451 |
2024-09-02 10:29
|
madamwebwin7fileMPDW-constrain... e4d40675c1dce3dd82443d9e0975d399 Generic Malware Antivirus Hide_URL PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key |
1
https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg
|
2
ia803104.us.archive.org(207.241.232.154) - malware 207.241.232.154 - malware
|
1
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
|
|
7.6 |
M |
4 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
452 |
2024-09-02 10:28
|
66d1e3c3c7dc6_vregs.exe#space 744dad327f45b0839b0150d45e6b1f9f Stealc Client SW User Data Stealer LokiBot ftp Client info stealer Malicious Library Antivirus Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer Malware download FTP Client Info Stealer Vidar VirusTotal Email Client Info Stealer Malware c&c PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Collect installed applications malicious URLs sandbox evasion anti-virtualization installed browsers check Stealc Stealer Windows Browser Email ComputerName DNS Software crashed plugin |
8
http://147.45.68.138/softokn3.dll http://147.45.68.138/mozglue.dll http://147.45.68.138/freebl3.dll http://147.45.68.138/nss3.dll http://147.45.68.138/sql.dll http://147.45.68.138/ - rule_id: 42298 http://147.45.68.138/msvcp140.dll http://147.45.68.138/vcruntime140.dll
|
1
147.45.68.138 - mailcious
|
10
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 ET INFO Dotted Quad Host DLL Request ET POLICY PE EXE or DLL Windows file download HTTP ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity
|
1
|
17.0 |
M |
45 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
453 |
2024-09-02 10:28
|
masrshal.exe a5a3902eda13fdecf1320b900d2e5395 PE File .NET EXE PE32 Malware download VirusTotal Malware Buffer PE AutoRuns suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Windows ComputerName DNS Cryptographic key crashed |
1
http://91.92.254.178/saphire/Kyrclzcw.wav
|
1
|
4
ET DROP Spamhaus DROP Listed Traffic Inbound group 13 ET MALWARE PE EXE or DLL Windows file download disguised as ASCII ET MALWARE PE EXE or DLL Windows file download Text M2 ET HUNTING [TW] Likely Hex Executable String
|
|
7.6 |
M |
54 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
454 |
2024-09-02 10:24
|
66d1ee505e71e_Build.exe a7b783146953de955a829962edd77767 Antivirus ScreenShot AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware PDB Code Injection Check memory Checks debugger buffers extracted unpack itself |
|
|
|
|
7.4 |
M |
53 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
455 |
2024-09-02 10:24
|
66cef067bb8bb_CoinAccording.ex... 6cd2eb2553ba19d387c45537a16547f4 Generic Malware Downloader Malicious Library UPX Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM PE File VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities suspicious process AppData folder malicious URLs WriteConsoleW Windows ComputerName DNS |
|
1
|
|
|
7.2 |
M |
17 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
456 |
2024-09-02 10:23
|
66d1e3d63bd13_sbgdwf.exe#space bde7cb83c1fa62b052a3b255a79dfc1e Stealc Client SW User Data Stealer ftp Client info stealer Malicious Library Antivirus Http API PWS AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer Malware download Vidar VirusTotal Malware c&c PDB Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Collect installed applications sandbox evasion anti-virtualization installed browsers check Stealc Stealer Windows Browser ComputerName DNS plugin |
9
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll http://46.8.231.109/c4754d4f680ead72.php - rule_id: 42211 http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll http://46.8.231.109/ - rule_id: 42142 http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
|
1
|
15
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in ET MALWARE Win32/Stealc Requesting browsers Config from C2 ET MALWARE Win32/Stealc Active C2 Responding with browsers Config M1 ET MALWARE Win32/Stealc Requesting plugins Config from C2 ET INFO Dotted Quad Host DLL Request ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 ET POLICY PE EXE or DLL Windows file download HTTP ET MALWARE Win32/Stealc Submitting System Information to C2 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity
|
2
http://46.8.231.109/c4754d4f680ead72.php http://46.8.231.109/
|
12.0 |
M |
24 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
457 |
2024-09-02 10:22
|
jhg.exe b21e324a39b4279504b10fee217239d3 Browser Login Data Stealer Generic Malware Malicious Library Downloader Malicious Packer UPX PE File PE32 OS Processor Check VirusTotal Malware AutoRuns Windows DNS |
|
1
|
|
|
4.6 |
M |
61 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
458 |
2024-09-02 10:21
|
MeMpEng.exe 2de33a20655435a626ae19973654e95c Formbook Generic Malware Malicious Library UPX PE File PE32 OS Processor Check DLL Browser Info Stealer VirusTotal Malware Checks debugger buffers extracted Creates executable files unpack itself AppData folder suspicious TLD Java Browser DNS |
19
http://www.inmotarget.online/f94d/?FhSMQ3HV=qXxH1TkJqyQLN7K67UolPOrNVrH3EkVnBHKOJBevZlWzyIWqOcopXSkjMgAVQAiVcEwXsA2AXYdRBAjRF8/XmlFRLYiZtr82nLJKSk2mfCIs3NsTyuUwAMniQ4mBWHwlcbK0rUc=&5CL=gie-nJmkplkdJ7 http://www.32wxd.top/fqtd/ - rule_id: 42374 http://www.foundation-repair.biz/5l7s/?FhSMQ3HV=5i9IxHyDCONgw46qIHGeUvwlYzbtgN8gQUqUIjK6jcHsfbLgiJ2s3wDRXgbc+h/bICwzf3ddx8E1HmjHsyEg1i4ki39GGAPq3qClCRMeu9QIBTg/A11C17kmPPIEN81gm2sAq9Q=&5CL=gie-nJmkplkdJ7 - rule_id: 42369 http://www.meetfactory.biz/xoqw/?FhSMQ3HV=IHXCkUsJunCVOO2Hwv8L1/jebUXenMysZsXgVBD8KQgj+TIAwNGDK5EWhUbKXzAU4KMQODjr0cxiOqiC8Z91HBWngaVBBi9zW0XdtSpa8XSCv8AOb3sJWenXQ9ufn4pifwUOwgs=&5CL=gie-nJmkplkdJ7 - rule_id: 42372 http://www.d71dg.top/qbiu/?FhSMQ3HV=cpFY4442L+Bmta8QONEKHiouDvWOZNVLDBDtb0iNjVMT9Lz9+WHyspHM09lzzQ6O3A+WaZO+gSWm6Q36us29ksmtCzg/K1sgttxXiQs+/4tLnxfFR1YWTQNZTBuvIfutPAZp0QU=&5CL=gie-nJmkplkdJ7 - rule_id: 42375 http://www.zenzip.xyz/9pad/?FhSMQ3HV=1a5ATRlanZ3ATSTMsvfkUs0ciM8umoJS8y8kT4HdOCMJyW9sS8tB9dhHCXeYKtsB5QysC2Hg2jCPifAM2S09CoHR88nq9oCTqozYG6NauxPM4LjmZuBJG1m7wEgFKI64QDVX+78=&5CL=gie-nJmkplkdJ7 - rule_id: 42371 http://www.onlytradez.club/k1y3/?FhSMQ3HV=J7VJwuuG4HUA4bFTkbQEdxkpMEpXPBCRRs+F1x6QwwkcPlqAPKpQJUUQrtsDqb7Q+tjdIUGQwp4fGorxq2J//mB+PqSTwbyLcRM9dR0EDrcHS/LNmgUR990rINKp1m+e5VNnNrk=&5CL=gie-nJmkplkdJ7 - rule_id: 42373 http://www.d71dg.top/qbiu/ - rule_id: 42375 http://www.foundation-repair.biz/5l7s/ - rule_id: 42369 http://www.sqlite.org/2022/sqlite-dll-win32-x86-3380000.zip http://www.51cc.top/7i54/?FhSMQ3HV=SgV//QM+kZDZSmca7ISHR4U/9iG4TLn30ssUgf4MDLRPguhpDtuGIpE5eby1mFBEyx9n6ho2rfFD9SDq3nlePS+8rBqg/0cGFsBGWXu5QF07X9CUnUPZux9wfWAAZevyIeAs5Qc=&5CL=gie-nJmkplkdJ7 - rule_id: 42370 http://www.2886080.xyz/eyiz/ - rule_id: 42368 http://www.51cc.top/7i54/ - rule_id: 42370 http://www.zenzip.xyz/9pad/ - rule_id: 42371 http://www.2886080.xyz/eyiz/?FhSMQ3HV=XQ7d8vWNf2bTOhYYL6UJlqYAXy7Rg8V7tb7nan5iZXoOR23qJ7xYi6zjP0ZZPC1qNGRbW38doA+CklQhfBW16OH9GbU74opfrouVpsjlwzkQhOIIL+clvr6SJ5uB6xxabU5X5cQ=&5CL=gie-nJmkplkdJ7 - rule_id: 42368 http://www.onlytradez.club/k1y3/ - rule_id: 42373 http://www.inmotarget.online/f94d/ http://www.meetfactory.biz/xoqw/ - rule_id: 42372 http://www.32wxd.top/fqtd/?FhSMQ3HV=NOGaE4zNJ3vPzwJVq9flFF94in2IcnN0bsRklEYFuNltL64f812fYl1xoipxw6mqFzyE6nPBnWGndAD5Tl5FPYyUit02KiWxxW2zK2p9R7C5MnzH/2vAyX3OoZI/vgfMfT+cSXI=&5CL=gie-nJmkplkdJ7 - rule_id: 42374
|
21
www.onlytradez.club(167.172.133.32) - mailcious www.zenzip.xyz(203.161.46.201) - mailcious www.inmotarget.online() www.sgcwin77rtplive.fun() - mailcious www.foundation-repair.biz(199.59.243.226) - mailcious www.32wxd.top(206.119.82.116) - mailcious www.2886080.xyz(103.249.106.91) - mailcious www.kej-sii.cloud() - mailcious www.d71dg.top(154.23.184.60) - mailcious www.meetfactory.biz(45.33.30.197) - mailcious www.51cc.top(216.83.36.195) - mailcious 103.249.106.91 - mailcious 98.124.224.17 - mailcious 167.172.133.32 - mailcious 216.83.36.195 - mailcious 199.59.243.226 - phishing 203.161.46.201 - mailcious 206.119.82.116 - mailcious 45.33.6.223 198.58.118.167 - mailcious 154.23.184.60 - mailcious
|
6
ET DNS Query to a *.top domain - Likely Hostile ET INFO HTTP Request to a *.top domain ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M1 ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M2 ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M3 ET INFO Observed DNS Query to .biz TLD
|
16
http://www.32wxd.top/fqtd/ http://www.foundation-repair.biz/5l7s/ http://www.meetfactory.biz/xoqw/ http://www.d71dg.top/qbiu/ http://www.zenzip.xyz/9pad/ http://www.onlytradez.club/k1y3/ http://www.d71dg.top/qbiu/ http://www.foundation-repair.biz/5l7s/ http://www.51cc.top/7i54/ http://www.2886080.xyz/eyiz/ http://www.51cc.top/7i54/ http://www.zenzip.xyz/9pad/ http://www.2886080.xyz/eyiz/ http://www.onlytradez.club/k1y3/ http://www.meetfactory.biz/xoqw/ http://www.32wxd.top/fqtd/
|
7.6 |
M |
48 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
459 |
2024-09-02 10:20
|
%E6%94%BE%E5%81%87%E5%80%BC%E7... 07898838cbb961a9c4a61b180b6b48da CoinMiner Generic Malware Malicious Library UPX AntiDebug AntiVM PE File PE64 OS Processor Check MSOffice File PNG Format VirusTotal Malware suspicious privilege Code Injection Check memory buffers extracted RWX flags setting exploit crash unpack itself Windows utilities Check virtual network interfaces suspicious process Windows Exploit ComputerName Remote Code Execution DNS crashed |
|
1
|
|
|
8.2 |
M |
18 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
460 |
2024-09-02 10:18
|
66d1b31955f50_SunshineSolving.... 0a34380175bb4da2cce136e0cb3d3e04 Generic Malware Malicious Library UPX PE File PE32 OS Processor Check ftp VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger WMI Creates executable files Windows utilities suspicious process AppData folder WriteConsoleW Windows ComputerName |
|
|
|
|
5.8 |
M |
14 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
461 |
2024-09-02 10:16
|
66d1e3d3208e9_vfdw12.exe#d12 b01121b9f9a1e48a7737d6b43e8a7fe5 Stealc Client SW User Data Stealer LokiBot Gen1 ftp Client info stealer Generic Malware Malicious Library Antivirus UPX Malicious Packer Http API PWS HTTP Code injection Internet API ScreenShot AntiDebug AntiVM PE File .NET EXE PE32 DLL OS Processor Check Browser Info Stealer Malware download FTP Client Info Stealer Vidar VirusTotal Email Client Info Stealer Malware c&c PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Stealc Stealer Windows Browser Email ComputerName DNS Software plugin |
10
http://147.45.68.138/softokn3.dll http://147.45.68.138/mozglue.dll http://147.45.44.104/prog/66d4d07501f6e_lsdfn.exe http://147.45.68.138/freebl3.dll http://147.45.68.138/nss3.dll http://147.45.68.138/sql.dll http://147.45.68.138/ - rule_id: 42298 http://147.45.44.104/prog/66d4d0780772b_vnew.exe http://147.45.68.138/msvcp140.dll http://147.45.68.138/vcruntime140.dll
|
2
147.45.68.138 - mailcious 147.45.44.104 - malware
|
13
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 ET INFO Dotted Quad Host DLL Request ET POLICY PE EXE or DLL Windows file download HTTP ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download ET DROP Spamhaus DROP Listed Traffic Inbound group 23 ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity ET INFO Executable Download from dotted-quad Host ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity
|
1
|
16.8 |
M |
54 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
462 |
2024-09-02 10:16
|
66d1ee217b021_1202156955.exe#1... f63c0bf42b8e72dc1cad0cad0b08ce62 Antivirus ScreenShot AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware PDB Code Injection Check memory Checks debugger buffers extracted unpack itself |
|
|
|
|
7.4 |
M |
54 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
463 |
2024-09-02 10:16
|
feishu_update.exe 1b8f93f22f2aee44c16f9886b44549b8 PE File PE64 VirusTotal Malware |
|
|
|
|
1.2 |
M |
56 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
464 |
2024-09-02 10:14
|
66d1ec0485e55_stealc_default.e... 0ce7687b9cd4c4acb89247fb9aef7c4c Stealc Client SW User Data Stealer ftp Client info stealer Malicious Library Antivirus Http API PWS AntiDebug AntiVM PE File .NET EXE PE32 Malware download FTP Client Info Stealer Malware c&c PDB Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows utilities Collect installed applications suspicious process sandbox evasion WriteConsoleW anti-virtualization installed browsers check Stealc Stealer Windows Browser ComputerName DNS Software plugin |
3
http://193.176.190.41/2fa883eebd632382.php - rule_id: 42194 http://193.176.190.41/9e7fbd3f0393ef32/sqlite3.dll http://193.176.190.41/ - rule_id: 42195
|
1
193.176.190.41 - mailcious
|
8
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in ET MALWARE Win32/Stealc Requesting browsers Config from C2 ET MALWARE Win32/Stealc Requesting plugins Config from C2 ET MALWARE Win32/Stealc Submitting System Information to C2 ET INFO Dotted Quad Host DLL Request ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity ET POLICY PE EXE or DLL Windows file download HTTP ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
|
2
http://193.176.190.41/2fa883eebd632382.php http://193.176.190.41/
|
14.4 |
M |
|
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
465 |
2024-09-02 10:02
|
joffer2.exe 4386df2790a9752e9cf0424dca91ad15 Generic Malware Admin Tool (Sysinternals etc ...) UPX PE File PE32 DLL Malware download VirusTotal Malware Malicious Traffic AppData folder suspicious TLD CryptBot DNS |
1
http://sevxv17pt.top/v1/upload.php
|
2
sevxv17pt.top(195.133.13.230) 195.133.13.230 - mailcious
|
3
ET DNS Query to a *.top domain - Likely Hostile ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 ET INFO HTTP Request to a *.top domain
|
|
3.4 |
M |
30 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|