popup

Cyber Threat Trends

  1. Day Week

Gemelli flickerflypro flickerfly

Summary: 2025/05/08 05:41

First reported date: 2016/12/20
Inquiry period : 2025/04/08 05:41 ~ 2025/05/08 05:41 (1 months), 1 search results

전 기간대비 동일한 트렌드를 보이고 있습니다.
기관 및 기업 Africa 도 새롭게 확인됩니다.
기타 African Firms Double Trumps 신규 키워드도 확인됩니다.

 * 최근 뉴스기사 Top3:
    ㆍ 2025/04/17 African PE Firms Double Fundraising Before Trump’s Trade War

Trend graph by period


Related keyword cloud
Top 100
# Trend Count Comparison
1Africa 1 ▲ new
2African 1 ▲ new
3PE 1 - 0 (0%)
4Firms 1 ▲ new
5Double 1 ▲ new
6Trumps 1 ▲ new
Special keyword group
Top 5
Malware Type
Malware Type

This is the type of malware that is becoming an issue.

No data.

Attacker & Actors
Attacker & Actors

The status of the attacker or attack group being issued.

No data.

Attack technique
Technique

This is an attack technique that is becoming an issue.

No data.

Country & Company
Country & Company

This is a country or company that is an issue.

Keyword Average Label
Africa
1 (100%)
Threat info
Last 5

SNS

(Total : 0)

No data.

News

(Total : 1)
  Total keyword

Africa

No Title Date
1African PE Firms Double Fundraising Before Trump’s Trade War - Bloomberg Technology2025.04.17

Additional information

No Request Hash(md5) Report No Date
1 av.exe
Gen1 Generic Malware PhysicalDrive Downloader Malicious Library WinRAR UPX Malicious Packer Antivirus Confuser .NET Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API pe 		c5ca67c0bbc8b248cea971121e96e93d555882024.12.18
2 DocTromTinNhan.exe
Gen1 Generic Malware Downloader Malicious Library ASPack UPX Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P Anti_VM AntiDebug AntiVM PE 		25dd80dc8b9c5e1afc5afb8c47253681551892024.11.03
3 QuizPokemon.exe
NSIS Generic Malware Downloader Malicious Library UPX Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM PE 		814ff8b10d8641b03fcf1e9efc1005bf510262024.06.18
4 OfferedBuilt.exe
NSIS Generic Malware Downloader Malicious Library UPX Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM PE 		00614852dbe5c98d84c4501702d04e93509162024.06.14
5 FrameworkSurvivor.exe
NSIS Generic Malware Downloader Malicious Library UPX Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM PE 		69f6dcdb3d87392f300e9052de99d7ce504082024.06.04
View only the last 5
Level Description
danger File has been identified by 40 AntiVirus engines on VirusTotal as malicious
danger Disables Windows Security features
watch Attempts to modify UAC prompt behavior
watch Attempts to stop active services
watch Created a process named as a common system process
watch Creates an Alternate Data Stream (ADS)
watch Creates known SpyNet files
watch Expresses interest in specific running processes
watch Powershell script adds registry entries
watch Resumed a suspended thread in a remote process potentially indicative of process injection
watch The process powershell.exe wrote an executable file to disk
watch Uses Sysinternals tools in order to add additional command line functionality
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a shortcut to an executable file
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice Creates hidden or system file
notice Drops a binary and executes it
notice Drops an executable to the user AppData folder
notice Executes one or more WMI queries
notice Executes one or more WMI queries which can be used to identify virtual machines
notice Terminates another process
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Collects information to fingerprint the system (MachineGuid
info Command line console output was observed
info One or more processes crashed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The file contains an unknown PE resource name possibly indicative of a packer
info This executable has a PDB path
info Tries to locate where the browsers are installed
info Uses Windows APIs to generate a cryptographic key
No data
No URL CC ASN Co Reporter Date
1https://154.197.69.165/System.exe
pe 		HK HKASLINE LIMITEDabus3reports2024.11.03
2http://176.111.174.140/zcc.exe
pe RedLineStealer 		abus3reports2024.11.03
Beta Service, If you select keyword, you can check detailed information.