Report - bcc-kz.kz/akciya.kz.exe

Report Overview

Visitedpublic

2023-08-28 04:49:54

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
bcc-kz.kz	unknown	2023-06-17	2023-08-25 13:27:23	2023-08-28 06:47:16	479 B	1.3 MB	195.210.46.20

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2023-08-28	medium	bcc-kz.kz/akciya.kz.exe	mimikatz
2023-08-28	medium	bcc-kz.kz/akciya.kz.exe	Detects Mimikatz strings
2023-08-28	medium	bcc-kz.kz/akciya.kz.exe	Detects Mimikatz SkeletonKey in Memory
2023-08-28	medium	bcc-kz.kz/akciya.kz.exe	Detects mimikatz icon in PE file
2023-08-28	medium	bcc-kz.kz/akciya.kz.exe	Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)
2023-08-28	medium	bcc-kz.kz/akciya.kz.exe	Detects Mimikatz by using some special strings
2023-08-28	medium	bcc-kz.kz/akciya.kz.exe	Windows.Hacktool.Mimikatz
2023-08-28	medium	bcc-kz.kz/akciya.kz.exe	Windows.Hacktool.Mimikatz
2023-08-28	medium	bcc-kz.kz/akciya.kz.exe	Detects win.mimikatz.

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

File detected

URL

bcc-kz.kz/akciya.kz.exe

IP / ASN

195.210.46.20

#48716 PS Internet Company LLC

File Overview

File TypePE32+ executable (console) x86-64, for MS Windows\012- data

Size1.3 MB (1250056 bytes)

MD5e930b05efe23891d19bc354a4209be3e

SHA1d1f7832035c3e8a73cc78afd28cfd7f4cece6d20

SHA25692804faaab2175dc501d73e814663058c78c0a042675a8937266357bcfb96c50

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	mimikatz
Public Nextron YARA rules	malware	Detects Mimikatz strings
Public Nextron YARA rules	malware	Detects Mimikatz SkeletonKey in Memory
Public Nextron YARA rules	malware	Detects mimikatz icon in PE file
Public Nextron YARA rules	malware	Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)
Public Nextron YARA rules	malware	Detects Mimikatz by using some special strings
Elastic Security YARA Rules	malware	Windows.Hacktool.Mimikatz
Elastic Security YARA Rules	malware	Windows.Hacktool.Mimikatz
Malpedia's yara-signator rules	malware	Detects win.mimikatz.
VirusTotal	malicious	VirusTotal - Scan result 58/71

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET bcc-kz.kz/akciya.kz.exe

195.210.46.20

200 OK

1.3 MB

URL

bcc-kz.kz/akciya.kz.exe

IP / ASN

195.210.46.20

#48716 PS Internet Company LLC

Requested byN/A

Resource Info

File typePE32+ executable (console) x86-64, for MS Windows\012- data

First Seen2023-05-03

Last Seen2025-05-29

Times Seen282

Size1.3 MB (1250056 bytes)

MD5e930b05efe23891d19bc354a4209be3e

SHA1d1f7832035c3e8a73cc78afd28cfd7f4cece6d20

SHA25692804faaab2175dc501d73e814663058c78c0a042675a8937266357bcfb96c50

Certificate Info

IssuerLet's Encrypt

Subjectbcc-kz.kz

Fingerprint3D:DC:87:A8:B5:6E:3F:74:DC:8B:8A:12:F5:A8:34:D5:05:8C:29:AE

ValidityFri, 25 Aug 2023 08:35:52 GMT - Thu, 23 Nov 2023 08:35:51 GMT

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	mimikatz
Public Nextron YARA rules	malware	Detects Mimikatz strings
Public Nextron YARA rules	malware	Detects Mimikatz SkeletonKey in Memory
Public Nextron YARA rules	malware	Detects mimikatz icon in PE file
Public Nextron YARA rules	malware	Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)
Public Nextron YARA rules	malware	Detects Mimikatz by using some special strings
Elastic Security YARA Rules	malware	Windows.Hacktool.Mimikatz
Elastic Security YARA Rules	malware	Windows.Hacktool.Mimikatz
Malpedia's yara-signator rules	malware	Detects win.mimikatz.
VirusTotal	malicious	VirusTotal - Scan result 58/71

HTTP Headers

GET /akciya.kz.exe HTTP/1.1
Host: bcc-kz.kz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Mon, 28 Aug 2023 04:49:37 GMT
content-type: application/octet-stream
content-length: 1250056
last-modified: Mon, 28 Aug 2023 04:48:26 GMT
etag: "64ec271a-131308"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-content-type-options: nosniff
x-powered-by: PleskLin
accept-ranges: bytes
X-Firefox-Spdy: h2