| 44791 |
2020-12-03 15:03
|
pp.exe a34aada9a4773e1c8f43cd4cc96f93d4
VirusTotal Malware MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself malicious URLs ComputerName DNS |
|
1
|
|
|
9.2 |
M |
25 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 44792 |
2020-12-03 14:59
|
pp.exe a34aada9a4773e1c8f43cd4cc96f93d4
VirusTotal Malware MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself malicious URLs ComputerName DNS |
|
1
|
|
|
9.8 |
M |
25 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 44793 |
2020-12-03 14:57
|
-PLND-AC5Of18BrwAABTwCAERFFwAM... 9a6f516437129516bb6596a3da44655c
VirusTotal Malware unpack itself malicious URLs |
|
|
|
|
3.2 |
|
34 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 44794 |
2020-12-03 14:44
|
ora.exe a0182c49a94e3059bca702e61f9a062c
Browser Info Stealer Malware download FTP Client Info Stealer Azorult VirusTotal Email Client Info Stealer Malware MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Collect installed applications AppData folder malicious URLs sandbox evasion anti-virtualization installed browsers check Browser Email ComputerName DNS Software |
1
http://172.104.211.124/index.php - rule_id: 139
|
1
172.104.211.124 - mailcious
|
3
ET MALWARE AZORult Variant.4 Checkin M2
ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
ET MALWARE AZORult v3.2 Server Response M1
|
1
http://172.104.211.124/index.php
|
15.6 |
M |
49 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 44795 |
2020-12-03 14:43
|
Ohms.exe c23744a31762ff3d7c45726f5b664f72
VirusTotal Malware Check memory Checks debugger unpack itself malicious URLs Windows ComputerName Cryptographic key crashed |
|
|
|
|
2.8 |
M |
37 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 44796 |
2020-12-03 14:09
|
oa.exe 49e3615ed498bea0b265d8581a686f5a
Browser Info Stealer Malware download FTP Client Info Stealer Azorult VirusTotal Email Client Info Stealer Malware MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Collect installed applications AppData folder malicious URLs sandbox evasion anti-virtualization installed browsers check Browser Email ComputerName DNS Software |
|
1
|
3
ET MALWARE AZORult Variant.4 Checkin M2
ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
ET MALWARE AZORult v3.2 Server Response M1
|
|
15.6 |
M |
52 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 44797 |
2020-12-03 14:09
|
mm.exe d5e81cac610e6928283350bb3f4d7d7b
Malware download Azorult VirusTotal Malware suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs Browser ComputerName DNS |
1
http://158.101.98.57/index.php - rule_id: 138
|
4
movie.metaservices.microsoft.com(65.55.186.115)
158.101.98.57
104.74.217.16
65.55.5.170
|
2
ET MALWARE AZORult Variant.4 Checkin M2
ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
|
1
http://158.101.98.57/index.php
|
11.8 |
M |
50 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 44798 |
2020-12-03 13:09
|
prowarzgalaxyz.exe aeb8c6e4bd873e955e0a4868ad38e540
Malware download VirusTotal Malware PDB suspicious privilege Malicious Traffic Creates executable files AppData folder malicious URLs WriteConsoleW installed browsers check Windows Browser DNS Downloader |
|
3
ddos.dnsnb8.net(162.217.99.134) - mailcious
154.202.3.44 - malware
162.217.99.134
|
8
ET INFO Executable Download from dotted-quad Host
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
ET MALWARE Possible Malicious Macro DL EXE Feb 2016
ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
ET POLICY PE EXE or DLL Windows file download HTTP
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
|
|
9.2 |
M |
65 |
조광섭
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 44799 |
2020-12-03 13:07
|
prowarzgalaxyz.exe aeb8c6e4bd873e955e0a4868ad38e540
Malware download VirusTotal Malware PDB suspicious privilege Malicious Traffic Creates executable files ICMP traffic AppData folder malicious URLs WriteConsoleW installed browsers check Windows Browser DNS Downloader |
|
3
ddos.dnsnb8.net(162.217.99.134) - mailcious
154.202.3.44 - malware
162.217.99.134
|
8
ET INFO Executable Download from dotted-quad Host
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
ET MALWARE Possible Malicious Macro DL EXE Feb 2016
ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
ET POLICY PE EXE or DLL Windows file download HTTP
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
|
|
10.6 |
M |
65 |
조광섭
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 44800 |
2020-12-03 13:01
|
prowarzgalaxyz.exe aeb8c6e4bd873e955e0a4868ad38e540
Malware download njRAT NetWireRC VirusTotal Malware PDB suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself AppData folder malicious URLs WriteConsoleW installed browsers check Windows Browser DNS DDNS Downloader |
|
4
ddos.dnsnb8.net(162.217.99.134) - mailcious
ddnshost-microsofts.serveftp.com(0.0.0.0) - mailcious
154.202.3.44 - malware
162.217.99.134
|
10
ET MALWARE Bladabindi/njRAT CnC Command (ll)
ET INFO Executable Download from dotted-quad Host
ET MALWARE Possible Malicious Macro DL EXE Feb 2016
ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
ET POLICY PE EXE or DLL Windows file download HTTP
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
ET POLICY DNS Query to DynDNS Domain *.serveftp .com
|
|
10.4 |
M |
65 |
조광섭
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 44801 |
2020-12-03 12:57
|
prowarzgalaxyz.exe aeb8c6e4bd873e955e0a4868ad38e540
Malware download VirusTotal Malware PDB suspicious privilege Malicious Traffic Creates executable files AppData folder malicious URLs WriteConsoleW installed browsers check Windows Browser DNS Downloader |
|
3
ddos.dnsnb8.net(162.217.99.134) - mailcious
154.202.3.44 - malware
162.217.99.134
|
8
ET INFO Executable Download from dotted-quad Host
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
ET MALWARE Possible Malicious Macro DL EXE Feb 2016
ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
ET POLICY PE EXE or DLL Windows file download HTTP
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
|
|
9.2 |
M |
65 |
조광섭
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 44802 |
2020-12-03 12:54
|
prowarzgalaxyz.exe aeb8c6e4bd873e955e0a4868ad38e540
Malware download VirusTotal Malware PDB suspicious privilege Malicious Traffic Creates executable files AppData folder malicious URLs WriteConsoleW installed browsers check Windows Browser DNS Downloader |
|
3
ddos.dnsnb8.net(162.217.99.134) - mailcious
154.202.3.44 - malware
162.217.99.134
|
8
ET INFO Executable Download from dotted-quad Host
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
ET MALWARE Possible Malicious Macro DL EXE Feb 2016
ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
ET POLICY PE EXE or DLL Windows file download HTTP
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
|
|
9.8 |
M |
65 |
조광섭
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 44803 |
2020-12-03 12:53
|
prowarzgalaxyz.exe aeb8c6e4bd873e955e0a4868ad38e540
Malware download VirusTotal Malware PDB suspicious privilege Malicious Traffic Creates executable files AppData folder malicious URLs WriteConsoleW installed browsers check Windows Browser DNS Downloader |
|
3
ddos.dnsnb8.net(162.217.99.134) - mailcious
154.202.3.44 - malware
162.217.99.134
|
8
ET INFO Executable Download from dotted-quad Host
ET MALWARE Possible Malicious Macro DL EXE Feb 2016
ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
ET POLICY PE EXE or DLL Windows file download HTTP
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
|
|
9.8 |
M |
65 |
조광섭
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 44804 |
2020-12-03 12:52
|
prowarzgalaxyz.exe aeb8c6e4bd873e955e0a4868ad38e540
Malware download VirusTotal Malware PDB suspicious privilege Malicious Traffic Creates executable files AppData folder malicious URLs WriteConsoleW installed browsers check Windows Browser DNS Downloader |
|
3
ddos.dnsnb8.net(162.217.99.134) - mailcious
154.202.3.44 - malware
162.217.99.134
|
8
ET INFO Executable Download from dotted-quad Host
ET MALWARE Possible Malicious Macro DL EXE Feb 2016
ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
ET POLICY PE EXE or DLL Windows file download HTTP
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
|
|
9.8 |
M |
65 |
조광섭
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 44805 |
2020-12-03 12:50
|
prowarzgalaxyz.exe aeb8c6e4bd873e955e0a4868ad38e540
Malware download VirusTotal Malware PDB suspicious privilege Malicious Traffic Creates executable files AppData folder malicious URLs WriteConsoleW installed browsers check Windows Browser DNS Downloader |
|
3
ddos.dnsnb8.net(162.217.99.134) - mailcious
154.202.3.44 - malware
162.217.99.134
|
8
ET INFO Executable Download from dotted-quad Host
ET MALWARE Possible Malicious Macro DL EXE Feb 2016
ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
ET POLICY PE EXE or DLL Windows file download HTTP
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
|
|
9.2 |
M |
65 |
조광섭
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|