Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | Aug. 28, 2023, 9:36 a.m. | Aug. 28, 2023, 9:38 a.m. |
IP Address | Status | Action |
---|---|---|
149.202.0.242 | Active | Moloch |
104.18.145.235 | Active | Moloch |
104.21.9.89 | Active | Moloch |
104.26.4.15 | Active | Moloch |
104.26.5.15 | Active | Moloch |
121.254.136.9 | Active | Moloch |
148.251.234.83 | Active | Moloch |
148.251.234.93 | Active | Moloch |
156.236.72.121 | Active | Moloch |
176.123.9.142 | Active | Moloch |
163.123.143.4 | Active | Moloch |
164.124.101.2 | Active | Moloch |
172.67.200.102 | Active | Moloch |
172.67.75.163 | Active | Moloch |
176.113.115.84 | Active | Moloch |
179.43.158.2 | Active | Moloch |
185.225.73.32 | Active | Moloch |
193.106.174.130 | Active | Moloch |
193.233.254.61 | Active | Moloch |
194.169.175.128 | Active | Moloch |
194.169.175.232 | Active | Moloch |
194.26.135.162 | Active | Moloch |
208.67.104.60 | Active | Moloch |
34.117.59.81 | Active | Moloch |
45.15.156.229 | Active | Moloch |
45.9.74.80 | Active | Moloch |
77.91.124.231 | Active | Moloch |
87.121.221.58 | Active | Moloch |
87.240.132.72 | Active | Moloch |
93.186.225.194 | Active | Moloch |
95.142.206.0 | Active | Moloch |
95.142.206.1 | Active | Moloch |
95.142.206.2 | Active | Moloch |
95.142.206.3 | Active | Moloch |
62.122.184.58 | Active | Moloch |
Suricata Alerts
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.102:49185 172.67.75.163:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 92:b4:ed:98:67:d9:db:8a:1e:bd:0e:fe:7f:22:45:e9:79:b5:78:65 |
TLSv1 192.168.56.102:49193 93.186.225.194:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49208 104.21.9.89:443 |
C=US, O=Let's Encrypt, CN=E1 | CN=busell.store | 71:50:48:a9:78:b2:3d:36:b6:9d:29:b2:6c:01:05:3a:d7:61:0e:e3 |
TLSv1 192.168.56.102:49233 93.186.225.194:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49234 95.142.206.3:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com | bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24 |
TLSv1 192.168.56.102:49242 93.186.225.194:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49241 93.186.225.194:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49218 93.186.225.194:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49221 95.142.206.0:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com | bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24 |
TLSv1 192.168.56.102:49217 93.186.225.194:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49222 95.142.206.0:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com | bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24 |
TLSv1 192.168.56.102:49230 93.186.225.194:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49237 95.142.206.3:443 |
None | None | None |
TLSv1 192.168.56.102:49245 95.142.206.2:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com | bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24 |
TLSv1 192.168.56.102:49254 93.186.225.194:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49250 93.186.225.194:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49273 104.26.4.15:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5 |
TLSv1 192.168.56.102:49293 104.26.5.15:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5 |
TLSv1 192.168.56.102:49287 172.67.75.163:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 92:b4:ed:98:67:d9:db:8a:1e:bd:0e:fe:7f:22:45:e9:79:b5:78:65 |
TLSv1 192.168.56.102:49363 87.240.132.72:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49412 87.240.132.72:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com | 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09 |
TLSv1 192.168.56.102:49291 104.26.4.15:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5 |
TLSv1 192.168.56.102:49421 95.142.206.1:443 |
C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 | C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com | bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24 |
suspicious_features | Connection to IP address | suspicious_request | GET http://208.67.104.60/api/tracemap.php | ||||||
suspicious_features | POST method with no referer header, Connection to IP address | suspicious_request | POST http://208.67.104.60/api/firegate.php | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://77.91.124.231/info/img0581.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://87.121.221.58/g.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://87.121.221.58/g.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://77.91.124.231/info/img0581.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://176.113.115.84:8080/4.php | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://45.15.156.229/api/tracemap.php | ||||||
suspicious_features | POST method with no referer header, Connection to IP address | suspicious_request | POST http://45.15.156.229/api/firegate.php | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://45.9.74.80/loa.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://45.9.74.80/super.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://45.9.74.80/super.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://45.9.74.80/loa.exe | ||||||
suspicious_features | POST method with no referer header, Connection to IP address | suspicious_request | POST http://193.233.254.61/loghub/master | ||||||
suspicious_features | POST method with no referer header, POST method with no useragent header, Connection to IP address | suspicious_request | POST http://45.9.74.80/0bjdn2Z/index.php |
domain | autorun.ddns.net |
request | GET http://208.67.104.60/api/tracemap.php |
request | POST http://208.67.104.60/api/firegate.php |
request | HEAD http://77.91.124.231/info/img0581.exe |
request | HEAD http://87.121.221.58/g.exe |
request | HEAD http://jjz.alie3ksgbb.com/m/iela2f5.exe |
request | HEAD http://autorun.ddns.net/autorun.exe |
request | GET http://jjz.alie3ksgbb.com/m/iela2f5.exe |
request | GET http://87.121.221.58/g.exe |
request | GET http://apps.identrust.com/roots/dstrootcax3.p7c |
request | GET http://autorun.ddns.net/autorun.exe |
request | GET http://77.91.124.231/info/img0581.exe |
request | GET http://176.113.115.84:8080/4.php |
request | GET http://45.15.156.229/api/tracemap.php |
request | GET http://www.maxmind.com/geoip/v2.1/city/me |
request | POST http://45.15.156.229/api/firegate.php |
request | HEAD http://45.9.74.80/loa.exe |
request | HEAD http://45.9.74.80/super.exe |
request | GET http://45.9.74.80/super.exe |
request | GET http://45.9.74.80/loa.exe |
request | HEAD http://230809204625331.nes.dtf99.top/f/fikim0809331.exe |
request | GET http://230809204625331.nes.dtf99.top/f/fikim0809331.exe |
request | POST http://193.233.254.61/loghub/master |
request | POST http://45.9.74.80/0bjdn2Z/index.php |
request | GET https://api.myip.com/ |
request | GET https://vk.com/doc746114504_647280747?hash=cvDFKP5q0CQEjBCbeoeHvPNrWE0xbMxZEmrkIeNKcET&dl=G42DMMJRGQ2TANA:1661413520:uZNj68vRUvQaydRD8wpAK8zluN0I7otw5AHbA1ZlN9T&api=1&no_preview=1 |
request | GET https://busell.store/setup294.exe |
request | GET https://vk.com/doc44017378_668379524?hash=SHDy8F6MTaslV7hf9Z9WkzT8bkNJZOA2fSyjKD1YdDo&dl=mK8EYpCb4aWgpHrL7FEXpgLAT0BAaZgxM86wS4u0thT&api=1&no_preview=1 |
request | GET https://vk.com/doc44017378_668355890?hash=OEXurxHv742cAEINPwUZWBvCkIvq2mo3gMKCk9mNEZz&dl=FcEr7W2vNSUK3rRVQ2uwXb1BnszbBNaV1N06orQc1Os&api=1&no_preview=1 |
request | GET https://sun6-20.userapi.com/c909618/u44017378/docs/d44/659cbd3e52a9/PL43464.bmp?extra=wK-OoZtI3J9ssAzreYk1kKj_zykQJOvu-BbinFwgrI900hXBuZG5_zEBcLVat0Mc2xdZYmHMPnynVNnjTwIJFL5e_3907MFu9oh5yOz8DYWjl4htBLKmXxGD66TLBh3cc_hNK4vbUGcr99qq |
request | GET https://sun6-20.userapi.com/c240331/u44017378/docs/d44/4a7d1471c416/RazerSynapse.bmp?extra=cN1Ah5ycB0omDx2FAikyNuYCqqszKvg5NBZJDmMD6HRQxbVzQbkLFTHETnx3i1hANoppE7iqkUrkKQtOQRPtkScZhENAh3LCvnuUSp-j8zDG-Cvg9M6IK8a17l-939_WI4KPzI7sBWuITe1s |
request | GET https://vk.com/doc44017378_668305087?hash=TuocKpTKJDaGHrC0HTDbLSAP7ILM8xAQgYNUm78Bmgc&dl=pQmbc6zVZsxint9VqlO9DcFBndvLOtSqeXbOXCsW4yo&api=1&no_preview=1#start |
request | GET https://vk.com/doc44017378_668469133?hash=BzAyBtoTQmQ0uUkT34inVefZZZfjSHGwzjfnXF9K9IP&dl=Y4YNowZZspOPNeFf2KoJiZEZDeoxookrqRltEutjAJL&api=1&no_preview=1#1 |
request | GET https://sun6-23.userapi.com/c909228/u44017378/docs/d31/031a419a08d3/x.bmp?extra=dePDDxM4DGeRjT25CPSd9Ct_rh4XuSy3bDoQT210esXvzYUkXxOVYuGMvFWgtBzuVzB3Pu96kIXJMM6wkMMmcUYG__1Vlk_pw8FQ7gzlKceZLiq9Eqem8GfM2a6kPvhxYu11_xbkARdYZv5A |
request | GET https://sun6-23.userapi.com/c237131/u44017378/docs/d8/804100308acb/crypted.bmp?extra=YdWzxtefQjhAn2En8yMf52BVIWQ1zDpTGnqIQV8H-oovyZAD987-RJUW7gg_f88GbltLuEEDnvBy7hYICJjBzLy3mUu_gNG3r-H83JNo8km9DJT6vRIbrJJSEyZFo5UVa2zp0-t91ahX0NLI |
request | GET https://vk.com/doc791620691_663065029?hash=Efubo9FQtw3Bdj42XJVcJwymfIH3PazMKz8g5wJ0dZX&dl=G44TCNRSGA3DSMI:1682787066:QgrgzF33wDt9bwmmOgWCYTv61J7HwhLVZOXGaEdWiKP&api=1&no_preview=1#stats |
request | GET https://vk.com/doc44017378_668304193?hash=9nKZ2LbJrWZTaSMoxOyzGdzdzVswMLVAELDqvF4WUzc&dl=8uKyjO7RLaL9aj2kQjAN7XRk3OAYJZ3SL1dkc9tNpxc&api=1&no_preview=1#WW1 |
request | GET https://sun6-22.userapi.com/c240331/u44017378/docs/d46/42e54d223ac0/WWW1.bmp?extra=z3ACIIJGvpBq0HIjNutA06MbTxxpx-3FTjAItWDCFPURzTU-Elofrz0yjYDQ-Y0cKAOty0-j-qZ4D9-iRxHB4fbGo-ZGq2MO7TmgEksuA_yPzC1cH8cIReEGVuYFWKNHeD38LYYVpq6zZwr1 |
request | GET https://vk.com/doc791620691_663065029?hash=Efubo9FQtw3Bdj42XJVcJwymfIH3PazMKz8g5wJ0dZX&dl=G44TCNRSGA3DSMI:1682787066:QgrgzF33wDt9bwmmOgWCYTv61J7HwhLVZOXGaEdWiKP&api=1&no_preview=1#test |
request | GET https://vk.com/doc44017378_668405935?hash=fvMGzddKGZ3CmaEa4ShIsqcaZmrdOzO4ZYwVyqVeuP4&dl=A1sZp5keQgwnZnnluDo5illwFz3gbsy8ItDrxpQJEYX&api=1&no_preview=1#rise |
request | GET https://sun6-23.userapi.com/c909628/u44017378/docs/d59/31728cb37cde/RisePro_0_5_eM6kP0V0t0TJM31LPkFZ.bmp?extra=8qyEsehyUDi_2xlj_ansoERclQ9Xci7OMgY_Z_dhC3sYp7lSaoe-hwps_VpYFHUZgKttlij0IkBys8yBQrRUN5ckgRxTLEt4x2H7QR9_t0L9p2MEQT46O4gRs1cifsBGFjn9PEomMPopTUT7 |
request | GET https://db-ip.com/demo/home.php?s=175.208.134.152 |
request | GET https://db-ip.com/ |
request | POST https://api.db-ip.com/v2/p31e4d59ee6ad1a0b5cc80695a873e43a8fbca06/self |
request | GET https://vk.com/doc44017378_668486332?hash=BhRIDxpzULlbXK2tKkcXiuoUkEN2dwCkZOYOzQcmo7H&dl=FDJjPlpT0sFHWyDa952v0WGrE3O4diq55i6OiBzVvCP&api=1&no_preview=1#tmwvr |
request | GET https://sun6-21.userapi.com/c909218/u44017378/docs/d2/a123e4d9467e/tmvwr.bmp?extra=dw3ig29aP3yneS_TLS58bIOpD3nvHS4hyj20IHzV4auTqlcYk7B3PTmG39G-DIsuZibYbb5DJwmuYhj-eeAZU_akb9ZZdKKH3i2dbrzniwCU6siKujeSKY42r-Yjhvn2HFKIbVb7ik8qBPQk |
request | POST http://208.67.104.60/api/firegate.php |
request | POST http://45.15.156.229/api/firegate.php |
request | POST http://193.233.254.61/loghub/master |
request | POST http://45.9.74.80/0bjdn2Z/index.php |
request | POST https://api.db-ip.com/v2/p31e4d59ee6ad1a0b5cc80695a873e43a8fbca06/self |
ip | 149.202.0.242 |
ip | 176.123.9.142 |
ip | 176.113.115.84 |
ip | 185.225.73.32 |
ip | 194.169.175.128 |
ip | 194.169.175.232 |
ip | 194.26.135.162 |
domain | iplis.ru | description | Russian Federation domain TLD | ||||||
domain | 230809204625331.nes.dtf99.top | description | Generic top level domain TLD |
domain | ipinfo.io |
Gridinsoft | Malware.U.Gen.bot |
description | Escalate priviledges | rule | Escalate_priviledges | ||||||
description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Checks if being debugged | rule | anti_dbg | ||||||
description | Bypass DEP | rule | disable_dep | ||||||
description | Run a KeyLogger | rule | KeyLogger |
host | 149.202.0.242 | |||
host | 176.123.9.142 | |||
host | 163.123.143.4 | |||
host | 176.113.115.84 | |||
host | 185.225.73.32 | |||
host | 193.233.254.61 | |||
host | 194.169.175.128 | |||
host | 194.26.135.162 | |||
host | 208.67.104.60 | |||
host | 45.15.156.229 | |||
host | 45.9.74.80 | |||
host | 77.91.124.231 | |||
host | 87.121.221.58 | |||
host | 62.122.184.58 |
dead_host | 176.113.115.84:80 |
dead_host | 163.123.143.4:80 |
dead_host | 192.168.56.102:49200 |