Submissions - ZeroBOX

Submissions

Date range button:

First seen:

Last seen:

No	Date	Request	Urls	Hosts	IDS	Rule	Score	Zero	VT	Player	Etc
1	2023-12-12 07:53	ama.exe 294593fcb93a6d6694c9670e86e649bf Amadey UPX Malicious Library .NET framework(MSIL) PWS AntiDebug AntiVM PE32 PE File JPEG Format DLL PE64 OS Processor Check .NET EXE Browser Info Stealer Malware download Amadey FTP Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency Buffer PE AutoRuns MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files RWX flags setting unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder sandbox evasion WriteConsoleW installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software crashed Downloader	4 Keyword trend analysis	5	9 Info ET INFO Executable Download from dotted-quad Host ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile ET POLICY PE EXE or DLL Windows file download HTTP ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 ET INFO Dotted Quad Host DLL Request ET MALWARE Amadey Bot Activity (POST) M1 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	1	18.6	M		ZeroCERT

First
1
Last
Total : 1cnts