popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

fb34_gate2.rar

KeyLogger PWS Escalate priviledges AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 12, 2024, 3:13 p.m. June 12, 2024, 3:15 p.m.
Size 8.9MB
Type RAR archive data, v5
MD5 a229ecb9458451d9691f269857aec75d
SHA256 79fcb3c4f7efe68da1732cae7a1d4649534a08911e9a6803f69e13a8d6e348c0
CRC32 B1A5BB06
ssdeep 196608:pGftfNqm34GVcQTBq8NDHfjiKBgCa8mX8vjW9H+/J87S:pG9NL3dcQE8Nt6iv1O7S
Yara None matched

Name Response Post-Analysis Lookup
lop.foxesjoy.com
A 172.67.159.232
A 104.21.66.124
172.67.159.232
bitbucket.org
A 104.192.141.1
104.192.141.1
raw.githubusercontent.com
A 185.199.109.133
A 185.199.111.133
A 185.199.110.133
A 185.199.108.133
185.199.108.133
vk.com
A 87.240.129.133
A 87.240.132.72
A 87.240.132.78
A 87.240.137.164
A 93.186.225.194
A 87.240.132.67
87.240.132.78
iplogger.org
A 104.21.4.208
A 172.67.132.113
104.21.4.208
apps.identrust.com
A 121.254.136.9
CNAME a1952.dscq.akamai.net
CNAME identrust.edgesuite.net
A 121.254.136.18
A 182.162.106.33
A 182.162.106.144
23.210.247.48
ipinfo.io
A 34.117.186.192
34.117.186.192
steamcommunity.com
A 104.71.154.102
104.106.57.101
cdn-download.avgbrowser.com
CNAME a333.dscd.akamai.net
A 23.33.184.234
CNAME cdn-prod-download.browser.akamaized.net
A 23.33.184.247
23.1.236.116
t.me
A 149.154.167.99
149.154.167.99
pool.hashvault.pro
A 125.253.92.50
A 131.153.76.130
125.253.92.50
api.myip.com
A 172.67.75.163
A 104.26.9.59
A 104.26.8.59
172.67.75.163
db-ip.com
A 104.26.5.15
A 104.26.4.15
A 172.67.75.166
104.26.4.15
api64.ipify.org
A 173.231.16.77
A 104.237.62.213
104.237.62.213
cdn.discordapp.com
A 162.159.135.233
A 162.159.134.233
A 162.159.129.233
A 162.159.130.233
A 162.159.133.233
162.159.135.233
IP Address Status Action
104.192.141.1 Active Moloch
104.21.4.208 Active Moloch
104.21.66.124 Active Moloch
104.237.62.213 Active Moloch
104.26.5.15 Active Moloch
104.26.9.59 Active Moloch
104.71.154.102 Active Moloch
121.254.136.9 Active Moloch
125.253.92.50 Active Moloch
147.45.47.126 Active Moloch
149.154.167.99 Active Moloch
162.159.130.233 Active Moloch
164.124.101.2 Active Moloch
182.162.106.33 Active Moloch
185.199.111.133 Active Moloch
23.33.184.247 Active Moloch
34.117.186.192 Active Moloch
5.42.66.10 Active Moloch
5.42.99.177 Active Moloch
77.91.77.80 Active Moloch
87.240.132.72 Active Moloch
88.218.93.76 Active Moloch
95.217.135.112 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49184 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49184 -> 34.117.186.192:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49184 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49182 -> 104.237.62.213:443 2047703 ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI Misc activity
TCP 192.168.56.102:49182 -> 104.237.62.213:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49182 -> 104.237.62.213:443 2047703 ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI Misc activity
TCP 104.237.62.213:443 -> 192.168.56.102:49183 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49199 -> 185.199.111.133:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49195 -> 185.199.111.133:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.199.111.133:80 -> 192.168.56.102:49195 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49200 -> 185.199.111.133:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49194 -> 185.199.111.133:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49194 -> 185.199.111.133:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49191 -> 104.192.141.1:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49191 -> 104.192.141.1:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.199.111.133:80 -> 192.168.56.102:49197 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 104.21.66.124:80 -> 192.168.56.102:49211 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49203 -> 104.21.66.124:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 104.21.66.124:80 -> 192.168.56.102:49203 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49192 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49192 -> 87.240.132.72:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49213 -> 104.192.141.1:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49212 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49212 -> 87.240.132.72:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49193 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 104.192.141.1:443 -> 192.168.56.102:49224 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49193 -> 87.240.132.72:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49224 -> 104.192.141.1:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49225 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49225 -> 87.240.132.72:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49215 -> 162.159.130.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49215 -> 162.159.130.233:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49215 -> 162.159.130.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49219 -> 104.21.66.124:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49207 -> 162.159.130.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49207 -> 162.159.130.233:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49207 -> 162.159.130.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49208 -> 162.159.130.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49208 -> 162.159.130.233:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49208 -> 162.159.130.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49216 -> 162.159.130.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 192.168.56.102:49216 -> 162.159.130.233:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49216 -> 162.159.130.233:443 2035464 ET INFO Observed Discord Domain (discordapp .com in TLS SNI) Misc activity
TCP 104.192.141.1:443 -> 192.168.56.102:49222 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49222 -> 104.192.141.1:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 104.192.141.1:443 -> 192.168.56.102:49227 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 5.42.66.10:80 -> 192.168.56.102:49190 2400000 ET DROP Spamhaus DROP Listed Traffic Inbound group 1 Misc Attack
TCP 192.168.56.102:49180 -> 104.26.9.59:443 2042969 ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49180 -> 104.26.9.59:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.102:56630 -> 164.124.101.2:53 2047702 ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup Misc activity
TCP 87.240.132.72:80 -> 192.168.56.102:49236 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49205 -> 104.21.66.124:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 104.21.66.124:80 -> 192.168.56.102:49205 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49204 -> 104.192.141.1:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49204 -> 104.192.141.1:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49186 -> 104.26.5.15:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49189 -> 77.91.77.80:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 88.218.93.76:80 -> 192.168.56.102:49188 2049228 ET HUNTING Redirect to Discord Attachment Download Misc activity
TCP 192.168.56.102:49241 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 88.218.93.76:80 -> 192.168.56.102:49188 2049228 ET HUNTING Redirect to Discord Attachment Download Misc activity
TCP 192.168.56.102:49206 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49206 -> 87.240.132.72:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49233 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49189 -> 77.91.77.80:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 77.91.77.80:80 -> 192.168.56.102:49189 2014819 ET INFO Packed Executable Download Misc activity
TCP 192.168.56.102:49237 -> 87.240.132.72:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49244 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49244 -> 87.240.132.72:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.102:60523 -> 164.124.101.2:53 2035466 ET INFO Observed Discord Domain in DNS Lookup (discordapp .com) Misc activity
TCP 192.168.56.102:49240 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49240 -> 87.240.132.72:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49187 -> 5.42.66.10:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 77.91.77.80:80 -> 192.168.56.102:49189 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 77.91.77.80:80 -> 192.168.56.102:49189 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.102:49220 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49220 -> 87.240.132.72:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49226 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49228 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49231 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49231 -> 87.240.132.72:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49239 -> 87.240.132.72:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49246 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49247 -> 87.240.132.72:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49249 -> 87.240.132.72:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49187 -> 5.42.66.10:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.102:49223 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49223 -> 87.240.132.72:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 5.42.66.10:80 -> 192.168.56.102:49190 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 5.42.66.10:80 -> 192.168.56.102:49190 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 5.42.66.10:80 -> 192.168.56.102:49190 2014520 ET INFO EXE - Served Attached HTTP Misc activity
TCP 5.42.66.10:80 -> 192.168.56.102:49187 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 5.42.66.10:80 -> 192.168.56.102:49187 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.102:49234 -> 87.240.132.72:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 87.240.132.72:80 -> 192.168.56.102:49234 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49196 -> 23.33.184.247:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49196 -> 23.33.184.247:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49251 -> 23.33.184.247:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49251 -> 23.33.184.247:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49255 -> 23.33.184.247:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 23.33.184.247:443 -> 192.168.56.102:49257 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49256 -> 23.33.184.247:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.102:57988 -> 164.124.101.2:53 2035948 ET POLICY IP Check Domain (iplogger .org in DNS Lookup) Potential Corporate Privacy Violation
TCP 149.154.167.99:443 -> 192.168.56.102:49263 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.102:49262 -> 104.21.4.208:443 2035949 ET POLICY IP Check Domain (iplogger .org in TLS SNI) Potential Corporate Privacy Violation
TCP 192.168.56.102:49262 -> 104.21.4.208:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 95.217.135.112:443 -> 192.168.56.102:49269 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
UDP 192.168.56.102:55774 -> 164.124.101.2:53 2036289 ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) Crypto Currency Mining Activity Detected
TCP 192.168.56.102:49260 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.102:49260 -> 149.154.167.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49260 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 147.45.47.126:58709 -> 192.168.56.102:49272 2400022 ET DROP Spamhaus DROP Listed Traffic Inbound group 23 Misc Attack
TCP 192.168.56.102:49272 -> 147.45.47.126:58709 2049060 ET MALWARE RisePro TCP Heartbeat Packet A Network Trojan was detected
TCP 147.45.47.126:58709 -> 192.168.56.102:49272 2046266 ET MALWARE [ANY.RUN] RisePro TCP (Token) A Network Trojan was detected
TCP 192.168.56.102:49242 -> 87.240.132.72:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49242 -> 87.240.132.72:80 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49245 -> 87.240.132.72:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49250 -> 87.240.132.72:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49253 -> 23.33.184.247:80 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode
TCP 192.168.56.102:49261 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.102:49261 -> 149.154.167.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49261 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.102:49266 -> 104.71.154.102:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49260 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.102:49182 -> 104.237.62.213:443 2047703 ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI Misc activity
TCP 23.33.184.247:443 -> 192.168.56.102:49258 2260001 SURICATA Applayer Wrong direction first Data Generic Protocol Command Decode

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49219
104.21.66.124:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=foxesjoy.com 98:61:17:75:9f:9b:34:ec:5e:dd:5b:36:49:5e:1b:7d:2d:22:18:22
TLSv1
192.168.56.102:49180
104.26.9.59:443 		C=US, O=Let's Encrypt, CN=R3 CN=myip.com 87:d2:90:92:b6:6a:56:3c:25:f1:ae:56:52:d9:2b:ac:16:44:bb:bc
TLSv1
192.168.56.102:49186
104.26.5.15:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=db-ip.com 1f:af:15:cd:f8:f8:ee:30:f9:6e:6e:54:bc:9a:a7:c7:77:70:6d:25
TLSv1
192.168.56.102:49237
87.240.132.72:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd
TLSv1
192.168.56.102:49239
87.240.132.72:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd
TLSv1
192.168.56.102:49247
87.240.132.72:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd
TLSv1
192.168.56.102:49249
87.240.132.72:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd
TLSv1
192.168.56.102:49262
104.21.4.208:443 		C=US, O=Let's Encrypt, CN=E1 CN=iplogger.org d8:ec:fc:e7:1f:4d:3a:fd:89:ef:f1:f1:1a:93:1b:94:db:b5:87:ec
TLS 1.3
192.168.56.102:49271
125.253.92.50:443 		None None None
TLSv1
192.168.56.102:49245
87.240.132.72:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd
TLSv1
192.168.56.102:49250
87.240.132.72:443 		C=BE, O=GlobalSign nv-sa, CN=GlobalSign ECC OV SSL CA 2018 C=RU, ST=Saint Petersburg, L=Saint Petersburg, O=V Kontakte LLC, CN=*.vk.com 65:c4:6f:80:24:02:e8:bf:a9:67:89:c3:4c:f8:46:77:d0:3b:df:fd
TLSv1
192.168.56.102:49266
104.71.154.102:443 		C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Extended Validation Server CA unknown=US, unknown=Washington, unknown=Private Organization, serialNumber=602 290 773, C=US, ST=Washington, L=Bellevue, O=Valve Corp, CN=store.steampowered.com 10:20:2b:ee:30:69:cc:b6:ac:5e:47:04:71:ca:b0:75:78:51:58:f5

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features Connection to IP address suspicious_request GET http://5.42.99.177/api/crazyfish.php
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://5.42.99.177/api/twofish.php
suspicious_features Connection to IP address suspicious_request HEAD http://5.42.66.10/download/123p.exe
suspicious_features Connection to IP address suspicious_request HEAD http://88.218.93.76/d/385135
suspicious_features Connection to IP address suspicious_request HEAD http://77.91.77.80/rome/kenzo.exe
suspicious_features Connection to IP address suspicious_request HEAD http://5.42.66.10/download/th/space.php
suspicious_features Connection to IP address suspicious_request GET http://77.91.77.80/rome/kenzo.exe
suspicious_features Connection to IP address suspicious_request GET http://88.218.93.76/d/385135
suspicious_features Connection to IP address suspicious_request GET http://5.42.66.10/download/th/space.php
suspicious_features Connection to IP address suspicious_request GET http://5.42.66.10/download/123p.exe
suspicious_features GET method with no useragent header suspicious_request GET https://steamcommunity.com/profiles/76561199698764354
request GET http://5.42.99.177/api/crazyfish.php
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request POST http://5.42.99.177/api/twofish.php
request HEAD http://5.42.66.10/download/123p.exe
request HEAD http://88.218.93.76/d/385135
request HEAD http://77.91.77.80/rome/kenzo.exe
request HEAD http://5.42.66.10/download/th/space.php
request GET http://77.91.77.80/rome/kenzo.exe
request GET http://88.218.93.76/d/385135
request GET http://5.42.66.10/download/th/space.php
request GET http://5.42.66.10/download/123p.exe
request GET https://db-ip.com/demo/home.php?s=
request GET https://lop.foxesjoy.com/ssl/crt.exe
request GET https://steamcommunity.com/profiles/76561199698764354
request POST http://5.42.99.177/api/twofish.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2188
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74002000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2188
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x737e3000
process_handle: 0xffffffff
1 0 0
domain ipinfo.io
file C:\Users\test22\AppData\Local\Temp\7zEC889A0D5\msvcp140.dll
file C:\Users\test22\AppData\Local\Temp\7zEC889A0D5\concrt140.dll
file C:\Users\test22\AppData\Local\Temp\7zEC889A0D5\file.exe
file C:\Users\test22\AppData\Local\Temp\7zEC889A0D5\amdhip64.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeRestorePrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0
description Escalate priviledges rule Escalate_priviledges
description PWS Memory rule Generic_PWS_Memory_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Run a KeyLogger rule KeyLogger
host 147.45.47.126
host 5.42.66.10
host 5.42.99.177
host 77.91.77.80
host 88.218.93.76
host 95.217.135.112