Report Overview

  1. Submitted URL

    github.com/S3cur3Th1sSh1t/Creds/blob/master/Ghostpack/SafetyKatz.exe?raw=true

  2. IP

    140.82.121.4

    ASN

    #36459 GITHUB

  3. Submitted

    2023-10-03T10:16:56Z

    Access

    public

  4. Website Title

    about:privatebrowsing

  5. Final URL

    about:privatebrowsing

  6. Tags

    None

  7. urlquery detections

    No alerts detected

Detections

  1. urlquery

    0

  2. Network Intrusion Detection

    0

  3. Threat Detection Systems

    3

Domain Summary

Domain Rank First Seen Last Seen
github.com (2) 1423 2016-07-13 12:28:22 2023-09-20 18:48:10
raw.githubusercontent.com (1) 35802 2014-03-01 08:08:08 2023-10-02 18:32:49

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules
Severity Indicator Alert
medium raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/Ghostpack/SafetyKatz.exe The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SafetyKatz project.
medium raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/Ghostpack/SafetyKatz.exe Detects c# red/black-team tools via typelibguid
medium raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/Ghostpack/SafetyKatz.exe Windows.Hacktool.SafetyKatz

OpenPhish

No alerts detected


PhishTank

No alerts detected


Fortinet's Web Filter

No alerts detected


mnemonic secure dns

No alerts detected


Quad9 DNS

No alerts detected


ThreatFox

No alerts detected


Files detected

  1. URL

    raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/Ghostpack/SafetyKatz.exe

  2. IP

    185.199.110.133

  3. ASN

    #54113 FASTLY

  1. File type

    PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows\012- data

    Size

    2059264

  2. Hash

    e615c10b8676ae8cd10768beae1e41d4

    aee671334f6d7c53be7c0ea2b49ecbe7c204f0d6

    52779c376bb2803a0bac90302d5bc82a4213aca88a0072166b04ef0fdccb7814

    Detections

    Analyzer Verdict Alert
    Public Nextron YARA rules malware
    The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SafetyKatz project.
    Public Nextron YARA rules malware
    Detects c# red/black-team tools via typelibguid
    Elastic Security YARA Rules malware
    Windows.Hacktool.SafetyKatz
    VirusTotal malicious

JavaScript (0)

HTTP Transactions (3)

URL IP Response Size
github.com/S3cur3Th1sSh1t/Creds/blob/master/Ghostpack/SafetyKatz.exe?raw=true
140.82.121.4 302 Found 0
github.com/S3cur3Th1sSh1t/Creds/raw/master/Ghostpack/SafetyKatz.exe
140.82.121.4 302 Found 0
raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/Ghostpack/SafetyKatz.exe
185.199.110.133 200 OK 2059264