Report Overview
Visitedpublic
2025-10-25 23:15:41
Tags
Submit Tags
URL
120.25.163.165:8080/mimikatz_trunk/Win32/mimikatz.exe
Finishing URL
about:privatebrowsing
IP / ASN
120.25.163.165
Title
about:privatebrowsing
Detections
urlquery
0
Network Intrusion Detection
6
Threat Detection Systems
8
Host Summary
| Host | Rank | Registered | First Seen | Last Seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
120.25.163.165 8 alert(s) on this Host | unknown | unknown | No data | No data | 437 B | 1.1 MB | 120.25.163.165 |    |
Microsoft ASP.NET (Web frameworks)
ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.IIS:10.0 (Web servers)
Internet Information Services (IIS) is an extensible web server software created by Microsoft for use with the Windows NT family.Windows Server (Operating systems)
Windows Server is a brand name for a group of server operating systems.Related reports
Network Intrusion Detection Systems
Suricata /w Emerging Threats Pro
| Timestamp | Severity | Source IP | Destination IP | Alert |
|---|---|---|---|---|
| high |  172.18.0.16 | 120.25.163.165 | ETPRO MALWARE Observed GET Request for mimikatz.exe | |
| high | 172.18.0.16 | 120.25.163.165 | URLhaus Known malware download URL detected (3192568) | |
| medium | 172.18.0.16 | 120.25.163.165 | ET INFO Executable Download from dotted-quad Host | |
| high | 120.25.163.165 | 172.18.0.16 | ET POLICY PE EXE or DLL Windows file download HTTP | |
| medium | 120.25.163.165 | 172.18.0.16 | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response | |
| high | 120.25.163.165 | 172.18.0.16 | ET MALWARE Mimikatz x86 Executable Download Over HTTP |
Threat Detection Systems
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| Nextron YARA rules | 120.25.163.165:8080/mimikatz_trunk/Win32/mimikatz.exe | malware | mimikatz |
| Nextron YARA rules | 120.25.163.165:8080/mimikatz_trunk/Win32/mimikatz.exe | malware | Detects Mimikatz strings |
| Nextron YARA rules | 120.25.163.165:8080/mimikatz_trunk/Win32/mimikatz.exe | malware | Detects mimikatz icon in PE file |
| Nextron YARA rules | 120.25.163.165:8080/mimikatz_trunk/Win32/mimikatz.exe | malware | Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible) |
| Nextron YARA rules | 120.25.163.165:8080/mimikatz_trunk/Win32/mimikatz.exe | malware | Detects Mimikatz by using some special strings |
| YARAhub by abuse.ch | 120.25.163.165:8080/mimikatz_trunk/Win32/mimikatz.exe | malware | meth_stackstrings |
| Elastic Security YARA rules | 120.25.163.165:8080/mimikatz_trunk/Win32/mimikatz.exe | malware | Windows.Hacktool.Mimikatz |
| ClamAV | 120.25.163.165:8080/mimikatz_trunk/Win32/mimikatz.exe | malicious | Win.Dropper.Mimikatz-9778171-1 |
File detected
URL
120.25.163.165:8080/mimikatz_trunk/Win32/mimikatz.exe
IP / ASN
120.25.163.165
File Overview
File TypePE32 executable (console) Intel 80386, for MS Windows, 5 sections
Size1.1 MB (1084416 bytes)
MD5ab9b9561a7c762f4d4f6b4f0f1d0e76d
SHA165587aebc325f61602a3a74ef84b6e7d8657e9c3
Detections
| Analyzer | Verdict | Alert |
|---|---|---|
| Public Nextron YARA rules | malware | mimikatz |
| Public Nextron YARA rules | malware | Detects Mimikatz strings |
| Public Nextron YARA rules | malware | Detects mimikatz icon in PE file |
| Public Nextron YARA rules | malware | Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible) |
| Public Nextron YARA rules | malware | Detects Mimikatz by using some special strings |
| YARAhub by abuse.ch | malware | meth_stackstrings |
| Elastic Security YARA Rules | malware | Windows.Hacktool.Mimikatz |
| ClamAV | malicious | Win.Dropper.Mimikatz-9778171-1 |
JavaScript (0)
No JavaScripts
HTTP Transactions (1)
| URL | IP | Response | Size |
|---|