48961 |
2021-02-06 09:48
|
723728IMG_06052.pdf.exe 745961d7f1fa9e0aa290734386cb3701 Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows utilities Check virtual network interfaces suspicious process malicious URLs VMware IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed |
3
http://checkip.dyndns.org/ https://freegeoip.app/xml/175.208.134.150 https://www.google.com/
|
7
www.google.com(172.217.175.100) freegeoip.app(104.21.19.200) checkip.dyndns.org(216.146.43.70) 172.217.24.132 - suspicious 131.186.161.70 172.67.188.154 172.217.26.4 - suspicious
|
4
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET POLICY External IP Lookup - checkip.dyndns.org ET INFO DYNAMIC_DNS Query to *.dyndns. Domain ET POLICY DynDNS CheckIp External IP Address Server Response
|
|
17.2 |
M |
41 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
48962 |
2021-02-06 09:45
|
0502.gif.exe 900024080a53ea49f9f7cc6ef6a07d35 VirusTotal Malware |
|
|
|
|
0.8 |
M |
24 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
48963 |
2021-02-05 16:25
|
416212.jpg.exe c060ac2f2bd19dc69047ff5ee59e26ab |
|
|
|
|
0.2 |
|
|
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
48964 |
2021-02-05 16:24
|
416212_2.jpg.exe c060ac2f2bd19dc69047ff5ee59e26ab |
|
|
|
|
0.2 |
|
|
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
48965 |
2021-02-05 16:24
|
416212.jpg.exe c060ac2f2bd19dc69047ff5ee59e26ab |
|
|
|
|
0.2 |
|
|
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
48966 |
2021-02-05 16:21
|
CompensationClaim-693156957-02... ff400ee36939874c5276ed1f45a9d9ef VirusTotal Malware AutoRuns Code Injection Check memory Checks debugger buffers extracted ICMP traffic unpack itself Windows utilities suspicious process sandbox evasion WriteConsoleW Windows ComputerName |
|
10
bestivf.org(192.185.16.81) - malware loonytoys.com.ar(138.36.237.100) - malware www.balkanstar.com(213.222.37.34) - malware omnicomm.es(149.5.209.93) - malware gpccc.org(192.254.233.217) - malware 213.222.37.34 - malware 138.36.237.100 - malware 149.5.209.93 - malware 192.254.233.217 - malware 192.185.16.81 - malware
|
3
ET POLICY PE EXE or DLL Windows file download HTTP ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2 ET INFO EXE - Served Attached HTTP
|
|
10.0 |
M |
12 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
48967 |
2021-02-05 16:15
|
cred.dll 6582e6aa3d7e01ff5e2f481ee2e054fe FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Malicious Traffic Check memory Checks debugger unpack itself Email DNS Software |
1
http://185.215.113.205//4dcYcWsw3/index.php
|
1
185.215.113.205 - malware
|
|
|
6.0 |
M |
32 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
48968 |
2021-02-05 16:09
|
winlog6.exe 6b0c5e3a2bbb09961f5a85dcd1633129 Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Browser Email ComputerName Software |
1
http://minimini.us/kin/kin4/fre.php
|
2
minimini.us(185.147.80.225) - mailcious 185.147.80.225
|
7
ET MALWARE LokiBot User-Agent (Charon/Inferno) ET MALWARE LokiBot Checkin ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 ET MALWARE LokiBot Request for C2 Commands Detected M1 ET MALWARE LokiBot Request for C2 Commands Detected M2 ET MALWARE LokiBot Fake 404 Response
|
|
12.4 |
M |
17 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
48969 |
2021-02-05 16:00
|
winlog5.exe 57e47d9cc7e182ce53425dcf9f1c9dcc Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Windows Browser Email ComputerName DNS Cryptographic key Software |
1
http://becharnise.ir/fa16/fre.php - rule_id: 229
|
2
becharnise.ir(185.208.180.121) - mailcious 185.208.180.121 - mailcious
|
7
ET MALWARE LokiBot User-Agent (Charon/Inferno) ET MALWARE LokiBot Checkin ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 ET MALWARE LokiBot Request for C2 Commands Detected M1 ET MALWARE LokiBot Request for C2 Commands Detected M2 ET MALWARE LokiBot Fake 404 Response
|
1
http://becharnise.ir/fa16/fre.php
|
13.6 |
M |
14 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
48970 |
2021-02-05 16:00
|
winlog4.exe a4f8d3f0b19d856de27e5d7cbb0f88be Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware MachineGuid Malicious Traffic Check memory Creates executable files unpack itself AppData folder malicious URLs sandbox evasion installed browsers check Browser Email ComputerName Software |
1
http://ragnaar.us/zoro/zoro5/fre.php
|
2
ragnaar.us(18.235.92.123) - mailcious 18.235.92.123 - mailcious
|
4
ET MALWARE LokiBot User-Agent (Charon/Inferno) ET MALWARE LokiBot Checkin ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
|
|
9.2 |
M |
50 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
48971 |
2021-02-05 15:55
|
winlog2.exe 2a936923728f5fd2ec1b5f939de46120 VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows utilities AppData folder malicious URLs Windows DNS |
4
http://www.goldcrownusa.com/oean/?XPJPe42X=pUmEbu3IKOUGFvtrCIZjRWk6436aDPw+KW4dbjKSuorCDyyleci3FvmZCsvIM8MXNt2ja29m&EBZ=ZTFtdrihOFcT9 http://www.goldcrownusa.com/oean/ http://www.dailyxe.online/oean/?XPJPe42X=trxqf63QiRAOPTEgREOz9HmxielufoAcOjZkGPSPCrptGu31/LHI21c1IG1NZs2vRRa4kyQi&EBZ=ZTFtdrihOFcT9 http://www.dailyxe.online/oean/
|
9
www.whitehatiq.com(74.208.236.196) - mailcious www.dailyxe.online(172.67.169.183) www.goldcrownusa.com(182.50.132.242) www.freshmarketfood.com(154.216.110.171) - mailcious www.fuyigranuletion.com() 74.208.236.196 - mailcious 104.21.39.63 182.50.132.242 - mailcious 154.216.110.171 - mailcious
|
|
|
12.0 |
M |
43 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
48972 |
2021-02-05 15:54
|
winlog3.exe 509bf8a3232810d4d16e9b5fdd68e05c VirusTotal Malware suspicious privilege Malicious Traffic Check memory Creates executable files unpack itself AppData folder malicious URLs sandbox evasion |
3
http://www.externalboard.com/aky/?9rz8F4dH=kIGiJmNRWTfH9Gx6F/Kd+nRJBhN+z1MQ2CVxDNmwZRBVSLGwVeMbQhpvGFXUSfhQF+QLYYXK&t8bL=Bdg8Qhi8e83 http://www.bazarsurtidorico.com/aky/?9rz8F4dH=mGydh0cglsz7mG41Yqsb5NuiTFQT3ml/KDoBUKHKSrBmGHw8txZC2ZZZstne0AEnrVDkTunz&t8bL=Bdg8Qhi8e83 http://www.louisbmartinez100th.com/aky/?9rz8F4dH=Xdfa45Y3kxD49xcIJ/ryTe1bA70q77Ad/xwR/hBmlvipsdqw7FJxvpVc+U9ZYpEe7QeDLxdT&t8bL=Bdg8Qhi8e83
|
8
www.externalboard.com(3.223.115.185) www.jeiksaoeklea.com(64.227.81.172) www.bazarsurtidorico.com(108.179.194.68) www.louisbmartinez100th.com(34.80.190.141) 108.179.194.68 3.223.115.185 - mailcious 64.227.81.172 34.80.190.141 - mailcious
|
|
|
6.4 |
M |
20 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
48973 |
2021-02-05 15:48
|
winlog.exe 7cb46f0e5fcd0ec84487f094af9e2036 VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows utilities AppData folder malicious URLs Windows DNS |
1
http://www.littlefreecherokeelibrary.com/xle/?1bz=o8rLp&yVMpQLtX=j0kojX1nTZux2b1HYqSB4xQ7fy015qg6Jcg5Vz3N7HOgsUafVA3CrDc/D+ziA//+cZbRR/Sj
|
3
www.littlefreecherokeelibrary.com(198.49.23.144) www.theatomicshots.com(198.185.159.144) - mailcious 198.185.159.145 - mailcious
|
|
|
11.2 |
M |
26 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
48974 |
2021-02-05 15:47
|
veHKklzK74heP6u.exe 11350fa4a6c8b5dccd88e3c94c930ea9 VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process malicious URLs WriteConsoleW Windows ComputerName Cryptographic key crashed |
|
|
|
|
11.6 |
M |
19 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
48975 |
2021-02-05 15:38
|
vbc3.exe d931e8e3243b8a32c2b4b141231cdb02 Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Windows Browser Email ComputerName DNS Cryptographic key Software |
1
http://dickson--constant.com/chief/har/fre.php
|
2
dickson--constant.com(18.235.92.123) 18.235.92.123
|
4
ET MALWARE LokiBot User-Agent (Charon/Inferno) ET MALWARE LokiBot Checkin ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
|
|
13.0 |
M |
20 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|