popup

Cyber Threat Trends

  1. Day Week

Gemelli flickerflypro flickerfly

Summary: 2025/04/29 12:56

First reported date: 2021/04/08
Inquiry period : 2025/03/30 12:56 ~ 2025/04/29 12:56 (1 months), 3 search results

전 기간대비 67% 높은 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 screenshot 입니다.
기타 fc18b0a28b4bba428cb63e8c9432f8dbae758cb816e3324685c0371562bbb30 httpstcoEXnC thorscanner h4rmsw4yX above 등 신규 키워드도 확인됩니다.

Trend graph by period


Related keyword cloud
Top 100
# Trend Count Comparison
1screenshot 3 ▲ 2 (67%)
2fc18b0a28b4bba428cb63e8c9432f8dbae758cb816e3324685c0371562bbb30 1 ▲ new
3httpstcoEXnC 1 ▲ new
4thorscanner 1 ▲ new
5h4rmsw4yX 1 ▲ new
6above 1 ▲ new
7content 1 ▲ new
8Advertising 1 ▲ new
9DevMan 1 ▲ new
10Ransom 1 ▲ new
11portal 1 ▲ new
Special keyword group
Top 5
Malware Type
Malware Type

This is the type of malware that is becoming an issue.

No data.

Attacker & Actors
Attacker & Actors

The status of the attacker or attack group being issued.

No data.

Attack technique
Technique

This is an attack technique that is becoming an issue.

No data.

Country & Company
Country & Company

This is a country or company that is an issue.

No data.

Threat info
Last 5

SNS

(Total : 3)
  Total keyword

Advertising

No Title Date
1Dark Web Informer - Cyber Threat Intelligence @DarkWebInformer
What do you think of the new DevMan Ransom portal? Screenshot below.		2025.04.19
2MalwareHunterTeam @malwrhunterteam
"screenshot_0201_jpg.apk": fc18b0a28b4bba428cb63e8c9432f8dbae758cb816e3324685c0371562bbbb30 https://t.co/EXnC8HSORf		2025.04.16
3MalwareHunterTeam @malwrhunterteam
@thor_scanner @h4rmsw4yX On the screenshot you can see the above mentioned file's content after some deobfuscation. It first loads this: https://api.binplorer.com/getAddressHistory/0x9BC1355344B54DEDf3E44296916eD15653844509?apiKey=freekey&type=mint&limit=1 From that, it extracts the "transac		2025.04.16

News

(Total : 0)

No data.

Additional information

No Request Hash(md5) Report No Date
1test.pdf.lnk
Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM GIF Format Lnk Format PowerShell 		3b4cbac8dad90d932e233a89650530a0602652025.04.29
2test.pdf.lnk
Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM GIF Format Lnk Format PowerShell 		3b4cbac8dad90d932e233a89650530a0602662025.04.29
3 file4.exe
njRAT backdoor AsyncRAT Generic Malware task schedule Downloader Admin Tool (Sysinternals etc ...) .NET framework(MSIL) Malicious Packer ASPack Malicious Library UPX Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS S 		e08bd789d9f45b08fe924d94b955d869602702025.04.29
4 discord.exe
AsyncRAT task schedule Downloader .NET framework(MSIL) Malicious Packer UPX Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM PE File 		40364f9f27183ccdee75ff16ea322641602692025.04.29
5 random.exe
Gen1 Themida Generic Malware PhysicalDrive Downloader UPX Malicious Packer Malicious Library Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P 		bfd4ad6d57c086d2e64ccd39398a908e602442025.04.28
View only the last 5
Level Description
danger The process powershell.exe wrote an executable file to disk which it then attempted to execute
danger File has been identified by 32 AntiVirus engines on VirusTotal as malicious
watch A command shell or script process was created by an unexpected parent process
watch Communicates with host for which no DNS query was performed
watch Disables proxy possibly for traffic interception
watch Found URLs in memory pointing to an IP address rather than a domain (potentially indicative of Command & Control traffic)
watch One or more non-whitelisted processes were created
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a shortcut to an executable file
notice Creates a suspicious process
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
notice Potentially malicious URLs were found in the process memory dump
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Queries for the computername
info Uses Windows APIs to generate a cryptographic key
No data
No data
Beta Service, If you select keyword, you can check detailed information.