Incident title: W32/Kryptik.HUQW!tr found on 45.66.230.36
Subcategory: Persistence
Target: 45.66.2 ...
show moreIncident title: W32/Kryptik.HUQW!tr found on 45.66.230.36
Subcategory: Persistence
Target: 45.66.230.36
Last Occurred: Sep 19, 2023, 10:18:00 AM
show less
Malware Sent by this IP
Malware Name: NSIS/Injector.RGRS!tr
Incident Title:
Not remediated Mal ...
show moreMalware Sent by this IP
Malware Name: NSIS/Injector.RGRS!tr
Incident Title:
Not remediated Malware NSIS/Injector.RGRS!tr found on 194.180.48.29
Subcathegory: Persistence
show less
W32/Kryptik.HUQW!tr found.
subtype="virus" eventtype="infected" msg="MIME header detected to hav ...
show moreW32/Kryptik.HUQW!tr found.
subtype="virus" eventtype="infected" msg="MIME header detected to have a virus and blocked." action="attachment-removed" service="SMTP" srcip=141.98.6.186 srcport=53264 srccountry="Netherlands"
show less
Found Phishing Virus HTML/Phish.TVF!tr
subtype="virus" eventtype="infected" level="warning" msg= ...
show moreFound Phishing Virus HTML/Phish.TVF!tr
subtype="virus" eventtype="infected" level="warning" msg="MIME header detected to have a virus and blocked." action="attachment-removed" service="SMTP" srcip=38.170.239.61 dstip=10.0.0.125 srcport=52203 dstport=25
show less
This IP scans for open ports then it's trying to establish connection by brute-force from the open p ...
show moreThis IP scans for open ports then it's trying to establish connection by brute-force from the open ports it founded.
"213.226.123.188 on port 64470"
show less
This IP is scanning for open ports then from the ports it founded, it's trying to establish connecti ...
show moreThis IP is scanning for open ports then from the ports it founded, it's trying to establish connection by brute-force
"213.226.123.144 on port 63928"
show less
This is a CnC, which is establishing connection with owaproxy.exe (malicious ransomware)
Parent-Chi ...
show moreThis is a CnC, which is establishing connection with owaproxy.exe (malicious ransomware)
Parent-Child process is below:
wininit.exe > services.exe > owaproxy.exe > connection to 185.216.71.78 via 48878 port.
show less
Client had a suspicious third party on code.exe this party tries to download suspicious script via p ...
show moreClient had a suspicious third party on code.exe this party tries to download suspicious script via powershell. Tries to connect to this IP
explorer.exe > Code.exe > cmd.exe > powershell.exe > Connection to 152.199.19.161
powershell arguements are below
"powershell.exe -NoProfile -ExecutionPolicy unrestricted -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12 ; & 'c:\Users\*****\.vscode\extensions\ms-dotnettools.vscode-dotnet-runtime-1.6.0\dist\install scripts\dotnet-install.ps1' -InstallDir 'c:\Users\*****\AppData\Roaming\Code\User\globalStorage\ms-dotnettools.vscode-dotnet-runtime\.dotnet\6.0.16' -Version 6.0.16 -Runtime dotnet }"
show less
Hacking
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.