556 |
2024-08-28 03:04
|
r57.exe 6b9ea327b920218c777a34b3193826a2 UPX PE File PE32 VirusTotal Malware |
|
|
|
|
1.2 |
M |
54 |
guest
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
557 |
2024-08-27 22:18
|
360.exe 7645db87b80a529917917a893dce7cc8 Generic Malware Malicious Library UPX PE File PE32 Malware download VirusTotal Malware AutoRuns Creates executable files ICMP traffic RWX flags setting unpack itself AppData folder Windows DNS crashed |
|
7
google.com(142.250.206.206) lqwljs.cn() - mailcious sjlwql.top() fget-career.com(34.253.216.9) - mailcious 34.253.216.9 142.250.76.14 1.15.110.72
|
2
ET MALWARE Win32/Ramnit Checkin ET DNS Query to a *.top domain - Likely Hostile
|
|
7.6 |
|
66 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
558 |
2024-08-27 22:14
|
66cd1d485d44c_lsfjf3n.exe 50d8852654d517f75977552d4a606941 Antivirus ScreenShot AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware PDB Code Injection Check memory Checks debugger buffers extracted unpack itself |
|
|
|
|
7.0 |
M |
22 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
559 |
2024-08-27 19:35
|
msvci70.dll ca3a59d92f479a17e5ca6a0e13896846 UPX PE File DLL PE32 PDB Check memory |
|
|
|
|
0.4 |
|
|
guest
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
560 |
2024-08-27 15:32
|
66cc6466906a0_ww9.exe#kis9 865adfa302bfc57219c6541aebbfa1c9 Stealc Client SW User Data Stealer Gen1 ftp Client info stealer Generic Malware Malicious Library UPX Malicious Packer Http API PWS AntiDebug AntiVM PE File .NET EXE PE32 DLL OS Processor Check Browser Info Stealer Malware download FTP Client Info Stealer Vidar VirusTotal Malware c&c PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Collect installed applications Check virtual network interfaces suspicious process sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Stealc Stealer Windows Browser ComputerName DNS Software plugin |
10
http://193.176.190.41/9e7fbd3f0393ef32/nss3.dll http://193.176.190.41/ - rule_id: 42195 http://193.176.190.41/9e7fbd3f0393ef32/freebl3.dll http://193.176.190.41/9e7fbd3f0393ef32/softokn3.dll http://193.176.190.41/9e7fbd3f0393ef32/msvcp140.dll http://193.176.190.41/2fa883eebd632382.php - rule_id: 42194 http://193.176.190.41/9e7fbd3f0393ef32/sqlite3.dll http://x1.i.lencr.org/ http://193.176.190.41/9e7fbd3f0393ef32/vcruntime140.dll http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll
|
5
aldiablo.cl(186.64.114.115) - malware x1.i.lencr.org(23.52.33.11) 193.176.190.41 - mailcious 186.64.114.115 - malware 23.35.220.247
|
17
ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in ET MALWARE Win32/Stealc Requesting browsers Config from C2 ET MALWARE Win32/Stealc Active C2 Responding with browsers Config M1 ET MALWARE Win32/Stealc Requesting plugins Config from C2 ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 ET MALWARE Win32/Stealc Submitting System Information to C2 ET INFO Dotted Quad Host DLL Request ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity ET POLICY PE EXE or DLL Windows file download HTTP ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity ET MALWARE Win32/Stealc Submitting Screenshot to C2
|
2
http://193.176.190.41/ http://193.176.190.41/2fa883eebd632382.php
|
16.4 |
M |
40 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
561 |
2024-08-27 15:30
|
qqlive_kvdun_108411.exe 7609af2419ddda223fa0685d13590303 Generic Malware PhysicalDrive Malicious Library Admin Tool (Sysinternals etc ...) UPX Downloader Malicious Packer Antivirus Anti_VM PE File PE32 OS Processor Check PNG Format BMP Format DLL VirusTotal Malware PDB Check memory Creates executable files unpack itself Windows utilities AppData folder sandbox evasion China Interception Windows Browser Remote Code Execution |
4
http://dldir1.qq.com/qqtv/azdk/mon_inst.ini http://dldir1.qq.com/qqtv/downloader/pcmgrdlcore.zip?time=1724759316 http://dldir1.qq.com/qqtv/azdk/mon_pro.ini http://cache.tv.qq.com/conf/config.ini?time=1724759316
|
5
cache.tv.qq.com(23.221.111.74) dldir1.qq.com(58.216.28.65) btrace.qq.com(0.0.0.1) 58.216.28.65 2.18.153.44
|
|
|
8.0 |
M |
29 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
562 |
2024-08-27 15:26
|
leto.exe a854823ade2ebde26f0869fdd05c5cce Amadey Stealc Gen1 Themida Packer Generic Malware Downloader Malicious Library UPX Malicious Packer Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogg Browser Info Stealer Malware download Amadey FTP Client Info Stealer Vidar VirusTotal Email Client Info Stealer Malware c&c AutoRuns MachineGuid Code Injection Malicious Traffic Check memory Checks debugger Creates executable files unpack itself Checks Bios Collect installed applications Detects VMWare suspicious process AppData folder sandbox evasion VMware anti-virtualization installed browsers check Stealc Stealer Windows Browser Email ComputerName DNS Software crashed plugin |
10
http://185.215.113.100/0d60be0de163924d/sqlite3.dll http://185.215.113.100/0d60be0de163924d/nss3.dll http://185.215.113.100/0d60be0de163924d/freebl3.dll http://185.215.113.100/0d60be0de163924d/vcruntime140.dll http://31.41.244.10/Dem7kTu/index.php - rule_id: 42202 http://185.215.113.100/0d60be0de163924d/msvcp140.dll http://185.215.113.100/ - rule_id: 41969 http://185.215.113.100/0d60be0de163924d/mozglue.dll http://185.215.113.100/0d60be0de163924d/softokn3.dll http://185.215.113.100/e2b1563c6670f193.php - rule_id: 41968
|
3
31.41.244.10 - malware 185.215.113.100 - mailcious 31.41.244.11 - mailcious
|
20
ET DROP Spamhaus DROP Listed Traffic Inbound group 33 ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in ET MALWARE Win32/Stealc Requesting browsers Config from C2 ET MALWARE Win32/Stealc Active C2 Responding with browsers Config M1 ET MALWARE Win32/Stealc Requesting plugins Config from C2 ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 ET MALWARE Win32/Stealc Submitting System Information to C2 ET INFO Dotted Quad Host DLL Request ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity ET POLICY PE EXE or DLL Windows file download HTTP ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity ET DROP Spamhaus DROP Listed Traffic Inbound group 2 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity ET INFO Executable Download from dotted-quad Host ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
|
3
http://31.41.244.10/Dem7kTu/index.php http://185.215.113.100/ http://185.215.113.100/e2b1563c6670f193.php
|
16.8 |
M |
29 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
563 |
2024-08-27 15:25
|
restart1.exe a53afb86a8787bf91dcb86a37dd4ba0b Generic Malware Malicious Library UPX PE File PE32 OS Processor Check VirusTotal Malware PDB |
|
|
|
|
1.2 |
M |
34 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
564 |
2024-08-27 15:24
|
Aquarius.exe a18fe6fa6a9296ba8faf7e7dcfd5d0f8 Gen1 Generic Malware task schedule Downloader Malicious Library UPX Admin Tool (Sysinternals etc ...) .NET framework(MSIL) Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet VirusTotal Malware AutoRuns Code Injection Check memory Checks debugger Creates executable files unpack itself Windows utilities suspicious process AppData folder malicious URLs WriteConsoleW Windows Java |
|
|
|
|
8.6 |
M |
55 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
565 |
2024-08-27 15:23
|
penguin.exe bbb6c17b5412df1003825be613b20a38 Generic Malware Malicious Library Malicious Packer UPX PE File PE64 OS Processor Check VirusTotal Malware PDB DNS |
|
1
131.153.76.130 - mailcious
|
|
|
1.2 |
M |
4 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
566 |
2024-08-27 15:22
|
csrss.exe a1c95767e2aae895bca002778203b26e Generic Malware Suspicious_Script_Bin Malicious Library UPX PE File PE32 OS Processor Check VirusTotal Malware AutoRuns Checks debugger Creates executable files unpack itself AppData folder Windows |
|
|
|
|
3.8 |
M |
37 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
567 |
2024-08-27 15:21
|
Minecom.exe 08147f2060315f23b4b5e6daeef11f66 UPX PE File .NET EXE PE32 OS Processor Check Malware suspicious privilege MachineGuid Malicious Traffic Check memory Checks debugger unpack itself Check virtual network interfaces AntiVM_Disk VM Disk Size Check ComputerName |
1
http://www.onlinesupportforroad.com/wsio.txt
|
2
www.onlinesupportforroad.com(193.31.116.186) - mailcious 193.31.116.186 - mailcious
|
|
|
3.8 |
M |
|
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
568 |
2024-08-27 15:21
|
2.exe 31fa727012b592325d876a801c0f1f83 Generic Malware Malicious Library UPX PE File PE32 OS Processor Check PE64 VirusTotal Cryptocurrency Miner Malware Cryptocurrency AutoRuns PDB Creates executable files unpack itself AppData folder Tofsee Windows Remote Code Execution DNS crashed CoinMiner |
1
https://bitbucket.org/olkfsd/vsdavdcs/raw/697f8aa216d03a176165f4890646ad43917554f1/macanfilter
|
4
pool.hashvault.pro(125.253.92.50) - mailcious
bitbucket.org(104.192.140.26) - malware 104.192.140.26 - mailcious
131.153.76.130 - mailcious
|
3
ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET POLICY Cryptocurrency Miner Checkin
|
|
4.0 |
M |
35 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
569 |
2024-08-27 15:17
|
leks.dll 6034e37cba0561fc20d10700e5d9cc02 Generic Malware Malicious Library UPX PE File DLL PE64 OS Processor Check VirusTotal Malware unpack itself crashed |
|
|
|
|
1.8 |
M |
32 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
570 |
2024-08-27 15:16
|
66cc3862316e2_vaiwkl.exe#d15 b487d459d6a3fe60ff7bb30aa3938370 Stealc Client SW User Data Stealer LokiBot ftp Client info stealer Antivirus Malicious Library Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 FTP Client Info Stealer VirusTotal Malware Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Software |
1
https://steamcommunity.com/profiles/76561199761128941 - rule_id: 42293
|
5
t.me(149.154.167.99) - mailcious steamcommunity.com(173.222.146.99) - mailcious 149.154.167.99 - mailcious 184.26.241.154 - mailcious 94.130.188.148
|
3
ET INFO Observed Telegram Domain (t .me in TLS SNI) SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET INFO TLS Handshake Failure
|
1
https://steamcommunity.com/profiles/76561199761128941
|
15.6 |
M |
41 |
ZeroCERT
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|