Skip to content
KitploitKITPLOIT
도구블로그
제출
도구블로그
제출

해킹, 침투 테스트 및 사이버 보안 도구를 당신의 보안 무기고에!

Kitploit은 해킹, 사이버 보안 및 침투 테스트 도구 디렉토리입니다. 최신 프로젝트 업데이트를 발견하여 취약점을 찾고, 시스템을 분석하고, 테스트를 자동화하고, 보안을 강화하세요.

··피드·문의·개인정보·© 2026 Kitploit

도구 디렉토리

카테고리

모든 카테고리 보기
Loading categories
도구/GitHubGitHub/corelight/zeek-strrat-detector
Defensive ToolsNetwork SecurityMalware AnalysisThreat IntelligenceIntrusion Detection
GitHubcorelight/zeek-strrat-detector

zeek-strrat-detector

Zeek 기반 STRRAT 악성코드 탐지기.

저장소 보기
12311개월 전아직 검토되지 않음

인기

모두 보기 →

커뮤니티에서 가장 많이 사용되는 도구를 찾아보세요.

모든 도구 탐색

도구 컬렉션을 둘러보세요

모든 도구 보기 →
공유

Zeek 기반 STRRAT 악성코드 탐지기

Zeek Spicy 기반 STRRAT 악성코드 탐지기입니다.

PCAP

  • https://app.any.run/tasks/4423258f-59bc-4a88-bfec-d8ac08c88538/#

예제 출력

root@kitploit:~
% zeek -Cr strrat-4423258f-59bc-4a88-bfec-d8ac08c88538.pcap zeek-strrat-detector

% cat notice.log
#separator \x09
#set_separator	,
#empty_field	(empty)
#unset_field	-
#path	notice
#open	2024-03-07-10-42-56
#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	fuid	file_mime_type	file_desc	proto	note	msg	sub	src	dst	p	n	peer_descr	actions	email_dest	suppress_for	remote_location.country_code	remote_location.region	remote_location.city	remote_location.latitude	remote_location.longitude
#types	time	string	addr	port	addr	port	string	string	string	enum	enum	string	string	addr	addr	port	count	string	set[enum]	set[string]	interval	string	string	string	double	double
1709664364.822047	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664371.522546	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|2 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664376.710978	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664381.522421	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|2 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664386.522601	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|1 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664391.522645	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|VHJhbnNhY3Rpb24gd2l0aCBSZWZlcmVuY2U=|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664396.522605	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664401.698316	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|3 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664406.522376	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|8 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664411.701275	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|13 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664416.522541	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|18 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664421.522582	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|23 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664426.522543	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664431.522610	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|2 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664436.522502	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664441.522741	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664446.522456	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664451.523442	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664456.707135	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664464.707113	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664466.522505	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664471.522655	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664476.522622	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|1 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664481.522594	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664486.522380	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664491.522465	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|1 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664496.522438	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|Not Idle	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664501.522813	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|1 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664506.522775	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|U2VsZWN0IFdpbmRvd3MgUG93ZXJTaGVsbA==|1.6|DE:Germany|Not Installed|Not Idle192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664511.522341	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|1 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664517.522529	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|3 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664521.710039	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|8 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664526.522818	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|13 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664531.522596	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|18 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664536.522366	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|23 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
1709664541.522567	Cgemrk320YLbiOonOd	192.168.100.11	49227	185.255.114.40	8219	-	-	-	tcp	STRRAT::C2_Traffic_Observed	Potential STRRAT C2 between source 192.168.100.11 and dest 185.255.114.40 with is_orig T and payload in the sub field.	ping|STRRAT|C4BA3647|USER-PC|admin|Microsoft Windows 7 Professional|32-bit|nan-av|V2luZG93cyBQb3dlclNoZWxs|1.6|DE:Germany|Not Installed|28 Sec	192.168.100.11	185.255.114.40	8219	-	-	Notice::ACTION_LOG	(empty)	3600.000000	-	-	-	-	-
#close	2024-03-07-10-42-56
도구 다운로드