111.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | Oct. 11, 2021, 9:55 a.m. | Oct. 11, 2021, 10:06 a.m. |
-
111.exe "C:\Users\test22\AppData\Local\Temp\111.exe"
1548
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| raw.githubusercontent.com | 185.199.108.133 | |
| sanctam.net | ||
| github.com | 52.78.231.108 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49165 -> 52.78.231.108:443 | 906200022 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.102:49166 -> 185.199.110.133:443 | 906200022 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLS 1.2 192.168.56.102:49165 52.78.231.108:443 |
C=US, O=DigiCert, Inc., CN=DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1 | C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=github.com | 84:63:b3:a9:29:12:cc:fd:1d:31:47:05:98:9b:ec:13:99:37:d0:d7 |
|
TLS 1.2 192.168.56.102:49166 185.199.110.133:443 |
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA | C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=www.github.com | 70:94:de:dd:e6:c4:69:48:3a:92:70:a1:48:56:78:2d:18:64:e0:b7 |
| suspicious_features | GET method with no useragent header | suspicious_request | GET https://github.com/UnamSanctam/SilentETHMiner/raw/master/SilentETHMiner/Resources/ethminer.zip | ||||||
| suspicious_features | GET method with no useragent header | suspicious_request | GET https://raw.githubusercontent.com/UnamSanctam/SilentETHMiner/master/SilentETHMiner/Resources/ethminer.zip | ||||||
| request | GET https://github.com/UnamSanctam/SilentETHMiner/raw/master/SilentETHMiner/Resources/ethminer.zip |
| request | GET https://raw.githubusercontent.com/UnamSanctam/SilentETHMiner/master/SilentETHMiner/Resources/ethminer.zip |
| section | {u'size_of_data': u'0x0000ee00', u'virtual_address': u'0x00002000', u'entropy': 7.963844057744755, u'name': u'.rdata', u'virtual_size': u'0x0000ec87'} | entropy | 7.96384405774 | description | A section with a high entropy has been found | |||||||||
| section | {u'size_of_data': u'0x000273f0', u'virtual_address': u'0x00013000', u'entropy': 7.965439463591778, u'name': u'.rsrc', u'virtual_size': u'0x000c13f0'} | entropy | 7.96543946359 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.986331601054 | description | Overall entropy of this PE file is high | |||||||||||
| host | 117.18.237.29 | |||
| host | 208.95.112.1 | |||