General
- Target https://de.rutrust.org
- Sample260814-3eckesbk8y
Score
7/10
Malware Config
Targets
-
- Target https://de.rutrust.org
Score7/10Outbound SSH connection to public host
SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.