corelight/zeek-strrat-detectorكاشف برمجيات خبيثة STRRAT مبني على Zeek.
هذا كاشف لبرمجية STRRAT الخبيثة مبني على Zeek Spicy.
% zeek -Cr strrat-4423258f-59bc-4a88-bfec-d8ac08c88538.pcap zeek-strrat-detector
% cat notice.log
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path notice
#open 2024-03-07-10-42-56
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions email_dest suppress_for remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] set[string] interval string string string double double
1709664364.822047 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle 192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1709664371.522546 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|2 Sec 192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1709664376.710978 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle 192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1709664381.522421 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|2 Sec 192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1709664386.522601 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|1 Sec 192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1709664391.522645 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|VHJhbnNhY3Rpb24gd2l0aCBSZWZlcmVuY2U=|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1709664396.522605 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1709664401.698316 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|3 Sec 192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1709664406.522376 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|8 Sec 192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1709664411.701275 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|13 Sec 192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1709664416.522541 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|18 Sec 192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1709664421.522582 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|23 Sec 192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1709664426.522543 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1709664431.522610 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|2 Sec 192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1709664436.522502 Cgemrk320YLbiOonOd 192.168.100.11 49227 185.255.114.40 8219 - - - tcp STRRAT::C2_Traffic_Observed Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field. ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle 192.168.100.11 185.255.114.40 8219 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -