| 3091 |
2020-11-17 18:44
|
F58PlfINzp49aXd.exe b0916454a9fa65dcffa2552149850fd8
Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder malicious URLs WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed |
2
http://checkip.dyndns.org/
https://freegeoip.app/xml/175.208.134.150
|
6
orisinlog.com(104.219.248.45)
freegeoip.app(104.28.4.151)
checkip.dyndns.org(131.186.161.70)
104.28.5.151
104.219.248.45 - suspicious
216.146.43.71
|
5
ET INFO DYNAMIC_DNS Query to *.dyndns. Domain
ET POLICY External IP Lookup - checkip.dyndns.org
ET POLICY DynDNS CheckIp External IP Address Server Response
SURICATA Applayer Detect protocol only one direction
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
|
|
13.2 |
|
25 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3092 |
2020-11-17 18:46
|
SDJ-0488.exe 89a84e0e14ffe871c73cd121ab13b6d5
Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process AppData folder malicious URLs installed browsers check Windows Browser Email ComputerName DNS Cryptographic key Software |
|
1
185.239.242.195 - suspicious
|
|
|
17.2 |
M |
21 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3093 |
2020-11-17 18:50
|
SK-0177.exe d737b3e50711d626e50f55db83908747
Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Buffer PE AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder malicious URLs IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed |
2
http://checkip.dyndns.org/
https://freegeoip.app/xml/175.208.134.150
|
6
freegeoip.app(104.28.4.151)
baharanvilla.ir(185.165.40.194)
checkip.dyndns.org(131.186.161.70)
131.186.113.70
104.28.5.151
185.165.40.194
|
5
ET POLICY External IP Lookup - checkip.dyndns.org
ET INFO DYNAMIC_DNS Query to *.dyndns. Domain
ET POLICY DynDNS CheckIp External IP Address Server Response
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
SURICATA Applayer Detect protocol only one direction
|
|
16.8 |
M |
24 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3094 |
2020-11-18 08:00
|
http://151.80.8.30/document1.d... f9a6dc3c7aa957c70e4f539d72e54c4f
Dridex VirusTotal Malware Code Injection Malicious Traffic exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed |
1
http://151.80.8.30/document1.doc
|
1
|
5
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET INFO TLS Handshake Failure
ET JA3 Hash - Possible Malware - Unknown traffic associated with Dridex
ET INFO Dotted Quad Host DOC Request
ET HUNTING Suspicious Request for Doc to IP Address with Terse Headers
|
|
4.6 |
|
25 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3095 |
2020-11-18 09:28
|
CKC.exe d54d01d0a3a073d1d2a3b70e0d9852cc
VirusTotal Malware AutoRuns suspicious privilege Code Injection Check memory Checks debugger unpack itself malicious URLs Windows DNS Cryptographic key |
|
|
|
|
7.0 |
M |
14 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3096 |
2020-11-18 09:30
|
3MLDad2sFoYnTE9.exe 8849ec79aac67ee11e47fca7938ccfb5
Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder malicious URLs WriteConsoleW IP Check Tofsee Windows Browser ComputerName Software crashed keylogger |
2
http://icanhazip.com/
https://raw.githubusercontent.com/pandalog/nothing/master/john.txt
|
6
orisinlog.com(104.219.248.45) - mailcious
icanhazip.com(147.75.47.199)
raw.githubusercontent.com(151.101.192.133) - malware
147.75.47.199
104.219.248.45 - suspicious
151.101.76.133 - suspicious
|
3
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET POLICY IP Check Domain (icanhazip. com in HTTP Host)
SURICATA Applayer Detect protocol only one direction
|
|
11.2 |
M |
23 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3097 |
2020-11-18 09:33
|
CKC.exe d54d01d0a3a073d1d2a3b70e0d9852cc
VirusTotal Malware AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs IP Check Windows Cryptographic key |
1
|
2
api.ipify.org(54.235.182.194)
54.243.161.145
|
1
ET POLICY External IP Lookup api.ipify.org
|
|
10.4 |
M |
14 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3098 |
2020-11-18 09:37
|
document.doc 41820dc68297b85f7dc85540a3423c1d
VirusTotal Malware Malicious Traffic exploit crash unpack itself malicious URLs Windows Exploit DNS crashed Downloader |
1
http://151.80.8.30/abw.exe
|
3
swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu(192.253.246.140) - mailcious
192.253.246.140
151.80.8.30 - suspicious
|
6
ET INFO Executable Download from dotted-quad Host
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
ET POLICY PE EXE or DLL Windows file download HTTP
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
|
|
6.2 |
M |
24 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3099 |
2020-11-18 09:37
|
document1.doc f9a6dc3c7aa957c70e4f539d72e54c4f
Malware download Azorult VirusTotal Malware Malicious Traffic exploit crash unpack itself malicious URLs Zeus Windows Exploit DNS crashed |
|
3
hgygbgfazoruthyshbcfzjzkdgbzbdzzsddfxfsa.ydns.eu(151.80.14.230) - mailcious
151.80.14.230 - suspicious
151.80.8.30 - suspicious
|
7
ET INFO Executable Download from dotted-quad Host
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
ET POLICY PE EXE or DLL Windows file download HTTP
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
ET MALWARE AZORult v3.3 Server Response M3
ET MALWARE Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)
|
|
5.6 |
M |
25 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3100 |
2020-11-18 10:27
|
eic.exe 665bfadaa21dc3f298b0c886b6867cd1
VirusTotal Malware AutoRuns suspicious privilege Code Injection Check memory Checks debugger unpack itself malicious URLs Windows DNS crashed |
|
|
|
|
7.2 |
M |
43 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3101 |
2020-11-18 10:28
|
ebyjon.exe 7e0601f46369fa6ad8d291b1205068d5
VirusTotal Malware Buffer PE AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself AppData folder malicious URLs Ransomware Windows Tor ComputerName Cryptographic key crashed |
|
|
|
|
13.2 |
|
22 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3102 |
2020-11-18 12:32
|
ebyjon.exe 7e0601f46369fa6ad8d291b1205068d5
VirusTotal Malware Buffer PE AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself AppData folder malicious URLs Ransomware Windows Tor ComputerName Cryptographic key crashed |
|
|
|
|
13.2 |
|
22 |
guest
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3103 |
2020-11-18 13:43
|
ebyjon.exe 7e0601f46369fa6ad8d291b1205068d5
VirusTotal Malware Buffer PE AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself AppData folder malicious URLs Windows ComputerName Cryptographic key crashed |
|
|
|
|
12.0 |
|
22 |
guest
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3104 |
2020-11-18 18:03
|
eic.exe 665bfadaa21dc3f298b0c886b6867cd1
VirusTotal Malware AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs IP Check Windows DNS crashed |
1
|
2
api.ipify.org(54.204.14.42)
54.243.164.148
|
1
ET POLICY External IP Lookup api.ipify.org
|
|
10.8 |
M |
48 |
guest
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3105 |
2020-11-18 18:03
|
abw.exe 678dac5fc4c6a55f032ba40698895e6a
Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process malicious URLs WriteConsoleW human activity check Windows ComputerName Cryptographic key crashed |
|
2
swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu(192.253.246.142) - mailcious
192.253.246.142
|
|
|
15.6 |
M |
|
guest
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|