Submissions - ZeroBOX

Submissions

Date range button:

First seen:

Last seen:

No	Date	Request	Urls	Hosts	IDS	Rule	Score	Zero	VT	Player	Etc
1	2023-03-12 11:12	build.exe 918b9b4d245035565fd159b7202ed708 Loki_b Loki_m Gen1 Suspicious_Script_Bin Generic Malware UPX Malicious Library Malicious Packer DGA Socket ScreenShot DNS Internet API PWS[m] Http API Code injection AntiDebug AntiVM OS Processor Check PE32 PE File DLL Browser Info Stealer Malware download FTP Client Info Stealer Dridex VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency Microsoft Telegram AutoRuns MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Collect installed applications suspicious process AppData folder malicious URLs suspicious TLD sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser Email ComputerName Remote Code Execution DNS Software	6 Keyword trend analysis	11 Info t.me(149.154.167.99) - mailcious uaery.top(210.182.29.70) - malware api.2ip.ua(162.0.217.254) steamcommunity.com(104.76.78.101) - mailcious zexeq.com(37.34.248.24) - malware 149.154.167.99 - mailcious 211.119.84.112 - malware 211.59.14.90 - malware 162.0.217.254 116.202.6.47 104.76.78.101 - mailcious	17 Info ET POLICY External IP Address Lookup DNS Query (2ip .ua) ET DNS Query to a .top domain - Likely Hostile ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI) SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET INFO Observed Telegram Domain (t .me in TLS SNI) ET INFO TLS Handshake Failure ET INFO Dotted Quad Host ZIP Request ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer) ET MALWARE Potential Dridex.Maldoc Minimal Executable Request ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016 ET MALWARE Win32/Vodkagats Loader Requesting Payload ET INFO HTTP Request to a .top domain ET POLICY PE EXE or DLL Windows file download HTTP ET HUNTING Possible EXE Download From Suspicious TLD ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key ET MALWARE Win32/Filecoder.STOP Variant Public Key Download	1	20.4	M	27	ZeroCERT

First
1
Last
Total : 1cnts