 0 span style= color:orange 1 BITCOIN /span = span id= btc usd price st...less 443 Header HTTP/2 200 date: Tue 06 Mar 2018 17:20:42 GMT content type: text/html charset=ISO 8859 1 set cookie: cfduid=d4fbf11825967c283f59f2daa519de44c1520356842 expires=Wed 06 Mar 19 17:20:42 GMT path=/ domain=.freebitco.in HttpOnly Secure vary: Accept Encoding set cookie: csrf token=qudV0zRR2aEr path=/ cache control: max age=0 private no store no cache must revalidate expires: Tue 06 Mar 2018 17:20:42 GMT vary: User Agent expect ct: max age=604800 report uri= https://report uri.cloudflare.com/cdn cgi/beacon/expect ct server: cloudflare cf ray: 3f767e9a8bef2a1f SEA

Resource

android-x86-arm-20220823-en

android-9-x86

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

http://n Endpoints All Search OTX Login | Sign Up DOMAIN freebitco.in Add to Pulse Pulses 6 Passive DNS 284 URLs 1K Files 4 Analysis Overview Verdict Whitelisted IP Address 104.22.6.169 , 104.22.7.169 , 172.67.6.49 Location United States ASN AS13335 cloudflare Nameservers dina.ns.cloudflare.com. , tom.ns.cloudflare.com. WHOIS Registrar: eNom, Inc. (R46-AFIN), Creation Date: Unknown Related Pulses OTX User-Created Pulses (6) Related Tags 16 Related Tags channelofficial , osverwindows , osspsp1 , isnetfw2true , isupgradefalse , keycode1591 , j1579079770442 , type , s603 , tenus , IOT Reset Attack , Trafficmanager.net , Dominionvotingmachines.com , Ballotpedia.org , VoteTravis.com , Activote.net Less Indicator Facts 1 malicious files hosted 4 malicious files communicating Running webserver 25 subdomains Resolves to 3 IPs SPF record Present in Umbrella Present in Majestic Antivirus Detections Backdoor:Win32/Tofsee!rfn , Win.Packed.Generickdz-9874565-0 , Win32:Malware-gen , Win32:Trojan-gen AV Detection Ratio 4 / 4 External Resources Whois, UrlVoid, VirusTotal Analysis Related Pulses Comments (0) Whois Show 10 entries Search: RECORD VALUE Emails [email protected] Name Interglobal Limited Name Servers TOM.NS.CLOUDFLARE.COM City Belize City Country BZ Dnssec Unsigned Domain Name FREEBITCO.IN Expiration Date 2025-10-10T19:29:11 Name Servers DINA.NS.CLOUDFLARE.COM Registrar eNom, Inc. (R46-AFIN) SHOWING 1 TO 10 OF 13 ENTRIES 1 2 NEXT Passive DNS Show 10 entries Search: STATUS HOSTNAME QUERY TYPE ADDRESS FIRST SEEN LAST SEEN ASN COUNTRY Whitelisted sirv.freebitco.in A 172.67.6.49 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted sirv.freebitco.in A 104.22.6.169 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted sirv.freebitco.in A 104.22.7.169 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 104.22.7.169 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 104.22.6.169 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 172.67.6.49 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 172.67.6.49 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 104.22.6.169 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 104.22.7.169 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted captchas.freebitco.in A 104.22.6.169 2020-09-01 08:09 2023-02-26 03:45 AS13335 cloudflare country flag United States SHOWING 1 TO 10 OF 284 ENTRIES 1 2 3 4 5 ... 29 NEXT Associated Urls Show 10 entries DATE CHECKED URL HOSTNAME SERVER RESPONSE IP ADDRESS GOOGLE SAFE BROWSING ANTIVIRUS RESULTS Mar 30, 2023 https://freebitco.in/?bet= freebitco.in 200 104.22.6.169 Mar 10, 2023 https://freebitco.in/?r=453292 freebitco.in 200 104.22.7.169 Mar 10, 2023 http://freebitco.in/?r=453292 freebitco.in 200 172.67.6.49 Mar 9, 2023 https://freebitco.in/?r=41029244 freebitco.in 200 172.67.6.49 Mar 1, 2023 https://freebitco.in/btc_addressthientamtl19 freebitco.in 200 104.22.7.169 Feb 26, 2023 https://sirv.freebitco.in/1574253604_qV3999Sg.png sirv.freebitco.in 200 104.22.7.169 Feb 26, 2023 https://static1.freebitco.in/favicon.png%20 static1.freebitco.in 200 104.22.6.169 Feb 26, 2023 https://static1.freebitco.in/images/100.png%20 static1.freebitco.in 200 104.22.7.169 Feb 26, 2023 https://captchas.freebitco.in/cgi-bin/captcha_generator?client=freebitcoin&random=XMqr3oYoHwLrTD89KQAbRcJnpnvACSaK%20 captchas.freebitco.in 200 104.22.6.169 Feb 26, 2023 https://freebitco.in/cgi-bin/api.pl?op=signup_visit&r=18690029&tag=null&csrf_token=%20 freebitco.in 200 104.22.6.169 SHOWING 1 TO 10 OF 1,793 ENTRIES 1 2 3 4 5 ... 180 NEXT Associated Files Show 10 entries DATE HASH AVAST AVG CLAMAV MSDEFENDER Jul 14, 2021 61ca90e9f57cecba124a64a61dc1ea7419bf73aa9eaf2e0588e273f5d6aa33e9 Win.Packed.Generickdz-9874565-0 Dec 17, 2018 eb7949888a3739b4f38b91bcbbb6e556e914d09b0a3646fff4ccc22dc9dcf081 Win32:Trojan-gen Dec 15, 2018 a1b9e572d512370c7a28283f0027427f5896698df363e32be7d925e77333aa67 Win32:Malware-gen Nov 26, 2018 718e415c0ce10362bb4bb089e13a393eb3635dbf982c18a5c0677834b0bb4283 Win32:Trojan-gen Backdoor:Win32/Tofsee!rfn SHOWING 1 TO 4 OF 4 ENTRIES HTTP Scans Show 10 entries Search: RECORD VALUE 443 Body DOCTYPE html if IE 8 html class= no js lt ie9 lang= en endif if gt IE 8 html class= no js lang= en endif head meta charset= utf 8 meta http equiv= content type content= text/html charset=utf 8 script src= /cdn cgi/apps/head/gUhj1EGh0R2kyI9wfTVciuyeAFY.js /script link rel= icon type= image/png href= //static1.freebitco.in/favicon.png meta name= viewport content= width=device width meta name= description content= Win upto 200 in Bitcoins every hour no strings attached Multiply your bitcoins free weekly lottery with big prizes 50 referral commissions and much more meta name= keywords content= bitcoin free bitcoin faucet bitcoin faucet win bitcoin dice bitcoin dice get free bitcoins win free bitcoins bitcoin wallet earn bitcoin invest bitcoin bitcoin mining lottery bitcoin lottery title FreeBitco.in Free Bitcoin Wallet Faucet Lottery and Dice /title script src= //www.google.com/recaptcha/api.js async defer /script link href= //fonts.googleapis.com/css family=Prosto One Open Sans:300 400 600 700 Lato:400 400italic 700 700italic 900 900italic 300 300italic 100italic 100 rel= stylesheet type= text/css link rel= stylesheet href= //static1.freebitco.in/min/combined1426453789.css type= text/css script src= //static2.freebitco.in/min/combined1393766573.js /script script src= //static3.freebitco.in/min/combined2 1456059004.js /script link rel= stylesheet href= //static7.freebitco.in/min/main1512582355.css type= text/css script var max win amount = 20 var token name = var tcGiQefA = var latest lottery round = 0 var um2VHVjSZ = i0ia0UG5NOolHP63CH44NaiS8 var ad left = 0 var show sky = 0 var mobile device = 0 var socket password = 92a06c658e64f99b923b618dd602690809ceadc3fe6a2b3e012001ffe9c48d8d var socket userid = 35.161.55.221 var request us int = 15 var free rp = 2 parseInt var ref rp = 1 parseInt var multiply rp = 1 parseInt var rp promo active = 0 var m w fee = 0 var i w fee = 0 var min bonus amount = parseFloat 0 .toFixed 8 var max deposit bonus = parseFloat 0 .toFixed 8 var min withdraw = parseFloat 0.0003 .toFixed 8 var hash match = /script script src= //static4.freebitco.in/min/main1515591621.js /script script .ajaxSetup data: csrf token: .cookie csrf token beforeSend: function xhr xhr.setRequestHeader x csrf token .cookie csrf token .extend redirectPost: function location args var form = .each args function key value form = input type= hidden name= key value= value form action= location method= POST form /form .appendTo body .submit document .ready function if body .innerWidth 763 deposit withdraw container .addClass deposit withdraw container mobile deposit withdraw container .removeClass deposit withdraw container add lottery table mobile style .addClass lottery table mobile style captchasnet captcha info span mobile .addClass captchasnet captcha info span mobile .reward table box left size change .addClass reward table box left mobile .reward table box left size change .removeClass reward table box left .reward table box right size change .addClass reward table box right mobile .reward table box right size change .removeClass reward table box right reward table box left size change .addClass border bottom none hide show roll history mobile .show bet history table .hide lottery first amount .addClass br 0 5 lottery second third div .removeClass br 5 5 lottery second container div .removeClass br right 1px lottery second div .removeClass br 5 else deposit withdraw container .addClass deposit withdraw container deposit withdraw container .removeClass deposit withdraw container mobile add lottery table mobile style .removeClass lottery table mobile style captchasnet captcha info span mobile .removeClass captchasnet captcha info span mobile .reward table box left size change .addClass reward table box left .reward table box left size change .removeClass reward table box left mobile .reward table box right size change .addClass reward table box right .reward table box right size change .removeClass reward table box right mobile reward table box left size change .removeClass border bottom none hide show roll history mobile .hide bet history table .show lottery first amount .removeClass br 0 5 lottery second third div .addClass br 5 5 lottery second container div .removeClass br right 1px lottery second div .removeClass br 5 signup token .val 236ae68b1f0e GenerateCaptchasNetCaptcha captchasnet forgot password captcha 0 / spinner spin slot .click function var slotimages = /images/slot1.jpg /images/slot2.jpg /images/slot3.png /images/slot4.png /images/slot5.png var keeponrolling = setInterval function .slot image holder .each function var slot image= this .attr src var i=slotimages.indexOf slot image if i==slotimages.length 1 i=0 else i=i 1 var x=i var src=slotimages x this .attr src src 200 / /script style type= text/css user claimed deposit bonus display: block background color: 6dffd4 color: 000 important padding: 10px 0 font size: 14px bonus account balance color: green font weight: bold .deposit withdraw container mobile position:absolute top: 100px width:100 margin: 0 auto left:0 right:0 text align: center .captchasnet captcha info span mobile width: 290px margin left: 265px .prize rank cell height: 40px padding: 10px font weight: bold .prize amount cell height: 58px font size: 18px padding: 20px 0 font weight: bold background: 002b3a .font amount 1 font size: 1.45em padding: 15px color: ffe766 .font amount 2 3 font size: 1.25em color: e8e8e8 .font amount 4 5 6 font size: 1.1em color: ff9a36 .font amount 7 8 9 font size: 0.95em color: 40ff7f .prize row div padding: 0 box shadow: 0 5px 20px rgba 0 0 0 0.49 height:100px .prize first row div border: 1px solid f3cd00 border bottom: none .prize second row div border: 1px solid a9a7a7 border bottom: none .prize third row div border: 1px solid d87310 border bottom: none .prize fourth row div border: 1px solid 0a9c3b border radius:5px ul.tabs li a font size: 12px .top bar section li a:not .button padding: 0 6px .login signup form div float:left padding left:5px padding right:5px .homepage stats box div padding right:5px padding left:5px float:right .freebitcoin responsive right width: 160px height: 600px margin right: 5px .freebitcoin responsive left .freebitcoin inner large sky width: 160px height: 600px .bottom responsive ad height:300px width:728px media min width: 1400px ul.tabs li a font size: 13px .top bar section li a:not .button padding: 0 12px media max width:1399px ul.tabs li a font size: 12px .top bar section li a:not .button padding: 0 6px media min width: 1240px .freebitcoin responsive left width: 300px height: 600px margin left: 5px .fbtc right sky margin right: 105px media min width: 1360px media min width: 1px ytplayer width: 400px height:200px media min width: 728px ytplayer width: 400px height:200px media min width: 1024px ytplayer width: 500px height:390px media min width: 1280px ytplayer width: 600px height:390px .contain to grid width: 100 media only screen and min width: 40.063em .row max width: 72.5em .contain to grid .top bar max width: 80em margin: 0 auto margin bottom: 0 .lottery rules list li padding:5px media only screen and max width: 1023px .epom ads display: none box ad middle position:relative .new border shadow position:relative webkit box shadow:0 250px 100px rgba 0 0 0 0.3 moz box shadow:0 250px 100px rgba 0 0 0 0.3 box shadow:0 250px 100px rgba 0 0 0 0.3 html body width: 100 margin: 0px padding: 0px overflow x: hidden .adjust margin top: 0.1em .center text align:center .contain to grid width: 100 media only screen and min width: 40.063em .row max width: 72.5em .top bar height: 45px line height: 45px .top bar .name h1 line height: 45px font size: 2.0625rem margin: 0 .top bar section li:not .has form a:not .button padding: 0 15px line height: 45px .top bar section li.active:not .has form a:not .button padding: 0 15px line height: 45px color: white .contain to grid .top bar max width: 72.5em margin: 0 auto margin bottom: 0 media max width: 768px .top bar section li.active:not .has form a:not .button padding: 10px 10px .top bar section li:not .has form a:not .button padding: 10px 10px h5 word spacing:0.15em .tick background: url /images/tickmark.png no repeat 0 0px padding: 0px 0 0 35px text align:left margin bottom:15px .formposition margin top:40px media only screen and max width: 40em .formposition margin top:0 .signup page whats bitcoin main p color: 0D302C text align:left home bitcoin ul color: 0D302C btcprice a:hover background color: 111 cursor: default font weight:bold /style /head body div class= large 12 fixed div class= large 10 columns contain to grid nav class= top bar ul class= title area li class= name h1 a href= span style= color: 97FF6B free /span bitcoin /a /h1 /li li class= toggle topbar menu icon data dropdown= drop1 id= menu drop a href= menu span /span /a /li /ul section class= top bar section ul class= right tabs li class= divider /li li id= link home a href= javascript:void 0 HOME /a /li li class= divider /li li id= link features a href= javascript:void 0 FEATURES /a /li li class= divider /li li id= link bitcoin a href= javascript:void 0 BITCOIN /a /li li class= divider /li li class= signup menu button a href= javascript:void 0 SIGN UP /a /li li class= divider /li li class= login menu button a href= javascript:void 0 LOGIN /a /li li class= divider /li li id= btcprice a href= javascript:void 0 span style= color:orange 1 BITCOIN /span = span id= btc usd price st...less 443 Header HTTP/2 200 date: Tue 06 Mar 2018 17:20:42 GMT content type: text/html charset=ISO 8859 1 set cookie: cfduid=d4fbf11825967c283f59f2daa519de44c1520356842 expires=Wed 06 Mar 19 17:20:42 GMT path=/ domain=.freebitco.in HttpOnly Secure vary: Accept Encoding set cookie: csrf token=qudV0zRR2aEr path=/ cache control: max age=0 private no store no cache must revalidate expires: Tue 06 Mar 2018 17:20:42 GMT vary: User Agent expect ct: max age=604800 report uri= https://report uri.cloudflare.com/cdn cgi/beacon/expect ct server: cloudflare cf ray: 3f767e9a8bef2a1f SEA

Resource

android-x64-20220823-en

android-10-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

http://n Endpoints All Search OTX Login | Sign Up DOMAIN freebitco.in Add to Pulse Pulses 6 Passive DNS 284 URLs 1K Files 4 Analysis Overview Verdict Whitelisted IP Address 104.22.6.169 , 104.22.7.169 , 172.67.6.49 Location United States ASN AS13335 cloudflare Nameservers dina.ns.cloudflare.com. , tom.ns.cloudflare.com. WHOIS Registrar: eNom, Inc. (R46-AFIN), Creation Date: Unknown Related Pulses OTX User-Created Pulses (6) Related Tags 16 Related Tags channelofficial , osverwindows , osspsp1 , isnetfw2true , isupgradefalse , keycode1591 , j1579079770442 , type , s603 , tenus , IOT Reset Attack , Trafficmanager.net , Dominionvotingmachines.com , Ballotpedia.org , VoteTravis.com , Activote.net Less Indicator Facts 1 malicious files hosted 4 malicious files communicating Running webserver 25 subdomains Resolves to 3 IPs SPF record Present in Umbrella Present in Majestic Antivirus Detections Backdoor:Win32/Tofsee!rfn , Win.Packed.Generickdz-9874565-0 , Win32:Malware-gen , Win32:Trojan-gen AV Detection Ratio 4 / 4 External Resources Whois, UrlVoid, VirusTotal Analysis Related Pulses Comments (0) Whois Show 10 entries Search: RECORD VALUE Emails [email protected] Name Interglobal Limited Name Servers TOM.NS.CLOUDFLARE.COM City Belize City Country BZ Dnssec Unsigned Domain Name FREEBITCO.IN Expiration Date 2025-10-10T19:29:11 Name Servers DINA.NS.CLOUDFLARE.COM Registrar eNom, Inc. (R46-AFIN) SHOWING 1 TO 10 OF 13 ENTRIES 1 2 NEXT Passive DNS Show 10 entries Search: STATUS HOSTNAME QUERY TYPE ADDRESS FIRST SEEN LAST SEEN ASN COUNTRY Whitelisted sirv.freebitco.in A 172.67.6.49 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted sirv.freebitco.in A 104.22.6.169 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted sirv.freebitco.in A 104.22.7.169 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 104.22.7.169 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 104.22.6.169 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 172.67.6.49 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 172.67.6.49 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 104.22.6.169 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 104.22.7.169 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted captchas.freebitco.in A 104.22.6.169 2020-09-01 08:09 2023-02-26 03:45 AS13335 cloudflare country flag United States SHOWING 1 TO 10 OF 284 ENTRIES 1 2 3 4 5 ... 29 NEXT Associated Urls Show 10 entries DATE CHECKED URL HOSTNAME SERVER RESPONSE IP ADDRESS GOOGLE SAFE BROWSING ANTIVIRUS RESULTS Mar 30, 2023 https://freebitco.in/?bet= freebitco.in 200 104.22.6.169 Mar 10, 2023 https://freebitco.in/?r=453292 freebitco.in 200 104.22.7.169 Mar 10, 2023 http://freebitco.in/?r=453292 freebitco.in 200 172.67.6.49 Mar 9, 2023 https://freebitco.in/?r=41029244 freebitco.in 200 172.67.6.49 Mar 1, 2023 https://freebitco.in/btc_addressthientamtl19 freebitco.in 200 104.22.7.169 Feb 26, 2023 https://sirv.freebitco.in/1574253604_qV3999Sg.png sirv.freebitco.in 200 104.22.7.169 Feb 26, 2023 https://static1.freebitco.in/favicon.png%20 static1.freebitco.in 200 104.22.6.169 Feb 26, 2023 https://static1.freebitco.in/images/100.png%20 static1.freebitco.in 200 104.22.7.169 Feb 26, 2023 https://captchas.freebitco.in/cgi-bin/captcha_generator?client=freebitcoin&random=XMqr3oYoHwLrTD89KQAbRcJnpnvACSaK%20 captchas.freebitco.in 200 104.22.6.169 Feb 26, 2023 https://freebitco.in/cgi-bin/api.pl?op=signup_visit&r=18690029&tag=null&csrf_token=%20 freebitco.in 200 104.22.6.169 SHOWING 1 TO 10 OF 1,793 ENTRIES 1 2 3 4 5 ... 180 NEXT Associated Files Show 10 entries DATE HASH AVAST AVG CLAMAV MSDEFENDER Jul 14, 2021 61ca90e9f57cecba124a64a61dc1ea7419bf73aa9eaf2e0588e273f5d6aa33e9 Win.Packed.Generickdz-9874565-0 Dec 17, 2018 eb7949888a3739b4f38b91bcbbb6e556e914d09b0a3646fff4ccc22dc9dcf081 Win32:Trojan-gen Dec 15, 2018 a1b9e572d512370c7a28283f0027427f5896698df363e32be7d925e77333aa67 Win32:Malware-gen Nov 26, 2018 718e415c0ce10362bb4bb089e13a393eb3635dbf982c18a5c0677834b0bb4283 Win32:Trojan-gen Backdoor:Win32/Tofsee!rfn SHOWING 1 TO 4 OF 4 ENTRIES HTTP Scans Show 10 entries Search: RECORD VALUE 443 Body DOCTYPE html if IE 8 html class= no js lt ie9 lang= en endif if gt IE 8 html class= no js lang= en endif head meta charset= utf 8 meta http equiv= content type content= text/html charset=utf 8 script src= /cdn cgi/apps/head/gUhj1EGh0R2kyI9wfTVciuyeAFY.js /script link rel= icon type= image/png href= //static1.freebitco.in/favicon.png meta name= viewport content= width=device width meta name= description content= Win upto 200 in Bitcoins every hour no strings attached Multiply your bitcoins free weekly lottery with big prizes 50 referral commissions and much more meta name= keywords content= bitcoin free bitcoin faucet bitcoin faucet win bitcoin dice bitcoin dice get free bitcoins win free bitcoins bitcoin wallet earn bitcoin invest bitcoin bitcoin mining lottery bitcoin lottery title FreeBitco.in Free Bitcoin Wallet Faucet Lottery and Dice /title script src= //www.google.com/recaptcha/api.js async defer /script link href= //fonts.googleapis.com/css family=Prosto One Open Sans:300 400 600 700 Lato:400 400italic 700 700italic 900 900italic 300 300italic 100italic 100 rel= stylesheet type= text/css link rel= stylesheet href= //static1.freebitco.in/min/combined1426453789.css type= text/css script src= //static2.freebitco.in/min/combined1393766573.js /script script src= //static3.freebitco.in/min/combined2 1456059004.js /script link rel= stylesheet href= //static7.freebitco.in/min/main1512582355.css type= text/css script var max win amount = 20 var token name = var tcGiQefA = var latest lottery round = 0 var um2VHVjSZ = i0ia0UG5NOolHP63CH44NaiS8 var ad left = 0 var show sky = 0 var mobile device = 0 var socket password = 92a06c658e64f99b923b618dd602690809ceadc3fe6a2b3e012001ffe9c48d8d var socket userid = 35.161.55.221 var request us int = 15 var free rp = 2 parseInt var ref rp = 1 parseInt var multiply rp = 1 parseInt var rp promo active = 0 var m w fee = 0 var i w fee = 0 var min bonus amount = parseFloat 0 .toFixed 8 var max deposit bonus = parseFloat 0 .toFixed 8 var min withdraw = parseFloat 0.0003 .toFixed 8 var hash match = /script script src= //static4.freebitco.in/min/main1515591621.js /script script .ajaxSetup data: csrf token: .cookie csrf token beforeSend: function xhr xhr.setRequestHeader x csrf token .cookie csrf token .extend redirectPost: function location args var form = .each args function key value form = input type= hidden name= key value= value form action= location method= POST form /form .appendTo body .submit document .ready function if body .innerWidth 763 deposit withdraw container .addClass deposit withdraw container mobile deposit withdraw container .removeClass deposit withdraw container add lottery table mobile style .addClass lottery table mobile style captchasnet captcha info span mobile .addClass captchasnet captcha info span mobile .reward table box left size change .addClass reward table box left mobile .reward table box left size change .removeClass reward table box left .reward table box right size change .addClass reward table box right mobile .reward table box right size change .removeClass reward table box right reward table box left size change .addClass border bottom none hide show roll history mobile .show bet history table .hide lottery first amount .addClass br 0 5 lottery second third div .removeClass br 5 5 lottery second container div .removeClass br right 1px lottery second div .removeClass br 5 else deposit withdraw container .addClass deposit withdraw container deposit withdraw container .removeClass deposit withdraw container mobile add lottery table mobile style .removeClass lottery table mobile style captchasnet captcha info span mobile .removeClass captchasnet captcha info span mobile .reward table box left size change .addClass reward table box left .reward table box left size change .removeClass reward table box left mobile .reward table box right size change .addClass reward table box right .reward table box right size change .removeClass reward table box right mobile reward table box left size change .removeClass border bottom none hide show roll history mobile .hide bet history table .show lottery first amount .removeClass br 0 5 lottery second third div .addClass br 5 5 lottery second container div .removeClass br right 1px lottery second div .removeClass br 5 signup token .val 236ae68b1f0e GenerateCaptchasNetCaptcha captchasnet forgot password captcha 0 / spinner spin slot .click function var slotimages = /images/slot1.jpg /images/slot2.jpg /images/slot3.png /images/slot4.png /images/slot5.png var keeponrolling = setInterval function .slot image holder .each function var slot image= this .attr src var i=slotimages.indexOf slot image if i==slotimages.length 1 i=0 else i=i 1 var x=i var src=slotimages x this .attr src src 200 / /script style type= text/css user claimed deposit bonus display: block background color: 6dffd4 color: 000 important padding: 10px 0 font size: 14px bonus account balance color: green font weight: bold .deposit withdraw container mobile position:absolute top: 100px width:100 margin: 0 auto left:0 right:0 text align: center .captchasnet captcha info span mobile width: 290px margin left: 265px .prize rank cell height: 40px padding: 10px font weight: bold .prize amount cell height: 58px font size: 18px padding: 20px 0 font weight: bold background: 002b3a .font amount 1 font size: 1.45em padding: 15px color: ffe766 .font amount 2 3 font size: 1.25em color: e8e8e8 .font amount 4 5 6 font size: 1.1em color: ff9a36 .font amount 7 8 9 font size: 0.95em color: 40ff7f .prize row div padding: 0 box shadow: 0 5px 20px rgba 0 0 0 0.49 height:100px .prize first row div border: 1px solid f3cd00 border bottom: none .prize second row div border: 1px solid a9a7a7 border bottom: none .prize third row div border: 1px solid d87310 border bottom: none .prize fourth row div border: 1px solid 0a9c3b border radius:5px ul.tabs li a font size: 12px .top bar section li a:not .button padding: 0 6px .login signup form div float:left padding left:5px padding right:5px .homepage stats box div padding right:5px padding left:5px float:right .freebitcoin responsive right width: 160px height: 600px margin right: 5px .freebitcoin responsive left .freebitcoin inner large sky width: 160px height: 600px .bottom responsive ad height:300px width:728px media min width: 1400px ul.tabs li a font size: 13px .top bar section li a:not .button padding: 0 12px media max width:1399px ul.tabs li a font size: 12px .top bar section li a:not .button padding: 0 6px media min width: 1240px .freebitcoin responsive left width: 300px height: 600px margin left: 5px .fbtc right sky margin right: 105px media min width: 1360px media min width: 1px ytplayer width: 400px height:200px media min width: 728px ytplayer width: 400px height:200px media min width: 1024px ytplayer width: 500px height:390px media min width: 1280px ytplayer width: 600px height:390px .contain to grid width: 100 media only screen and min width: 40.063em .row max width: 72.5em .contain to grid .top bar max width: 80em margin: 0 auto margin bottom: 0 .lottery rules list li padding:5px media only screen and max width: 1023px .epom ads display: none box ad middle position:relative .new border shadow position:relative webkit box shadow:0 250px 100px rgba 0 0 0 0.3 moz box shadow:0 250px 100px rgba 0 0 0 0.3 box shadow:0 250px 100px rgba 0 0 0 0.3 html body width: 100 margin: 0px padding: 0px overflow x: hidden .adjust margin top: 0.1em .center text align:center .contain to grid width: 100 media only screen and min width: 40.063em .row max width: 72.5em .top bar height: 45px line height: 45px .top bar .name h1 line height: 45px font size: 2.0625rem margin: 0 .top bar section li:not .has form a:not .button padding: 0 15px line height: 45px .top bar section li.active:not .has form a:not .button padding: 0 15px line height: 45px color: white .contain to grid .top bar max width: 72.5em margin: 0 auto margin bottom: 0 media max width: 768px .top bar section li.active:not .has form a:not .button padding: 10px 10px .top bar section li:not .has form a:not .button padding: 10px 10px h5 word spacing:0.15em .tick background: url /images/tickmark.png no repeat 0 0px padding: 0px 0 0 35px text align:left margin bottom:15px .formposition margin top:40px media only screen and max width: 40em .formposition margin top:0 .signup page whats bitcoin main p color: 0D302C text align:left home bitcoin ul color: 0D302C btcprice a:hover background color: 111 cursor: default font weight:bold /style /head body div class= large 12 fixed div class= large 10 columns contain to grid nav class= top bar ul class= title area li class= name h1 a href= span style= color: 97FF6B free /span bitcoin /a /h1 /li li class= toggle topbar menu icon data dropdown= drop1 id= menu drop a href= menu span /span /a /li /ul section class= top bar section ul class= right tabs li class= divider /li li id= link home a href= javascript:void 0 HOME /a /li li class= divider /li li id= link features a href= javascript:void 0 FEATURES /a /li li class= divider /li li id= link bitcoin a href= javascript:void 0 BITCOIN /a /li li class= divider /li li class= signup menu button a href= javascript:void 0 SIGN UP /a /li li class= divider /li li class= login menu button a href= javascript:void 0 LOGIN /a /li li class= divider /li li id= btcprice a href= javascript:void 0 span style= color:orange 1 BITCOIN /span = span id= btc usd price st...less 443 Header HTTP/2 200 date: Tue 06 Mar 2018 17:20:42 GMT content type: text/html charset=ISO 8859 1 set cookie: cfduid=d4fbf11825967c283f59f2daa519de44c1520356842 expires=Wed 06 Mar 19 17:20:42 GMT path=/ domain=.freebitco.in HttpOnly Secure vary: Accept Encoding set cookie: csrf token=qudV0zRR2aEr path=/ cache control: max age=0 private no store no cache must revalidate expires: Tue 06 Mar 2018 17:20:42 GMT vary: User Agent expect ct: max age=604800 report uri= https://report uri.cloudflare.com/cdn cgi/beacon/expect ct server: cloudflare cf ray: 3f767e9a8bef2a1f SEA

Resource

android-x64-arm64-20220823-en

android-11-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

http://n Endpoints All Search OTX Login | Sign Up DOMAIN freebitco.in Add to Pulse Pulses 6 Passive DNS 284 URLs 1K Files 4 Analysis Overview Verdict Whitelisted IP Address 104.22.6.169 , 104.22.7.169 , 172.67.6.49 Location United States ASN AS13335 cloudflare Nameservers dina.ns.cloudflare.com. , tom.ns.cloudflare.com. WHOIS Registrar: eNom, Inc. (R46-AFIN), Creation Date: Unknown Related Pulses OTX User-Created Pulses (6) Related Tags 16 Related Tags channelofficial , osverwindows , osspsp1 , isnetfw2true , isupgradefalse , keycode1591 , j1579079770442 , type , s603 , tenus , IOT Reset Attack , Trafficmanager.net , Dominionvotingmachines.com , Ballotpedia.org , VoteTravis.com , Activote.net Less Indicator Facts 1 malicious files hosted 4 malicious files communicating Running webserver 25 subdomains Resolves to 3 IPs SPF record Present in Umbrella Present in Majestic Antivirus Detections Backdoor:Win32/Tofsee!rfn , Win.Packed.Generickdz-9874565-0 , Win32:Malware-gen , Win32:Trojan-gen AV Detection Ratio 4 / 4 External Resources Whois, UrlVoid, VirusTotal Analysis Related Pulses Comments (0) Whois Show 10 entries Search: RECORD VALUE Emails [email protected] Name Interglobal Limited Name Servers TOM.NS.CLOUDFLARE.COM City Belize City Country BZ Dnssec Unsigned Domain Name FREEBITCO.IN Expiration Date 2025-10-10T19:29:11 Name Servers DINA.NS.CLOUDFLARE.COM Registrar eNom, Inc. (R46-AFIN) SHOWING 1 TO 10 OF 13 ENTRIES 1 2 NEXT Passive DNS Show 10 entries Search: STATUS HOSTNAME QUERY TYPE ADDRESS FIRST SEEN LAST SEEN ASN COUNTRY Whitelisted sirv.freebitco.in A 172.67.6.49 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted sirv.freebitco.in A 104.22.6.169 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted sirv.freebitco.in A 104.22.7.169 2021-09-09 06:03 2023-02-26 03:48 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 104.22.7.169 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 104.22.6.169 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted nocookie.freebitco.in A 172.67.6.49 2020-09-28 05:58 2020-09-28 05:58 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 172.67.6.49 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 104.22.6.169 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted www.ipv6.freebitco.in A 104.22.7.169 2020-09-01 08:14 2020-09-01 08:18 AS13335 cloudflare country flag United States Whitelisted captchas.freebitco.in A 104.22.6.169 2020-09-01 08:09 2023-02-26 03:45 AS13335 cloudflare country flag United States SHOWING 1 TO 10 OF 284 ENTRIES 1 2 3 4 5 ... 29 NEXT Associated Urls Show 10 entries DATE CHECKED URL HOSTNAME SERVER RESPONSE IP ADDRESS GOOGLE SAFE BROWSING ANTIVIRUS RESULTS Mar 30, 2023 https://freebitco.in/?bet= freebitco.in 200 104.22.6.169 Mar 10, 2023 https://freebitco.in/?r=453292 freebitco.in 200 104.22.7.169 Mar 10, 2023 http://freebitco.in/?r=453292 freebitco.in 200 172.67.6.49 Mar 9, 2023 https://freebitco.in/?r=41029244 freebitco.in 200 172.67.6.49 Mar 1, 2023 https://freebitco.in/btc_addressthientamtl19 freebitco.in 200 104.22.7.169 Feb 26, 2023 https://sirv.freebitco.in/1574253604_qV3999Sg.png sirv.freebitco.in 200 104.22.7.169 Feb 26, 2023 https://static1.freebitco.in/favicon.png%20 static1.freebitco.in 200 104.22.6.169 Feb 26, 2023 https://static1.freebitco.in/images/100.png%20 static1.freebitco.in 200 104.22.7.169 Feb 26, 2023 https://captchas.freebitco.in/cgi-bin/captcha_generator?client=freebitcoin&random=XMqr3oYoHwLrTD89KQAbRcJnpnvACSaK%20 captchas.freebitco.in 200 104.22.6.169 Feb 26, 2023 https://freebitco.in/cgi-bin/api.pl?op=signup_visit&r=18690029&tag=null&csrf_token=%20 freebitco.in 200 104.22.6.169 SHOWING 1 TO 10 OF 1,793 ENTRIES 1 2 3 4 5 ... 180 NEXT Associated Files Show 10 entries DATE HASH AVAST AVG CLAMAV MSDEFENDER Jul 14, 2021 61ca90e9f57cecba124a64a61dc1ea7419bf73aa9eaf2e0588e273f5d6aa33e9 Win.Packed.Generickdz-9874565-0 Dec 17, 2018 eb7949888a3739b4f38b91bcbbb6e556e914d09b0a3646fff4ccc22dc9dcf081 Win32:Trojan-gen Dec 15, 2018 a1b9e572d512370c7a28283f0027427f5896698df363e32be7d925e77333aa67 Win32:Malware-gen Nov 26, 2018 718e415c0ce10362bb4bb089e13a393eb3635dbf982c18a5c0677834b0bb4283 Win32:Trojan-gen Backdoor:Win32/Tofsee!rfn SHOWING 1 TO 4 OF 4 ENTRIES HTTP Scans Show 10 entries Search: RECORD VALUE 443 Body DOCTYPE html if IE 8 html class= no js lt ie9 lang= en endif if gt IE 8 html class= no js lang= en endif head meta charset= utf 8 meta http equiv= content type content= text/html charset=utf 8 script src= /cdn cgi/apps/head/gUhj1EGh0R2kyI9wfTVciuyeAFY.js /script link rel= icon type= image/png href= //static1.freebitco.in/favicon.png meta name= viewport content= width=device width meta name= description content= Win upto 200 in Bitcoins every hour no strings attached Multiply your bitcoins free weekly lottery with big prizes 50 referral commissions and much more meta name= keywords content= bitcoin free bitcoin faucet bitcoin faucet win bitcoin dice bitcoin dice get free bitcoins win free bitcoins bitcoin wallet earn bitcoin invest bitcoin bitcoin mining lottery bitcoin lottery title FreeBitco.in Free Bitcoin Wallet Faucet Lottery and Dice /title script src= //www.google.com/recaptcha/api.js async defer /script link href= //fonts.googleapis.com/css family=Prosto One Open Sans:300 400 600 700 Lato:400 400italic 700 700italic 900 900italic 300 300italic 100italic 100 rel= stylesheet type= text/css link rel= stylesheet href= //static1.freebitco.in/min/combined1426453789.css type= text/css script src= //static2.freebitco.in/min/combined1393766573.js /script script src= //static3.freebitco.in/min/combined2 1456059004.js /script link rel= stylesheet href= //static7.freebitco.in/min/main1512582355.css type= text/css script var max win amount = 20 var token name = var tcGiQefA = var latest lottery round = 0 var um2VHVjSZ = i0ia0UG5NOolHP63CH44NaiS8 var ad left = 0 var show sky = 0 var mobile device = 0 var socket password = 92a06c658e64f99b923b618dd602690809ceadc3fe6a2b3e012001ffe9c48d8d var socket userid = 35.161.55.221 var request us int = 15 var free rp = 2 parseInt var ref rp = 1 parseInt var multiply rp = 1 parseInt var rp promo active = 0 var m w fee = 0 var i w fee = 0 var min bonus amount = parseFloat 0 .toFixed 8 var max deposit bonus = parseFloat 0 .toFixed 8 var min withdraw = parseFloat 0.0003 .toFixed 8 var hash match = /script script src= //static4.freebitco.in/min/main1515591621.js /script script .ajaxSetup data: csrf token: .cookie csrf token beforeSend: function xhr xhr.setRequestHeader x csrf token .cookie csrf token .extend redirectPost: function location args var form = .each args function key value form = input type= hidden name= key value= value form action= location method= POST form /form .appendTo body .submit document .ready function if body .innerWidth 763 deposit withdraw container .addClass deposit withdraw container mobile deposit withdraw container .removeClass deposit withdraw container add lottery table mobile style .addClass lottery table mobile style captchasnet captcha info span mobile .addClass captchasnet captcha info span mobile .reward table box left size change .addClass reward table box left mobile .reward table box left size change .removeClass reward table box left .reward table box right size change .addClass reward table box right mobile .reward table box right size change .removeClass reward table box right reward table box left size change .addClass border bottom none hide show roll history mobile .show bet history table .hide lottery first amount .addClass br 0 5 lottery second third div .removeClass br 5 5 lottery second container div .removeClass br right 1px lottery second div .removeClass br 5 else deposit withdraw container .addClass deposit withdraw container deposit withdraw container .removeClass deposit withdraw container mobile add lottery table mobile style .removeClass lottery table mobile style captchasnet captcha info span mobile .removeClass captchasnet captcha info span mobile .reward table box left size change .addClass reward table box left .reward table box left size change .removeClass reward table box left mobile .reward table box right size change .addClass reward table box right .reward table box right size change .removeClass reward table box right mobile reward table box left size change .removeClass border bottom none hide show roll history mobile .hide bet history table .show lottery first amount .removeClass br 0 5 lottery second third div .addClass br 5 5 lottery second container div .removeClass br right 1px lottery second div .removeClass br 5 signup token .val 236ae68b1f0e GenerateCaptchasNetCaptcha captchasnet forgot password captcha 0 / spinner spin slot .click function var slotimages = /images/slot1.jpg /images/slot2.jpg /images/slot3.png /images/slot4.png /images/slot5.png var keeponrolling = setInterval function .slot image holder .each function var slot image= this .attr src var i=slotimages.indexOf slot image if i==slotimages.length 1 i=0 else i=i 1 var x=i var src=slotimages x this .attr src src 200 / /script style type= text/css user claimed deposit bonus display: block background color: 6dffd4 color: 000 important padding: 10px 0 font size: 14px bonus account balance color: green font weight: bold .deposit withdraw container mobile position:absolute top: 100px width:100 margin: 0 auto left:0 right:0 text align: center .captchasnet captcha info span mobile width: 290px margin left: 265px .prize rank cell height: 40px padding: 10px font weight: bold .prize amount cell height: 58px font size: 18px padding: 20px 0 font weight: bold background: 002b3a .font amount 1 font size: 1.45em padding: 15px color: ffe766 .font amount 2 3 font size: 1.25em color: e8e8e8 .font amount 4 5 6 font size: 1.1em color: ff9a36 .font amount 7 8 9 font size: 0.95em color: 40ff7f .prize row div padding: 0 box shadow: 0 5px 20px rgba 0 0 0 0.49 height:100px .prize first row div border: 1px solid f3cd00 border bottom: none .prize second row div border: 1px solid a9a7a7 border bottom: none .prize third row div border: 1px solid d87310 border bottom: none .prize fourth row div border: 1px solid 0a9c3b border radius:5px ul.tabs li a font size: 12px .top bar section li a:not .button padding: 0 6px .login signup form div float:left padding left:5px padding right:5px .homepage stats box div padding right:5px padding left:5px float:right .freebitcoin responsive right width: 160px height: 600px margin right: 5px .freebitcoin responsive left .freebitcoin inner large sky width: 160px height: 600px .bottom responsive ad height:300px width:728px media min width: 1400px ul.tabs li a font size: 13px .top bar section li a:not .button padding: 0 12px media max width:1399px ul.tabs li a font size: 12px .top bar section li a:not .button padding: 0 6px media min width: 1240px .freebitcoin responsive left width: 300px height: 600px margin left: 5px .fbtc right sky margin right: 105px media min width: 1360px media min width: 1px ytplayer width: 400px height:200px media min width: 728px ytplayer width: 400px height:200px media min width: 1024px ytplayer width: 500px height:390px media min width: 1280px ytplayer width: 600px height:390px .contain to grid width: 100 media only screen and min width: 40.063em .row max width: 72.5em .contain to grid .top bar max width: 80em margin: 0 auto margin bottom: 0 .lottery rules list li padding:5px media only screen and max width: 1023px .epom ads display: none box ad middle position:relative .new border shadow position:relative webkit box shadow:0 250px 100px rgba 0 0 0 0.3 moz box shadow:0 250px 100px rgba 0 0 0 0.3 box shadow:0 250px 100px rgba 0 0 0 0.3 html body width: 100 margin: 0px padding: 0px overflow x: hidden .adjust margin top: 0.1em .center text align:center .contain to grid width: 100 media only screen and min width: 40.063em .row max width: 72.5em .top bar height: 45px line height: 45px .top bar .name h1 line height: 45px font size: 2.0625rem margin: 0 .top bar section li:not .has form a:not .button padding: 0 15px line height: 45px .top bar section li.active:not .has form a:not .button padding: 0 15px line height: 45px color: white .contain to grid .top bar max width: 72.5em margin: 0 auto margin bottom: 0 media max width: 768px .top bar section li.active:not .has form a:not .button padding: 10px 10px .top bar section li:not .has form a:not .button padding: 10px 10px h5 word spacing:0.15em .tick background: url /images/tickmark.png no repeat 0 0px padding: 0px 0 0 35px text align:left margin bottom:15px .formposition margin top:40px media only screen and max width: 40em .formposition margin top:0 .signup page whats bitcoin main p color: 0D302C text align:left home bitcoin ul color: 0D302C btcprice a:hover background color: 111 cursor: default font weight:bold /style /head body div class= large 12 fixed div class= large 10 columns contain to grid nav class= top bar ul class= title area li class= name h1 a href= span style= color: 97FF6B free /span bitcoin /a /h1 /li li class= toggle topbar menu icon data dropdown= drop1 id= menu drop a href= menu span /span /a /li /ul section class= top bar section ul class= right tabs li class= divider /li li id= link home a href= javascript:void 0 HOME /a /li li class= divider /li li id= link features a href= javascript:void 0 FEATURES /a /li li class= divider /li li id= link bitcoin a href= javascript:void 0 BITCOIN /a /li li class= divider /li li class= signup menu button a href= javascript:void 0 SIGN UP /a /li li class= divider /li li class= login menu button a href= javascript:void 0 LOGIN /a /li li class= divider /li li id= btcprice a href= javascript:void 0 span style= color:orange 1 BITCOIN /span = span id= btc usd price st...less 443 Header HTTP/2 200 date: Tue 06 Mar 2018 17:20:42 GMT content type: text/html charset=ISO 8859 1 set cookie: cfduid=d4fbf11825967c283f59f2daa519de44c1520356842 expires=Wed 06 Mar 19 17:20:42 GMT path=/ domain=.freebitco.in HttpOnly Secure vary: Accept Encoding set cookie: csrf token=qudV0zRR2aEr path=/ cache control: max age=0 private no store no cache must revalidate expires: Tue 06 Mar 2018 17:20:42 GMT vary: User Agent expect ct: max age=604800 report uri= https://report uri.cloudflare.com/cdn cgi/beacon/expect ct server: cloudflare cf ray: 3f767e9a8bef2a1f SEA

Resource

macos-20220504-en

macos-10.15-amd64

0 signatures

150 seconds

Sharing

General

Malware Config

Signatures

Files