Submissions - ZeroBOX

Submissions

Date range button:

First seen:

Last seen:

No	Date	Request	Urls	Hosts	IDS	Rule	Score	Zero	VT	Player	Etc
1	2021-11-15 14:52	prox.exe 0ed76cd7cb14cc30d04802a750bcad22 UPX Malicious Library KeyLogger ScreenShot Escalate priviledges AntiDebug AntiVM PE File OS Processor Check PE32 Browser Info Stealer Emotet Malware download FTP Client Info Stealer VirusTotal Malware powershell Telegram Buffer PE AutoRuns Code Injection Malicious Traffic Check memory buffers extracted WMI Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check Zeus Windows Java Browser ComputerName Trojan DNS Software keylogger	2 Keyword trend analysis	3	11 Info ET INFO Executable Download from dotted-quad Host ET MALWARE Trojan Generic - POST To gate.php with no referer ET MALWARE Trojan Generic - POST To gate.php with no accept headers ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad ET MALWARE Win32/Spy.Agent.QAQ Variant CnC Activity ET POLICY PE EXE or DLL Windows file download HTTP ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response ET INFO TLS Handshake Failure ET HUNTING Telegram API Domain in DNS Lookup ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)		19.2		30	ZeroCERT

First
1
Last
Total : 1cnts