Submissions - ZeroBOX

Submissions

Date range button:

First seen:

Last seen:

No	Date	Request	Urls	Hosts	IDS	Rule	Score	Zero	VT	Player	Etc
1	2023-05-31 17:58	jjjj.exe 7338191364d7eb9a6f697f08833b7fe4 RAT Gen2 Gen1 PhysicalDrive Generic Malware Malicious Packer UPX Malicious Library Antivirus PWS[m] Anti_VM AntiDebug AntiVM PE File PE32 JPEG Format PE64 OS Processor Check .NET EXE Browser Info Stealer Malware download Amadey VirusTotal Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities Collect installed applications Check virtual network interfaces suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check SectopRAT Windows Browser Backdoor ComputerName DNS Cryptographic key crashed	6 Keyword trend analysis Info http://45.159.189.105/bot/online?guid=TEST22-PC&key=afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34 - rule_id: 26212 http://78.47.9.120/so57Nst/index.php?scr=1 http://45.159.189.105/bot/regex?key=afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34 - rule_id: 26211 http://78.47.9.120/so57Nst/index.php http://162.55.212.236/unsecapp.exe http://162.55.212.236/tcpupdate.exe	4	11 Info ET INFO Executable Download from dotted-quad Host ET MALWARE Amadey CnC Check-In ET MALWARE Win32/Amadey Bot Activity (POST) M2 ET POLICY PE EXE or DLL Windows file download HTTP ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 ET MALWARE Laplas Clipper - Regex CnC Request ET MALWARE Laplas Clipper - SetOnline CnC Checkin ET MALWARE Arechclient2 Backdoor CnC Init ET MALWARE Amadey Bot Activity (POST) M1	2	18.0	M	42	ZeroCERT

First
1
Last
Total : 1cnts