VirusTotal

LD-Deceptive Mail Detected

March 17, 2026

SOC SIEM EDR Log Analysis Phishing AsyncRAT Escalation to L2 True Positive VirusTotal AbuseIPDB

A phishing email with a password-protected ZIP delivered AsyncRAT via a SILENTBUILDER dropper. The victim executed the payload, establishing an active C2 channel and triggering full host reconnaissance before containment.

LD-Malicious Attachment Detected

March 16, 2026

SOC SIEM EDR Phishing CVE-2017-11882 Xlsx JuicyPotato RCE True Positive VirusTotal AbuseIPDB

Investigation of a phishing email delivering a malicious Excel attachment exploiting CVE-2017-11882, leading to payload download and privilege escalation via JuicyPotato

LD-Suspicious PowerShell Script Executed

March 14, 2026

SOC SIEM EDR PowerShell Fileless Malware Sandbox Evasion True Positive VirusTotal

User Tony downloaded and executed a malicious PowerShell script (payload_1.ps1 / agent3.ps1) classified as trojan.powershell/boxter (Azorult family). The script bypassed execution policy, then fetched and invoked a second-stage payload from kionagranada.com (161.22.46.148), establishing a two-stage C2 chain with a final pivot to 91.236.116.163.

↑