vbc.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | Dec. 4, 2021, 10:03 p.m. | Dec. 4, 2021, 10:38 p.m. |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.xn--o39a00am61aa311e3tj68d.com | ||
| www.fillthegap.site | ||
| www.hatdieuhoanglinhlinh.com | 103.90.233.128 | |
| www.horrycountyrealtor.com | ||
| www.8wngeu.icu | 156.234.12.236 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.103:49164 -> 103.90.233.128:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49164 -> 103.90.233.128:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49164 -> 103.90.233.128:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| UDP 192.168.56.103:51958 -> 164.124.101.2:53 | 2026888 | ET INFO DNS Query for Suspicious .icu Domain | Potentially Bad Traffic |
| TCP 192.168.56.103:49165 -> 156.234.12.236:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49165 -> 156.234.12.236:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49165 -> 156.234.12.236:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
| section | .ndata |
| suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.hatdieuhoanglinhlinh.com/c1h5/?GVIp=U1bVErOKBwq0/qne9ly802VYsrPYaU3lSfk76VAFrq7s7GMJ2bTuzd8ISZ8Jn1imiGtcYMHa&uzu4=jjIDZjg0D0EpUr | ||||||
| suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.8wngeu.icu/c1h5/?GVIp=zDGZ3vEmxGxSOsZI9fS37WtkChyhZfEo+Gn4TKgK29zc6+ut9iheeJAGbC/eRZmilZa7E+2d&uzu4=jjIDZjg0D0EpUr | ||||||
| request | GET http://www.hatdieuhoanglinhlinh.com/c1h5/?GVIp=U1bVErOKBwq0/qne9ly802VYsrPYaU3lSfk76VAFrq7s7GMJ2bTuzd8ISZ8Jn1imiGtcYMHa&uzu4=jjIDZjg0D0EpUr |
| request | GET http://www.8wngeu.icu/c1h5/?GVIp=zDGZ3vEmxGxSOsZI9fS37WtkChyhZfEo+Gn4TKgK29zc6+ut9iheeJAGbC/eRZmilZa7E+2d&uzu4=jjIDZjg0D0EpUr |
| file | C:\Users\test22\AppData\Local\Temp\nsf8A10.tmp\igabfsyqm.dll |
| file | C:\Users\test22\AppData\Local\Temp\nsf8A10.tmp\igabfsyqm.dll |
| MicroWorld-eScan | Trojan.NSISX.Spy.Gen.2 |
| FireEye | Trojan.NSISX.Spy.Gen.2 |
| Cylance | Unsafe |
| Symantec | Packed.Generic.606 |
| ESET-NOD32 | a variant of Win32/Injector.EQRN |
| Paloalto | generic.ml |
| Kaspersky | UDS:DangerousObject.Multi.Generic |
| BitDefender | Trojan.NSISX.Spy.Gen.2 |
| Emsisoft | Trojan.NSISX.Spy.Gen.2 (B) |
| APEX | Malicious |
| MAX | malware (ai score=85) |
| Microsoft | Trojan:Win32/Sabsik.FL.B!ml |
| Arcabit | Zum.Androm.1 |
| GData | Zum.Androm.1 |
| Cynet | Malicious (score: 100) |
| Malwarebytes | Malware.AI.4134841244 |
| Fortinet | W32/Kryptik.EQRK!tr |
| Cybereason | malicious.b0e326 |