popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

release.rar

Amadey PWS Escalate priviledges KeyLogger AntiDebug AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Dec. 15, 2023, 5:34 p.m. Dec. 15, 2023, 5:37 p.m.
Size 7.9MB
Type RAR archive data, v5
MD5 57ab5e01e6e92d13ae33e587004ad918
SHA256 b6b19302dbaaf3d352c4636cc1925ad773286c3bb2269d3dfc834f62391327f0
CRC32 F318DCE5
ssdeep 196608:QjQk09yFvrNWqNl/sVJW1xnYWg2BJdVRAyS7Sd4:n3YvrL/dnpdVRAyUC4
Yara None matched

Name Response Post-Analysis Lookup
medfioytrkdkcodlskeej.net
A 91.215.85.209
91.215.85.209
zexeq.com
A 211.53.230.67
A 123.213.233.131
A 211.119.84.111
A 14.33.209.147
A 123.140.161.243
A 196.188.169.138
A 195.158.3.162
A 211.40.39.251
A 181.168.176.36
A 210.182.29.70
211.53.230.67
apps.identrust.com
A 23.67.53.27
A 23.67.53.17
CNAME a1952.dscq.akamai.net
CNAME identrust.edgesuite.net
A 121.254.136.9
A 121.254.136.18
23.67.53.27
vdfgdfbfdbdfbdfgroup.sbs
A 172.67.222.70
A 104.21.38.114
172.67.222.70
ipinfo.io
A 34.117.59.81
A 34.117.186.192
34.117.59.81
zen.topteamlife.com
A 172.67.138.35
A 104.21.26.173
172.67.138.35
91920b82-9195-455d-9a5f-23f11e556e53.uuid.dumperstats.org 185.82.216.111
mrproper.org
A 104.21.63.180
A 172.67.171.152
104.21.63.180
sun6-23.userapi.com
A 95.142.206.3
95.142.206.3
sun6-22.userapi.com
A 95.142.206.2
95.142.206.2
walkinglate.com
A 172.67.212.188
A 104.21.23.184
172.67.212.188
vsblobprodscussu5shard58.blob.core.windows.net
CNAME blob.sat09prdstrz08a.store.core.windows.net
CNAME blob.SAT09PrdStrz08A.trafficmanager.net
A 20.150.38.228
A 20.150.79.68
A 20.150.70.36
20.150.38.228
iplis.ru
A 104.21.63.150
A 172.67.147.32
172.67.147.32
domen414.com
A 172.67.166.192
A 104.21.91.52
172.67.166.192
msdl.microsoft.com
CNAME msdl.microsoft.akadns.net
CNAME msdl-microsoft-com.a-0016.a-msedge.net
CNAME a-0016.a-msedge.net
A 204.79.197.219
204.79.197.219
vk.com
A 87.240.129.133
A 87.240.132.72
A 87.240.132.67
A 87.240.137.164
A 93.186.225.194
A 87.240.132.78
87.240.132.72
iplogger.org
A 104.21.4.208
A 172.67.132.113
104.21.4.208
sun6-20.userapi.com
A 95.142.206.0
95.142.206.0
api.ipify.org
A 173.231.16.77
A 64.185.227.156
CNAME api4.ipify.org
A 104.237.62.212
64.185.227.156
api.2ip.ua
A 104.21.65.24
A 172.67.139.220
172.67.139.220
stun1.l.google.com
A 172.253.56.127
172.253.56.127
xmr-asia1.nanopool.org
A 103.3.62.64
A 139.99.102.73
A 139.99.101.232
A 139.99.102.71
A 139.99.102.74
A 139.99.102.72
A 139.99.101.198
A 139.99.102.70
A 139.99.101.197
A 172.104.165.191
172.104.165.191
sun6-21.userapi.com
A 95.142.206.1
95.142.206.1
still.topteamlife.com
A 172.67.138.35
A 104.21.26.173
172.67.138.35
vanaheim.cn
A 91.222.236.186
91.222.236.186
api.myip.com
A 172.67.75.163
A 104.26.9.59
A 104.26.8.59
104.26.9.59
transfer.sh
A 144.76.136.153
144.76.136.153
db-ip.com
A 104.26.5.15
A 104.26.4.15
A 172.67.75.166
104.26.4.15
vsblobprodscussu5shard10.blob.core.windows.net
CNAME blob.sat09prdstrz08a.store.core.windows.net
CNAME blob.SAT09PrdStrz08A.trafficmanager.net
A 20.150.79.68
A 20.150.38.228
A 20.150.70.36
20.150.38.228
server6.dumperstats.org
A 185.82.216.111
185.82.216.111
cdn.discordapp.com
A 162.159.135.233
A 162.159.134.233
A 162.159.130.233
A 162.159.129.233
A 162.159.133.233
162.159.135.233
IP Address Status Action
104.21.38.114 Active Moloch
104.21.63.150 Active Moloch
104.21.63.180 Active Moloch
104.26.5.15 Active Moloch
109.107.182.3 Active Moloch
121.254.136.18 Active Moloch
144.76.136.153 Active Moloch
162.159.135.233 Active Moloch
164.124.101.2 Active Moloch
172.104.165.191 Active Moloch
172.253.56.127 Active Moloch
172.67.132.113 Active Moloch
172.67.138.35 Active Moloch
172.67.139.220 Active Moloch
172.67.166.192 Active Moloch
172.67.212.188 Active Moloch
172.67.75.163 Active Moloch
173.231.16.77 Active Moloch
176.113.115.84 Active Moloch
176.123.10.211 Active Moloch
185.172.128.19 Active Moloch
185.82.216.111 Active Moloch
194.33.191.102 Active Moloch
194.33.191.60 Active Moloch
195.20.16.45 Active Moloch
23.67.53.27 Active Moloch
34.117.186.192 Active Moloch
34.117.59.81 Active Moloch
45.15.156.229 Active Moloch
5.42.64.35 Active Moloch
5.42.64.41 Active Moloch
77.105.147.130 Active Moloch
87.240.132.67 Active Moloch
91.215.85.209 Active Moloch
95.142.206.0 Active Moloch
95.142.206.1 Active Moloch
95.142.206.2 Active Moloch
95.142.206.3 Active Moloch
20.150.38.228 Active Moloch
20.150.79.68 Active Moloch
204.79.197.219 Active Moloch
211.53.230.67 Active Moloch
45.15.156.187 Active Moloch
91.222.236.186 Active Moloch
91.92.254.7 Active Moloch
91.92.242.146 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49174 -> 195.20.16.45:80 2045779 ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49178 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49179 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49175 -> 172.67.75.163:443 2042969 ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49179 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49175 -> 172.67.75.163:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 176.113.115.84:80 -> 192.168.56.102:49189 2400019 ET DROP Spamhaus DROP Listed Traffic Inbound group 20 Misc Attack
TCP 192.168.56.102:49181 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49187 -> 5.42.64.35:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.102:49186 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.102:49194 -> 104.21.38.114:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 104.21.38.114:80 -> 192.168.56.102:49194 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 104.21.38.114:80 -> 192.168.56.102:49196 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49195 -> 91.215.85.209:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49195 -> 91.215.85.209:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49187 -> 5.42.64.35:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.102:49186 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.102:49198 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 5.42.64.35:80 -> 192.168.56.102:49187 2014819 ET INFO Packed Executable Download Misc activity
TCP 192.168.56.102:49198 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49191 -> 91.215.85.209:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49191 -> 91.215.85.209:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49200 -> 91.215.85.209:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49190 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49190 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 109.107.182.3:80 -> 192.168.56.102:49186 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 5.42.64.35:80 -> 192.168.56.102:49187 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 109.107.182.3:80 -> 192.168.56.102:49186 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 5.42.64.35:80 -> 192.168.56.102:49187 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.102:49197 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49197 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 87.240.132.67:80 -> 192.168.56.102:49202 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 172.67.138.35:80 -> 192.168.56.102:49192 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 172.67.138.35:80 -> 192.168.56.102:49192 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 192.168.56.102:49201 -> 104.21.38.114:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49203 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49207 -> 91.215.85.209:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 176.113.115.84:8080 -> 192.168.56.102:49206 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 176.113.115.84:8080 -> 192.168.56.102:49206 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 176.113.115.84:8080 -> 192.168.56.102:49206 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 192.168.56.102:49176 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49176 -> 34.117.186.192:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49176 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49176 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49183 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49188 -> 194.33.191.102:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.102:49185 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49185 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 194.33.191.102:80 -> 192.168.56.102:49188 2045860 ET HUNTING Rejetto HTTP File Sever Response A Network Trojan was detected
TCP 192.168.56.102:49188 -> 194.33.191.102:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 194.33.191.102:80 -> 192.168.56.102:49188 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 194.33.191.102:80 -> 192.168.56.102:49188 2020500 ET EXPLOIT_KIT DRIVEBY Likely Evil EXE with no referer from HFS webserver (used by Unknown EK) Exploit Kit Activity Detected
TCP 194.33.191.102:80 -> 192.168.56.102:49188 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 194.33.191.102:80 -> 192.168.56.102:49188 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 194.33.191.102:80 -> 192.168.56.102:49188 2015744 ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) Misc activity
TCP 192.168.56.102:49193 -> 104.21.38.114:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49193 -> 104.21.38.114:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 91.215.85.209:443 -> 192.168.56.102:49213 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49210 -> 91.215.85.209:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49212 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49214 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49214 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49218 -> 95.142.206.0:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49216 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49217 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49217 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49219 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 87.240.132.67:80 -> 192.168.56.102:49219 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49220 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49220 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49221 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49221 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49228 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49228 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49211 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49211 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49225 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49225 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49234 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49227 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49231 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49231 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49238 -> 95.142.206.1:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49229 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49240 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49240 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49239 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49241 -> 95.142.206.1:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49243 -> 95.142.206.0:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49245 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49245 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49246 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49246 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49249 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49249 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49247 -> 95.142.206.2:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49232 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49232 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49254 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49256 -> 95.142.206.3:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49255 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49257 -> 95.142.206.3:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49260 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49260 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49252 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49261 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49261 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49236 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49267 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49242 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49258 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49258 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49263 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49222 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49271 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49223 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49233 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49244 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 87.240.132.67:80 -> 192.168.56.102:49244 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49248 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49266 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49266 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49251 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49259 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49259 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49262 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49270 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.102:65368 -> 164.124.101.2:53 2027026 ET POLICY External IP Address Lookup DNS Query (2ip .ua) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49274 -> 45.15.156.229:80 2045779 ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49280 -> 172.67.139.220:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.102:49276 -> 77.105.147.130:80 2045779 ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49280 -> 172.67.139.220:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49279 -> 172.67.75.163:443 2042969 ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49279 -> 172.67.75.163:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49286 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49286 -> 34.117.186.192:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49268 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49286 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49282 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49282 -> 34.117.186.192:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49282 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 91.92.242.146:80 -> 192.168.56.102:49285 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 91.92.242.146:80 -> 192.168.56.102:49285 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 91.92.242.146:80 -> 192.168.56.102:49285 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 192.168.56.102:49289 -> 172.67.132.113:443 2035949 ET POLICY IP Check Domain (iplogger .org in TLS SNI) Potential Corporate Privacy Violation
TCP 192.168.56.102:49289 -> 172.67.132.113:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49290 -> 194.33.191.60:44675 2043233 ET INFO Microsoft net.tcp Connection Initialization Activity Potentially Bad Traffic
TCP 192.168.56.102:49290 -> 194.33.191.60:44675 2046045 ET MALWARE [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) A Network Trojan was detected
TCP 192.168.56.102:49281 -> 172.67.75.163:443 2042969 ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49281 -> 172.67.75.163:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49281 -> 172.67.75.163:443 2042969 ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49284 -> 104.21.63.150:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49294 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49294 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49299 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.102:59651 -> 164.124.101.2:53 2034316 ET POLICY Observed DNS Query to File Transfer Service Domain (transfer .sh) Potentially Bad Traffic
UDP 192.168.56.102:59651 -> 164.124.101.2:53 2035139 ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in DNS Lookup) Misc activity
TCP 195.20.16.45:50500 -> 192.168.56.102:49301 2046266 ET MALWARE [ANY.RUN] RisePro TCP (Token) Malware Command and Control Activity Detected
TCP 192.168.56.102:49301 -> 195.20.16.45:50500 2049060 ET MALWARE Suspected RisePro TCP Heartbeat Packet A Network Trojan was detected
UDP 192.168.56.102:59651 -> 8.8.8.8:53 2034316 ET POLICY Observed DNS Query to File Transfer Service Domain (transfer .sh) Potentially Bad Traffic
UDP 192.168.56.102:59651 -> 8.8.8.8:53 2035139 ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in DNS Lookup) Misc activity
TCP 195.20.16.45:50500 -> 192.168.56.102:49301 2046267 ET MALWARE [ANY.RUN] RisePro TCP (External IP) Malware Command and Control Activity Detected
TCP 87.240.132.67:80 -> 192.168.56.102:49296 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49310 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 87.240.132.67:80 -> 192.168.56.102:49310 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49305 -> 144.76.136.153:443 2035145 ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI) Misc activity
TCP 192.168.56.102:49305 -> 144.76.136.153:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49308 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 87.240.132.67:80 -> 192.168.56.102:49308 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49301 -> 195.20.16.45:50500 2046269 ET MALWARE [ANY.RUN] RisePro TCP (Activity) Malware Command and Control Activity Detected
TCP 192.168.56.102:49301 -> 195.20.16.45:50500 2046268 ET MALWARE [ANY.RUN] RisePro TCP v.0.x (Get_settings) Malware Command and Control Activity Detected
TCP 192.168.56.102:49320 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49305 -> 144.76.136.153:443 2035145 ET INFO Commonly Abused File Sharing Site Domain Observed (transfer .sh in TLS SNI) Misc activity
TCP 144.76.136.153:443 -> 192.168.56.102:49305 2033076 ET POLICY Observed File Transfer Service SSL/TLS Certificate (transfer .sh) Potential Corporate Privacy Violation
TCP 192.168.56.102:49301 -> 195.20.16.45:50500 2046270 ET MALWARE [ANY.RUN] RisePro TCP (Exfiltration) Malware Command and Control Activity Detected
UDP 192.168.56.102:53991 -> 164.124.101.2:53 2027026 ET POLICY External IP Address Lookup DNS Query (2ip .ua) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49314 -> 104.26.5.15:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49315 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 87.240.132.67:80 -> 192.168.56.102:49316 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 195.20.16.45:50505 -> 192.168.56.102:49272 2046266 ET MALWARE [ANY.RUN] RisePro TCP (Token) Malware Command and Control Activity Detected
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2044243 ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in Malware Command and Control Activity Detected
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2044244 ET MALWARE Win32/Stealc Requesting browsers Config from C2 Malware Command and Control Activity Detected
TCP 5.42.64.41:80 -> 192.168.56.102:49278 2044245 ET MALWARE Win32/Stealc Active C2 Responding with browsers Config Malware Command and Control Activity Detected
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2044246 ET MALWARE Win32/Stealc Requesting plugins Config from C2 Malware Command and Control Activity Detected
TCP 192.168.56.102:49330 -> 211.53.230.67:80 2002400 ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer) A Network Trojan was detected
TCP 192.168.56.102:49330 -> 211.53.230.67:80 2036334 ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key A Network Trojan was detected
TCP 192.168.56.102:49272 -> 195.20.16.45:50505 2046269 ET MALWARE [ANY.RUN] RisePro TCP (Activity) Malware Command and Control Activity Detected
TCP 211.53.230.67:80 -> 192.168.56.102:49330 2036335 ET MALWARE Win32/Filecoder.STOP Variant Public Key Download A Network Trojan was detected
TCP 5.42.64.41:80 -> 192.168.56.102:49278 2044247 ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config Malware Command and Control Activity Detected
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2044248 ET MALWARE Win32/Stealc Submitting System Information to C2 Malware Command and Control Activity Detected
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2044301 ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 5.42.64.41:80 -> 192.168.56.102:49278 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 5.42.64.41:80 -> 192.168.56.102:49278 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.102:49306 -> 87.240.132.67:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49306 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49307 -> 185.172.128.19:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.102:49307 -> 185.172.128.19:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.172.128.19:80 -> 192.168.56.102:49307 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.19:80 -> 192.168.56.102:49307 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.102:49321 -> 87.240.132.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 194.33.191.60:44675 -> 192.168.56.102:49290 2046056 ET MALWARE Redline Stealer Family Activity (Response) A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043233 ET INFO Microsoft net.tcp Connection Initialization Activity Potentially Bad Traffic
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2046045 ET MALWARE [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) A Network Trojan was detected
TCP 192.168.56.102:49332 -> 185.172.128.19:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 45.15.156.187:23929 -> 192.168.56.102:49334 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response A Network Trojan was detected
TCP 192.168.56.102:49324 -> 95.142.206.1:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.172.128.19:80 -> 192.168.56.102:49332 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.19:80 -> 192.168.56.102:49332 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.172.128.19:80 -> 192.168.56.102:49332 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.102:49328 -> 172.67.139.220:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
TCP 192.168.56.102:49328 -> 172.67.139.220:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49328 -> 172.67.139.220:443 2033214 ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) Potentially Bad Traffic
UDP 192.168.56.102:50447 -> 164.124.101.2:53 2035948 ET POLICY IP Check Domain (iplogger .org in DNS Lookup) Potential Corporate Privacy Violation
TCP 192.168.56.102:49291 -> 176.123.10.211:47430 2043233 ET INFO Microsoft net.tcp Connection Initialization Activity Potentially Bad Traffic
TCP 192.168.56.102:49291 -> 176.123.10.211:47430 2046045 ET MALWARE [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) A Network Trojan was detected
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2044303 ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity A suspicious filename was detected
UDP 192.168.56.102:53208 -> 8.8.8.8:53 2047702 ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup Misc activity
TCP 176.123.10.211:47430 -> 192.168.56.102:49291 2046056 ET MALWARE Redline Stealer Family Activity (Response) A Network Trojan was detected
TCP 192.168.56.102:49339 -> 104.21.63.180:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49341 -> 172.67.166.192:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2044302 ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49295 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 87.240.132.67:80 -> 192.168.56.102:49295 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2044305 ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49332 -> 185.172.128.19:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 45.15.156.187:23929 -> 192.168.56.102:49334 2046056 ET MALWARE Redline Stealer Family Activity (Response) A Network Trojan was detected
TCP 192.168.56.102:49332 -> 185.172.128.19:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.102:49332 -> 185.172.128.19:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.102:49338 -> 91.92.254.7:80 2011227 ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla)) Potentially Bad Traffic
TCP 192.168.56.102:49337 -> 173.231.16.77:80 2029622 ET POLICY External IP Lookup (ipify .org) Potential Corporate Privacy Violation
TCP 192.168.56.102:49337 -> 173.231.16.77:80 2011227 ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla)) Potentially Bad Traffic
TCP 192.168.56.102:49340 -> 5.42.64.35:80 2011227 ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla)) Potentially Bad Traffic
TCP 192.168.56.102:49340 -> 5.42.64.35:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 5.42.64.35:80 -> 192.168.56.102:49340 2014819 ET INFO Packed Executable Download Misc activity
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2044306 ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 5.42.64.35:80 -> 192.168.56.102:49340 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 5.42.64.35:80 -> 192.168.56.102:49340 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.102:49342 -> 172.67.138.35:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 172.67.138.35:80 -> 192.168.56.102:49342 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 172.67.138.35:80 -> 192.168.56.102:49342 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 172.67.138.35:80 -> 192.168.56.102:49342 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49278 -> 5.42.64.41:80 2044307 ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.102:49312 -> 34.117.59.81:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49312 -> 34.117.59.81:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49312 -> 34.117.59.81:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49311 -> 87.240.132.67:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 87.240.132.67:80 -> 192.168.56.102:49311 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49332 -> 185.172.128.19:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
UDP 192.168.56.102:62197 -> 8.8.8.8:53 2035466 ET INFO Observed Discord Domain in DNS Lookup (discordapp .com) Misc activity
TCP 192.168.56.102:49345 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49345 -> 162.159.135.233:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49345 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49348 -> 204.79.197.219:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49349 -> 20.150.79.68:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49354 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49354 -> 162.159.135.233:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49354 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49354 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49353 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49353 -> 162.159.135.233:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49353 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49359 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49359 -> 162.159.135.233:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49359 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49332 -> 185.172.128.19:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
UDP 192.168.56.102:59518 -> 172.253.56.127:19302 2033078 ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port) Misc activity
TCP 192.168.56.102:49350 -> 20.150.38.228:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49334 -> 45.15.156.187:23929 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.102:49364 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49366 -> 185.82.216.111:443 2048654 ET MALWARE Observed Glupteba CnC Domain (dumperstats .org in TLS SNI) Domain Observed Used for C2 Detected
UDP 192.168.56.102:53208 -> 164.124.101.2:53 2047702 ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup Misc activity
TCP 192.168.56.102:49344 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49344 -> 162.159.135.233:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49344 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49332 -> 185.172.128.19:80 2044623 ET MALWARE Amadey Bot Activity (POST) A Network Trojan was detected
TCP 192.168.56.102:49371 -> 185.82.216.111:443 2048654 ET MALWARE Observed Glupteba CnC Domain (dumperstats .org in TLS SNI) Domain Observed Used for C2 Detected
UDP 192.168.56.102:51010 -> 8.8.8.8:53 2033268 ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org) Potential Corporate Privacy Violation
TCP 192.168.56.102:49360 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49360 -> 162.159.135.233:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49360 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49377 -> 185.82.216.111:443 2048654 ET MALWARE Observed Glupteba CnC Domain (dumperstats .org in TLS SNI) Domain Observed Used for C2 Detected
TCP 192.168.56.102:49354 -> 162.159.135.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49176 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49175
172.67.75.163:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 92:b4:ed:98:67:d9:db:8a:1e:bd:0e:fe:7f:22:45:e9:79:b5:78:65
TLSv1
192.168.56.102:49201
104.21.38.114:443 		C=US, O=Let's Encrypt, CN=E1 CN=vdfgdfbfdbdfbdfgroup.sbs be:9c:16:40:0f:33:52:e2:62:c6:95:50:66:2d:56:52:bb:a2:ae:b3
TLSv1
192.168.56.102:49183
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49212
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49218
95.142.206.0:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24
TLSv1
192.168.56.102:49234
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49227
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49238
95.142.206.1:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24
TLSv1
192.168.56.102:49239
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49241
95.142.206.1:443 		None None None
TLSv1
192.168.56.102:49243
95.142.206.0:443 		None None None
TLSv1
192.168.56.102:49247
95.142.206.2:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24
TLSv1
192.168.56.102:49254
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49256
95.142.206.3:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24
TLSv1
192.168.56.102:49255
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49257
95.142.206.3:443 		None None None
TLSv1
192.168.56.102:49236
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49267
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49242
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49271
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49251
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49270
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49280
172.67.139.220:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=2ip.ua df:8e:38:7b:a5:b7:63:5f:01:77:75:f0:d6:4a:08:30:fa:63:46:8f
TLSv1
192.168.56.102:49279
172.67.75.163:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 92:b4:ed:98:67:d9:db:8a:1e:bd:0e:fe:7f:22:45:e9:79:b5:78:65
TLSv1
192.168.56.102:49289
172.67.132.113:443 		C=US, O=Let's Encrypt, CN=E1 CN=iplogger.org 1e:76:b5:78:be:35:ec:fb:3f:26:d0:5f:1c:2a:2d:33:0e:51:6f:7e
TLSv1
192.168.56.102:49281
172.67.75.163:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 92:b4:ed:98:67:d9:db:8a:1e:bd:0e:fe:7f:22:45:e9:79:b5:78:65
TLSv1
192.168.56.102:49284
104.21.63.150:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=iplis.ru 04:2b:ef:ab:43:60:60:33:69:03:f3:51:37:11:c8:29:26:89:a4:93
TLSv1
192.168.56.102:49299
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49320
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49305
144.76.136.153:443 		C=US, O=Let's Encrypt, CN=R3 CN=transfer.sh eb:93:df:77:44:ea:3e:bd:4e:9e:67:5e:66:84:77:b7:96:ce:0f:82
TLSv1
192.168.56.102:49314
104.26.5.15:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5
TLSv1
192.168.56.102:49321
87.240.132.67:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 6b:39:d3:5a:fa:5a:ee:80:1a:d7:f6:77:30:52:cf:2b:52:a1:82:09
TLSv1
192.168.56.102:49324
95.142.206.1:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.userapi.com bc:a9:84:5f:86:90:b1:02:ba:2d:66:e8:e5:46:c1:57:e9:c0:cc:24
TLSv1
192.168.56.102:49328
172.67.139.220:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=2ip.ua df:8e:38:7b:a5:b7:63:5f:01:77:75:f0:d6:4a:08:30:fa:63:46:8f
TLSv1
192.168.56.102:49339
104.21.63.180:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=mrproper.org 14:ea:69:cf:02:60:60:31:ca:c1:73:e0:08:32:fb:f0:1c:3b:a4:6e
TLSv1
192.168.56.102:49341
172.67.166.192:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=domen414.com 8d:05:bd:c1:10:73:1e:9b:6c:63:b2:d4:99:bf:3f:a0:6a:76:8e:3c
TLSv1
192.168.56.102:49348
204.79.197.219:443 		C=US, O=Microsoft Corporation, CN=Microsoft Azure RSA TLS Issuing CA 04 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, CN=msdl.microsoft.com 1e:ad:90:78:48:f7:11:32:f5:23:1c:08:ec:53:07:87:4a:98:82:8e
TLSv1
192.168.56.102:49349
20.150.79.68:443 		C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01 CN=*.blob.core.windows.net 6e:0d:1b:21:93:e6:c6:eb:18:68:57:6a:7e:85:c2:b6:90:ce:6b:9d
TLS 1.3
192.168.56.102:49357
172.104.165.191:10343 		None None None
TLSv1
192.168.56.102:49350
20.150.38.228:443 		C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01 CN=*.blob.core.windows.net 6e:0d:1b:21:93:e6:c6:eb:18:68:57:6a:7e:85:c2:b6:90:ce:6b:9d
TLS 1.3
192.168.56.102:49364
162.159.135.233:443 		None None None
TLS 1.3
192.168.56.102:49366
185.82.216.111:443 		None None None
TLS 1.3
192.168.56.102:49368
172.67.212.188:443 		None None None
TLS 1.3
192.168.56.102:49371
185.82.216.111:443 		None None None
TLS 1.3
192.168.56.102:49377
185.82.216.111:443 		None None None

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features Connection to IP address suspicious_request GET http://195.20.16.45/api/tracemap.php
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://195.20.16.45/api/firegate.php
suspicious_features Connection to IP address suspicious_request HEAD http://109.107.182.3/dote/film.exe
suspicious_features Connection to IP address suspicious_request HEAD http://5.42.64.35/timeSync.exe
suspicious_features Connection to IP address suspicious_request HEAD http://194.33.191.102/autorun.exe
suspicious_features Connection to IP address suspicious_request GET http://5.42.64.35/timeSync.exe
suspicious_features Connection to IP address suspicious_request GET http://194.33.191.102/autorun.exe
suspicious_features Connection to IP address suspicious_request GET http://109.107.182.3/dote/film.exe
suspicious_features Connection to IP address suspicious_request GET http://176.113.115.84:8080/4.php
suspicious_features Connection to IP address suspicious_request GET http://45.15.156.229/api/tracemap.php
suspicious_features Connection to IP address suspicious_request GET http://77.105.147.130/api/tracemap.php
suspicious_features Connection to IP address suspicious_request GET http://91.92.254.7/scripts/plus.php?substr=one&s=two
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://5.42.64.41/40d570f44e84a454.php
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://5.42.64.41/2a7743b8bbd7e4a7/sqlite3.dll
suspicious_features Connection to IP address suspicious_request GET http://91.92.242.146/advdlc.php
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://45.15.156.229/api/firegate.php
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://5.42.64.41/2a7743b8bbd7e4a7/freebl3.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://5.42.64.41/2a7743b8bbd7e4a7/mozglue.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://5.42.64.41/2a7743b8bbd7e4a7/msvcp140.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://5.42.64.41/2a7743b8bbd7e4a7/nss3.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://5.42.64.41/2a7743b8bbd7e4a7/softokn3.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://5.42.64.41/2a7743b8bbd7e4a7/vcruntime140.dll
suspicious_features Connection to IP address suspicious_request HEAD http://185.172.128.19/build2.exe
suspicious_features Connection to IP address suspicious_request GET http://185.172.128.19/build2.exe
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://185.172.128.19/ghsdh39s/index.php
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.172.128.19/InstallSetup8.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.172.128.19/toolspub2.exe
suspicious_features Connection to IP address suspicious_request GET http://91.92.254.7/scripts/plus.php?ip=175.208.134.152&substr=eight&s=ab
suspicious_features Connection to IP address suspicious_request GET http://5.42.64.35/syncUpd.exe
suspicious_features GET method with no useragent header suspicious_request GET http://still.topteamlife.com/order/tuc3.exe
suspicious_features GET method with no useragent header suspicious_request GET https://mrproper.org/e0cbefcb1af40c7d4aff4aca26621a98.exe
suspicious_features GET method with no useragent header suspicious_request GET https://domen414.com/70e35a78e758263ac94805845a3b1aa6/e0cbefcb1af40c7d4aff4aca26621a98.exe
request GET http://195.20.16.45/api/tracemap.php
request POST http://195.20.16.45/api/firegate.php
request HEAD http://109.107.182.3/dote/film.exe
request HEAD http://5.42.64.35/timeSync.exe
request HEAD http://194.33.191.102/autorun.exe
request HEAD http://zen.topteamlife.com/order/adobe.exe
request GET http://5.42.64.35/timeSync.exe
request GET http://194.33.191.102/autorun.exe
request GET http://109.107.182.3/dote/film.exe
request GET http://zen.topteamlife.com/order/adobe.exe
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request GET http://176.113.115.84:8080/4.php
request GET http://45.15.156.229/api/tracemap.php
request GET http://77.105.147.130/api/tracemap.php
request GET http://91.92.254.7/scripts/plus.php?substr=one&s=two
request POST http://5.42.64.41/40d570f44e84a454.php
request GET http://5.42.64.41/2a7743b8bbd7e4a7/sqlite3.dll
request GET http://91.92.242.146/advdlc.php
request POST http://45.15.156.229/api/firegate.php
request GET http://5.42.64.41/2a7743b8bbd7e4a7/freebl3.dll
request GET http://5.42.64.41/2a7743b8bbd7e4a7/mozglue.dll
request GET http://5.42.64.41/2a7743b8bbd7e4a7/msvcp140.dll
request GET http://5.42.64.41/2a7743b8bbd7e4a7/nss3.dll
request GET http://5.42.64.41/2a7743b8bbd7e4a7/softokn3.dll
request GET http://5.42.64.41/2a7743b8bbd7e4a7/vcruntime140.dll
request HEAD http://185.172.128.19/build2.exe
request GET http://185.172.128.19/build2.exe
request GET http://zexeq.com/test2/get.php?pid=CD20CF071BA7C05D5F5E6CAF42496E78&first=true
request POST http://185.172.128.19/ghsdh39s/index.php
request GET http://185.172.128.19/InstallSetup8.exe
request GET http://185.172.128.19/toolspub2.exe
request GET http://api.ipify.org/?format=qwc
request GET http://91.92.254.7/scripts/plus.php?ip=175.208.134.152&substr=eight&s=ab
request GET http://5.42.64.35/syncUpd.exe
request GET http://still.topteamlife.com/order/tuc3.exe
request GET https://api.myip.com/
request GET https://vk.com/doc746114504_647280747?hash=cvDFKP5q0CQEjBCbeoeHvPNrWE0xbMxZEmrkIeNKcET&dl=G42DMMJRGQ2TANA:1661413520:uZNj68vRUvQaydRD8wpAK8zluN0I7otw5AHbA1ZlN9T&api=1&no_preview=1
request GET https://vdfgdfbfdbdfbdfgroup.sbs/setup294.exe
request GET https://vk.com/doc418490229_669446210?hash=BZ9b8Xtsn5Z8zZkSRBEdwF1W7jzCAT8GJBVEicdXS6L&dl=eA4o75IiHafzbkgdBC8nz7TmLS7uMpwJRsfDOcAnrqD&api=1&no_preview=1
request GET https://sun6-20.userapi.com/c909518/u418490229/docs/d9/5e0d43d301bf/BotClient_WWW.bmp?extra=K4Bc2tEiqrN1_FErEK6iFLRLCk66bRPdEIg_NBxdAdEKjqBoH80jch2EATGL5aoZyV0ONQLUKsLO3xWLSK_Dqja2G9_4sN84DzErWXT52ONKiCO1heZTXPBUC44s8QXP0LO8LqIDy-hnCQNaAQ
request GET https://vk.com/doc791620691_663065029?hash=Efubo9FQtw3Bdj42XJVcJwymfIH3PazMKz8g5wJ0dZX&dl=G44TCNRSGA3DSMI:1682787066:QgrgzF33wDt9bwmmOgWCYTv61J7HwhLVZOXGaEdWiKP&api=1&no_preview=1#test
request GET https://vk.com/doc418490229_669431693?hash=ZJOgiMvcEt67O8ZgIQTPetDJ5TJVWChVj8OP8l7poMo&dl=l8kZtnWtBZ88utyX5ok8hBf0AvLsgVspFPCyrexPZcc&api=1&no_preview=1
request GET https://vk.com/doc418490229_669446288?hash=QFSGrfzK1NpHqTbP7orCKrs6ivw74w9NbUeXT4cVAJ8&dl=scYinNdJ0msbOFLMzJwjxC4aj2UhN7mrdx5bV4i4j1T&api=1&no_preview=1#ww11
request GET https://sun6-21.userapi.com/c235031/u418490229/docs/d20/3537096df5d0/sdfj34dv.bmp?extra=-wfwzf8mggLUbLw-tDmqqwImNK4Ftwq957DguR_ZMse6BpyI5-rPV6hbhzSG2NwFqlvPZVAflEjl79RMCYIB1POUVIydbhkLkUQ6dr7fGPtpI4ydIkrZ_U79xWEv5Xk1NueG2w6-DwHLIn3DeQ
request GET https://sun6-21.userapi.com/c235131/u418490229/docs/d58/5c0b9e6bfbb0/WWW11_32.bmp?extra=p1oBag1URwphK9fm5j9Jq7YOyeLeYwoTlNXxy-wy5IUdSKAq5VMvZiEdPlIcLVQn8hIZLuRKmCNHWREB57Cexdl8j2qkqFJbyxi0QG7Y6MixRJdPAmBV-XZVChIxLC6qYD1souE3k5cCPKfsSA
request GET https://vk.com/doc418490229_669587219?hash=k77BufzomwcBsW3hPhpz2FEdZyz0nCp5svZgzAhWzX8&dl=GGiKhtZZMwWTM9cPInAZ3ZvsfBC6QLOXzRT6d5aaZ9w&api=1&no_preview=1#xin
request GET https://sun6-20.userapi.com/c909518/u418490229/docs/d24/8a4941081cf4/xinxin.bmp?extra=MYqii3RlgEdZmDiKshYG4cBuSFt-4I8No-BNWthaqggg8UIboNVqio9EQKvqnDf0IwnpwaqiXtjrufIKCgD54naDTYqQKF7M8ZxG9jgvbLoxaZAboWXtmkjqHzXUIPaO1cX_tjq7DjsuoOVT1Q
request GET https://vk.com/doc418490229_669575445?hash=vrqpipzq5gbIf9ZzlH6eoLxWYY2GVWTdCZyZfEBDU6o&dl=vAwShLyLIswxvXKtspyKZMxVY7MZYQOz2xin63S1bXz&api=1&no_preview=1#1
request GET https://sun6-22.userapi.com/c909218/u418490229/docs/d43/33a4d3a867cd/crypted.bmp?extra=7n1p5WXd_XA-frypoGw5NGGcH5ozP0-5aPXvPSGNWJnmWcOQyKm3XmG1A4H78VWMkEfRaxwAsjW6UtarY0Cdk2S00-TlIzTDgoGExJ2V7IUXR3iB7Oq8RmopiHVQh1hv_C_EWlY_STkxOJE2iw
request GET https://vk.com/doc418490229_669576362?hash=2TYLSTWS5p3PwhTNSYwsx2GpGiyOpl6IB17qzZDTTnz&dl=R4angaiywIuZ3iAh5RqnVQxC3TmVWJZOPSt2s7ZkU94&api=1&no_preview=1
request POST http://195.20.16.45/api/firegate.php
request POST http://5.42.64.41/40d570f44e84a454.php
request POST http://45.15.156.229/api/firegate.php
request POST http://185.172.128.19/ghsdh39s/index.php
ip 172.104.165.191
ip 176.113.115.84
ip 176.123.10.211
ip 194.33.191.60
ip 195.20.16.45
ip 45.15.156.187
ip 172.253.56.127
domain iplis.ru description Russian Federation domain TLD
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74062000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x737d3000
process_handle: 0xffffffff
1 0 0
domain api.ipify.org
domain ipinfo.io
file C:\Users\test22\AppData\Local\Temp\7zE4A860151\setup.exe
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeRestorePrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0
description Escalate priviledges rule Escalate_priviledges
description PWS Memory rule Generic_PWS_Memory_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Run a KeyLogger rule KeyLogger
domain stun1.l.google.com
domain 91920b82-9195-455d-9a5f-23f11e556e53.uuid.dumperstats.org
host 109.107.182.3
host 176.113.115.84
host 176.123.10.211
host 185.172.128.19
host 194.33.191.102
host 194.33.191.60
host 195.20.16.45
host 45.15.156.229
host 5.42.64.35
host 5.42.64.41
host 77.105.147.130
host 45.15.156.187
host 91.92.254.7
host 91.92.242.146
dead_host 176.113.115.84:80
dead_host 192.168.56.102:49189
dead_host 91.222.236.186:443