alphamedglobal.com
70.32.23.53AS55293 · USthis page sends its visitors on to https://beyondfitness.co…om/microsoft-store.php, which handed our browser an executable file ("zoom-installer-silent.vbs", https://beyondfitness.co…m-installer-silent.vbs) with no click
- Browser Analysismalicious
- Delivered filemalicious
- Threat Intelligencemalicious
- Network & Hostingclean
- Related Infrastructureclean
- Domain Intelligenceunknown
What happened
Step by step, from what the scanner recorded.Dangerous — confirmed threat
AutomatedIts page title claims to be Zoom, which this address is not associated with. After a short wait it sends you on to another page on the same site (https://beyondfitness.com.br/wp-includes/images/zoom/zoom/microsoft-store.php), and that page hands over a program to run on your computer. It is listed on external threat-intelligence feeds. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.
What to do
Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.
This verdict rests on other evidence: the site never showed us its own page, so its content was not assessed. Re-scan later or verify through a trusted channel.
Findings
Strongest firstWe analysed the file this page delivered — it is Malicious.
Success
SHA-256 3f50f278947223d4c75e649be6f514fda21d439dabcfdc9d25c2d823c99784e3
The page we scanned shows a wait screen and names one page on its own site as where it is about to send the visitor. We opened that page in our browser and it handed us a file — "zoom-installer-silent.vbs" from https://beyondfitness.com.br/wp-includes/zlc/zoom-installer-silent.vbs — without anyone clicking anything. delivers a script, not an installer ("zoom-installer-silent.vbs")
Analyst noteWe hold this file — it was delivered to our browser, so the file analysis on this scan is of the real payload rather than of the page. Nothing was clicked: the second page starts the download by itself. The submitted address only leads there, which is why it looks empty on its own.
The file this page handed over is a script, and its own text fetches the Level installer. Remote-management tools are legitimate software; what makes this an attack is that the visitor was given one under a different pretext, so the attacker ends up with remote control of the machine.
Analyst noteWe read this out of the delivered file itself, not off the page — which is why the page says nothing about Level. Treat the address as an IOC, and check whether the tenant it enrols into is yours before assuming it is not.
The page presents itself as a known brand (brand keywords/branding detected).
Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.
File
Stored by the engineWhat you download may be live malware. Open it only in an isolated environment, and do not double-click it.
The ZIP is encrypted. Password:infected
Inside the ZIP the file carries a name the engine generated, not the one the page used.
Delivered fileMaliciousThe engine stored it under a generated name
SHA-2563f50f278947223d4c75e649be6f514fda21d439dabcfdc9d25c2d823c99784e3
Fromhxxps://beyondfitness[.]com[.]br/wp-includes/zlc/zoom-installer-silent[.]vbs
Infrastructure
- IP
- 70.32.23.53A2HOSTING - A2 Hosting, Inc., US · AS55293US
- Redirects
- 1 hop · /home.php → /wp-includes/images/zoom/zoom/
WHOIS
- Registrar
- eNom, LLC
- Created
- Jun 19, 2019
- Expires
- Jun 19, 2027
- Nameservers
- ns1.stableserver.netns2.stableserver.netns3.stableserver.netns4.stableserver.net
Hashes & fingerprints
Page capture
LiveTitle “Zoom Client Update” · brand shown: Zoom (medium)
Engines
6 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- Zoom Client Update
- Load
- 10.12 s · 6 requests