Skip to content
KitploitKITPLOIT
أدواتالمدونة
إرسال
أدواتالمدونة
إرسال

أدوات الاختراق واختبار الاختراق والأمن السيبراني لترسانتك الأمنية!

Kitploit هو دليل لأدوات الاختراق والأمن السيبراني واختبار الاختراق. اكتشف آخر تحديثات المشاريع للعثور على الثغرات وتحليل الأنظمة وأتمتة الاختبارات وتعزيز أمنك.

··الخلاصات·اتصال·الخصوصية·© 2026 Kitploit

دليل الأدوات

الفئات

عرض جميع الفئات
Loading categories
zeek-strrat-detector — كاشف برمجيات خبيثة STRRAT مبني على Zeek. | Kitploit
أدوات/GitHubGitHub/corelight/zeek-strrat-detector
أدوات دفاعيةأمن الشبكاتتحليل البرمجيات الخبيثةاستخبارات التهديداتكشف التسلل
GitHubcorelight/zeek-strrat-detector

zeek-strrat-detector

كاشف برمجيات خبيثة STRRAT مبني على Zeek.

عرض المستودع
12منذ 10 أشهرلم تتم المراجعة بعد

الأكثر شعبية

عرض الكل →

اكتشف الأدوات الأكثر استخدامًا من قبل مجتمعنا.

استكشف جميع الأدوات

تصفح مجموعتنا من الأدوات

عرض جميع الأدوات →
مشاركة

كاشف برمجية STRRAT الخبيثة القائم على Zeek

هذا كاشف لبرمجية STRRAT الخبيثة مبني على Zeek Spicy.

PCAP

  • https://app.any.run/tasks/4423258f-59bc-4a88-bfec-d8ac08c88538/#

مثال على المخرجات

root@kitploit:~
% zeek -Cr strrat-4423258f-59bc-4a88-bfec-d8ac08c88538.pcap zeek-strrat-detector

% cat notice.log
#separator \x09
#set_separator	,
#empty_field	(empty)
#unset_field	-
#path	notice
#open	2024-03-07-10-42-56
#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	fuid	file_mime_type	file_desc	proto	note	msg	sub	src	dst	p	n	peer_descr	actions	email_dest	suppress_for	remote_location.country_code	remote_location.region	remote_location.city	remote_location.latitude	remote_location.longitude
#types	time	string	addr	port	addr	port	string	string	string	enum	enum	string	string	addr	addr	port	count	string	set[enum]	set[string]	interval	string	string	string	double	double
1709664364.822047	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664371.522546	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|2 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664376.710978	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664381.522421	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|2 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664386.522601	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|1 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664391.522645	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|VHJhbnNhY3Rpb24gd2l0aCBSZWZlcmVuY2U=|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664396.522605	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664401.698316	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|3 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664406.522376	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|8 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664411.701275	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|13 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664416.522541	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|18 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664421.522582	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|23 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664426.522543	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664431.522610	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|2 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664436.522502	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664441.522741	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664446.522456	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664451.523442	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664456.707135	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664464.707113	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664466.522505	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664471.522655	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664476.522622	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|1 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664481.522594	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664486.522380	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664491.522465	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|1 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664496.522438	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664501.522813	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|1 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664506.522775	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664511.522341	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|1 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664517.522529	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|3 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664521.710039	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|8 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664526.522818	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|13 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664531.522596	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|18 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664536.522366	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|23 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664541.522567	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|28 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
#close	2024-03-07-10-42-56
تنزيل الأداة