45721 |
2024-07-03 08:07
|
mku.vbs 723330a9cf1200400aa6a4dcbd27e061 Malware download Wshrat NetWireRC Malware VBScript AutoRuns WMI wscript.exe payload download AntiVM_Disk VM Disk Size Check Windows Houdini ComputerName DNS DDNS Dropper |
1
http://chongmei33.publicvm.com:7045/is-ready - rule_id: 28328
|
2
chongmei33.publicvm.com(46.246.86.12) - mailcious 46.246.86.12
|
4
ET MALWARE WSHRAT CnC Checkin ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm/WSHRAT Checkin 1 ET INFO DYNAMIC_DNS HTTP Request to a *.publicvm .com Domain ET POLICY Observed DNS Query to DynDNS Domain (publicvm .com)
|
1
http://chongmei33.publicvm.com:7045/is-ready
|
10.0 |
M |
|
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
45722 |
2024-07-03 08:09
|
don701.exe 6a1ff8c93c4d4ba50c8145a354b5c586 AgentTesla Malicious Library PWS SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer VirusTotal Email Client Info Stealer Malware Buffer PE suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Tofsee Windows Gmail Browser Email ComputerName Cryptographic key crashed keylogger |
|
2
smtp.gmail.com(74.125.23.109) 173.194.174.109
|
2
SURICATA Applayer Detect protocol only one direction SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
|
|
13.6 |
M |
56 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
45723 |
2024-07-03 08:13
|
Build.exe 2f6f4f9674c6721b5ea8319ed90a8f20 Emotet Gen1 Generic Malware PhysicalDrive NSIS NMap Malicious Library Downloader UPX Malicious Packer Admin Tool (Sysinternals etc ...) Antivirus .NET framework(MSIL) ASPack Anti_VM Javascript_Blob PE File PE32 MZP Format OS Processor Check DllRegisterSer Browser Info Stealer VirusTotal Malware AutoRuns Check memory Creates executable files unpack itself suspicious process AppData folder installed browsers check Tofsee Windows Browser Advertising Google ComputerName Trojan DNS DDNS crashed keylogger |
7
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
|
10
drive.usercontent.google.com(142.250.207.97) - mailcious
docs.google.com(172.217.25.174) - mailcious
xred.mooo.com() - mailcious
freedns.afraid.org(69.42.215.252)
www.dropbox.com(162.125.84.18) - mailcious 142.251.220.78
45.141.26.232 - mailcious
142.251.220.1
69.42.215.252
162.125.84.18 - mailcious
|
2
ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
|
|
12.2 |
M |
69 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
45724 |
2024-07-03 08:15
|
x.exe d27e7c560c09eb318c80cab58baea1b2 Emotet Gen1 Generic Malware PhysicalDrive NSIS NMap Malicious Library Antivirus UPX Malicious Packer Admin Tool (Sysinternals etc ...) Downloader .NET framework(MSIL) ASPack Anti_VM Javascript_Blob PE File PE32 MZP Format OS Processor Check DllRegisterSer Browser Info Stealer AutoRuns suspicious privilege MachineGuid Check memory Checks debugger Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check installed browsers check Windows Browser ComputerName Cryptographic key |
|
|
|
|
6.0 |
M |
|
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
45725 |
2024-07-03 08:17
|
java_update.exe bc4206081a6f4206dc5b63948b05ef4b Emotet Gen1 Generic Malware PhysicalDrive NSIS NMap Malicious Library Antivirus UPX Malicious Packer Admin Tool (Sysinternals etc ...) Downloader .NET framework(MSIL) ASPack Anti_VM Javascript_Blob PE File PE32 MZP Format OS Processor Check DllRegisterSer Browser Info Stealer AutoRuns suspicious privilege MachineGuid Check memory Checks debugger Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check installed browsers check Windows Browser ComputerName DNS Cryptographic key |
|
2
142.250.66.142 142.251.220.33
|
|
|
6.6 |
M |
|
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
45726 |
2024-07-03 08:17
|
F.exe e501c275814bfcb58fe845c38227d5c5 Emotet Gen1 Generic Malware PhysicalDrive NSIS NMap Malicious Library Antivirus UPX Malicious Packer Admin Tool (Sysinternals etc ...) Downloader .NET framework(MSIL) ASPack Anti_VM Javascript_Blob PE File PE32 MZP Format OS Processor Check DllRegisterSer Browser Info Stealer VirusTotal Malware AutoRuns suspicious privilege MachineGuid Check memory Checks debugger Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check installed browsers check Tofsee Windows Browser Advertising Google ComputerName DNS Cryptographic key DDNS crashed keylogger |
7
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
|
11
drive.usercontent.google.com(142.250.206.193) - mailcious
docs.google.com(172.217.25.174) - mailcious
xred.mooo.com() - mailcious
freedns.afraid.org(69.42.215.252)
www.dropbox.com(162.125.84.18) - mailcious 142.251.220.78
69.42.215.252
142.250.66.142
142.251.220.1
142.251.220.33
162.125.84.18 - mailcious
|
2
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com
|
|
10.8 |
M |
68 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
45727 |
2024-07-03 09:29
|
outbyte-driver-updater.exe 19e7819eb886414b6bcab23db00541ec Gen1 Generic Malware PhysicalDrive Malicious Library UPX Malicious Packer Admin Tool (Sysinternals etc ...) Anti_VM PE File PE32 MZP Format OS Processor Check DLL DllRegisterServer dll ftp PE64 VirusTotal Malware MachineGuid Malicious Traffic Check memory Checks debugger Creates executable files RWX flags setting unpack itself Checks Bios AppData folder AntiVM_Disk anti-virtualization VM Disk Size Check Tofsee |
1
https://www.google-analytics.com/mp/collect?measurement_id=G-SEW4YMR3XJ&api_secret=Bwp8gLa9SqG7iUYK8RMmcg
|
4
outbyte.com(45.33.97.245) www.google-analytics.com(142.250.207.110) 142.251.130.14 45.33.97.245
|
1
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
|
|
6.8 |
|
4 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
45728 |
2024-07-03 09:37
|
Fortect.exe 745dfc19a7a8ce32812211f17b792fa6 Gen1 RedLine stealer Emotet NSIS Generic Malware Suspicious_Script_Bin Downloader Malicious Library UPX Admin Tool (Sysinternals etc ...) Malicious Packer Antivirus Anti_VM Javascript_Blob PE File PE32 OS Processor Check DLL PNG Format JPEG Format Lnk For VirusTotal Malware AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted WMI Creates shortcut RWX flags setting unpack itself Auto service AppData folder AntiVM_Disk sandbox evasion VM Disk Size Check human activity check Tofsee Ransomware Windows ComputerName DNS Software |
11
https://app.fortect.com/events/events.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502&id=PKAOK¶m=ServiceRunning<*> https://app.fortect.com/events/version.php?data=json&sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502&installed= https://app.fortect.com/events/events.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502&id=INSVR¶m=6.5.0.2<*> https://app.fortect.com/ev-install-start/ev-install-start.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502 https://app.fortect.com/events/events.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502&id=INSST¶m=Downloader%20Started<*> https://app.fortect.com/ev-install-end/ev-install-end.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502 https://cloud.fortect.com/app/installation/engine/6502/FortectSetup64.7z https://app.fortect.com/events/events.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502&id=LANG¶m=1042<*>ko<*> https://app.fortect.com/events/evt_scan.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502&id=AUINS¶m=service%20installed<*>0<*>6.5.0.2<*> https://app.fortect.com/events/events.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502&id=INSRN¶m=6.5.0.2<*> https://cloud.fortect.com/app/installation/service/6502/FortectProtection64.7z
|
6
service.fortect.com(104.26.3.16) app.fortect.com(104.26.2.16) cloud.fortect.com(172.67.75.40) 104.26.3.16 - mailcious 172.67.75.40 - mailcious 104.26.2.16 - mailcious
|
3
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com)
|
|
8.6 |
|
1 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
45729 |
2024-07-03 09:40
|
outbyte-driver-updater.exe 19e7819eb886414b6bcab23db00541ec Gen1 HermeticWiper Generic Malware PhysicalDrive Malicious Library UPX Admin Tool (Sysinternals etc ...) Malicious Packer Anti_VM PE File PE32 MZP Format OS Processor Check Lnk Format GIF Format DLL PE64 MSOffice File DllRegisterServer dll ftp Browser Info Stealer VirusTotal Malware AutoRuns suspicious privilege MachineGuid Malicious Traffic Check memory Checks debugger WMI Creates shortcut Creates executable files RWX flags setting unpack itself Windows utilities Checks Bios AppData folder AntiVM_Disk WriteConsoleW anti-virtualization VM Disk Size Check installed browsers check Tofsee GameoverP2P Zeus Windows Browser ComputerName Trojan Banking crashed |
1
https://www.google-analytics.com/mp/collect?measurement_id=G-SEW4YMR3XJ&api_secret=Bwp8gLa9SqG7iUYK8RMmcg
|
9
ssl.outbyte.com(45.33.97.245) api.outbyte.com(192.155.86.205) outbyte.com(45.33.97.245) du.outbyte.com(51.81.185.149) www.google-analytics.com(142.250.206.206) 142.250.207.78 51.81.185.149 45.33.97.245 192.155.86.205
|
2
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET INFO TLS Handshake Failure
|
|
11.6 |
|
4 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
45730 |
2024-07-03 09:49
|
Gamesense.rar b1adc1e869b9d40b6d9c8550cd129268 Escalate priviledges PWS KeyLogger AntiDebug AntiVM VirusTotal Malware suspicious privilege Check memory Checks debugger Creates executable files unpack itself |
|
|
|
|
3.0 |
M |
38 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
45731 |
2024-07-03 10:04
|
scrscrscr.exe d62cda8235956adc06d774785dbc8ca6 UPX PE File PE32 VirusTotal Malware PDB Remote Code Execution |
|
|
|
|
1.2 |
M |
21 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
45732 |
2024-07-03 10:05
|
au.u.u.uuu.doc 82bb2c75e40c4beb166cfa0c3d7fc0bc MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware Malicious Traffic buffers extracted ICMP traffic exploit crash unpack itself Exploit DNS crashed |
1
http://103.186.67.211/66122/imagesrecreatedforflowersbeauty.gif
|
2
103.186.67.211 - mailcious
41.216.183.13 - mailcious
|
|
|
6.8 |
M |
37 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
45733 |
2024-07-03 10:42
|
archive.rar 9d10f6f08ae1cc016c10b09007063417 Vidar Escalate priviledges PWS KeyLogger AntiDebug AntiVM VirusTotal Cryptocurrency Miner Malware Telegram suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself IP Check Tofsee Windows Discord DNS CoinMiner |
10
http://5.42.99.177/api/crazyfish.php - rule_id: 40006
http://apps.identrust.com/roots/dstrootcax3.p7c
http://80.78.242.100/d/525403
http://5.42.99.177/api/twofish.php - rule_id: 40008
http://x1.i.lencr.org/
https://steamcommunity.com/profiles/76561199707802586 - rule_id: 40674
https://lop.foxesjoy.com/ssl/crt.exe - rule_id: 40188
https://db-ip.com/demo/home.php?s=
http://77.105.133.27/download/th/space.php
http://77.105.133.27/download/123p.exe
|
35
db-ip.com(172.67.75.166)
monoblocked.com(45.130.41.108) - malware
api64.ipify.org(173.231.16.77)
api.myip.com(172.67.75.163)
steamcommunity.com(104.100.64.90) - mailcious
lop.foxesjoy.com(104.21.66.124) - malware
t.me(149.154.167.99) - mailcious
ipinfo.io(34.117.186.192)
x1.i.lencr.org(23.35.220.247)
bitbucket.org(104.192.141.1) - malware
cdn.discordapp.com(162.159.133.233) - malware
vk.com(87.240.132.67) - mailcious
iplogger.org(104.21.4.208) - mailcious
pool.hashvault.pro(142.202.242.45) - mailcious 104.71.154.102
104.26.5.15
149.154.167.99 - mailcious
23.201.35.155
34.117.186.192
125.253.92.50
104.26.8.59
162.159.130.233 - malware
104.21.66.124 - malware
45.130.41.108 - malware
104.237.62.213
77.91.77.80 - malware
104.192.141.1 - mailcious
121.254.136.9
80.78.242.100 - mailcious
37.27.31.150
5.42.99.177 - mailcious
23.41.113.9
77.105.133.27 - mailcious
87.240.132.72 - mailcious
172.67.132.113
|
17
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET INFO Observed Discord Domain (discordapp .com in TLS SNI) ET INFO Observed Discord Domain in DNS Lookup (discordapp .com) SURICATA Applayer Mismatch protocol both directions ET INFO Executable Download from dotted-quad Host ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com) ET HUNTING Redirect to Discord Attachment Download ET INFO TLS Handshake Failure ET POLICY PE EXE or DLL Windows file download HTTP ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response ET INFO EXE - Served Attached HTTP ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup ET POLICY IP Check Domain (iplogger .org in DNS Lookup) ET POLICY IP Check Domain (iplogger .org in TLS SNI) ET INFO Observed Telegram Domain (t .me in TLS SNI) ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)
|
4
http://5.42.99.177/api/crazyfish.php http://5.42.99.177/api/twofish.php https://steamcommunity.com/profiles/76561199707802586 https://lop.foxesjoy.com/ssl/crt.exe
|
6.0 |
M |
1 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
45734 |
2024-07-03 10:46
|
Update.js cbca476a716c76cf629b3428ee9c3f43VBScript wscript.exe payload download Tofsee crashed Dropper |
1
https://yeo.fans.smalladventureguide.com/orderReview
|
2
yeo.fans.smalladventureguide.com(162.252.175.117) 162.252.175.117 - mailcious
|
2
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET INFO TLS Handshake Failure
|
|
10.0 |
|
|
r0d
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
45735 |
2024-07-03 11:20
|
setup.exe 6a29cf171c9718d55a0b617102451f6b Malicious Library PE File PE32 Checks debugger WMI Creates executable files RWX flags setting unpack itself Checks Bios anti-virtualization ComputerName |
|
|
|
|
3.6 |
|
|
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|