JoeSandbox

Flows from PureLogs infection in CapLoader

PureLogs Forensics

| | 38d29f5ac47583f39a2ff5dc1c366f7d, 3b5074b1b5d032e5620f69f9f700ff0e, 8d7729ca0b25a677287076b4461304a21813e6f15053e190975512e58754988f, 91.92.120.101, ANY.RUN, fc8b0ee149027c4c02f7d44cc06cade3222bb6b6, JoeSandbox, PureCrypter, PureLogs, t12d210700_76e208dd3e22_2dae41c691ec
I analyzed some PureLogs Stealer malware infections this morning and found some interesting behavior and artifacts that I want to share. PureLogs infections sometimes start with a dropper/downloader (PureCrypter) that retrieves a ...
NETRESEC Network Security Blog
NetworkMiner 2.7.3

NetworkMiner 2.7.3 Released

| | 6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c, Abuse.ch, BitRAT, carve, Cobalt Strike, CobaltStrike, DBSBL, DNSBL, Emotet, FileScan.IO, JA3, JoeSandbox, memdump, meterpreter, NetworkMiner, NetworkMinerCLI, OSINT, PIPI, Protocol Detection, Qbot, RFC8422, TrickBot, unfurl, X.509
NetworkMiner now extracts meterpreter payloads from reverse shells and performs offline lookups of JA3 hashes and TLS certificates. Our commercial tool, NetworkMiner Professional, additionally comes with a packet carver that extracts network ...
NETRESEC Network Security Blog