Home
Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide
2020-06-10
Version history
2020-06-10
login
popup
Submissions
10
15
20
50
Request
Connection
hash(md5,sha256)
Signature
PE API
Tag or IDS
Icon
user nickname
Date range button:
Date range picker
First seen:
Last seen:
No
Date
Request
Urls
Hosts
IDS
Rule
Score
Zero
VT
Player
Etc
1
2021-10-08 11:43
qpl-075091120003.exe
ac6fda43023f6764756838ae94fd4582
RAT
PWS
.NET framework
Generic Malware
PE File
PE32
.NET EXE
VirusTotal
Malware
Check memory
Checks debugger
buffers extracted
unpack itself
Check virtual network interfaces
Tofsee
ComputerName
1
Keyword trend analysis
×
Info
×
http://apps.identrust.com/roots/dstrootcax3.p7c
4
Info
×
apps.identrust.com(119.207.65.137)
store2.gofile.io(31.14.69.10) - mailcious
31.14.69.10 - mailcious
121.254.136.57
1
Info
×
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
3.2
M
32
ZeroCERT
2
2021-10-08 11:39
QTL076213000008.exe
70eeaeae5a9624ca4fbaaef91d2adfdb
RAT
Generic Malware
Antivirus
PE File
PE32
.NET EXE
VirusTotal
Malware
powershell
suspicious privilege
Check memory
Checks debugger
buffers extracted
Creates shortcut
unpack itself
Windows utilities
powershell.exe wrote
Check virtual network interfaces
suspicious process
WriteConsoleW
Tofsee
Windows
ComputerName
Cryptographic key
1
Keyword trend analysis
×
Info
×
http://apps.identrust.com/roots/dstrootcax3.p7c
4
Info
×
apps.identrust.com(119.207.65.137)
store2.gofile.io(31.14.69.10) - mailcious
31.14.69.10 - mailcious
121.254.136.57
1
Info
×
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
5.8
M
16
ZeroCERT
3
2021-10-08 11:30
plt_107510013098613.exe
fc1ac30e0bd33f65402eee320f49f829
RAT
PWS
.NET framework
Generic Malware
PE File
PE32
.NET EXE
VirusTotal
Malware
Check memory
Checks debugger
buffers extracted
unpack itself
Check virtual network interfaces
Tofsee
ComputerName
1
Keyword trend analysis
×
Info
×
http://apps.identrust.com/roots/dstrootcax3.p7c
4
Info
×
apps.identrust.com(119.207.64.153)
store2.gofile.io(31.14.69.10) - mailcious
31.14.69.10 - mailcious
121.254.136.27
1
Info
×
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
3.4
M
42
ZeroCERT
4
2021-10-08 11:28
img-0878111036633.exe
f058ec68a9f1649827914157c3e3b45a
RAT
PWS
.NET framework
Generic Malware
PE File
PE32
.NET EXE
VirusTotal
Malware
Check memory
Checks debugger
buffers extracted
unpack itself
Check virtual network interfaces
Tofsee
ComputerName
1
Keyword trend analysis
×
Info
×
http://apps.identrust.com/roots/dstrootcax3.p7c
4
Info
×
apps.identrust.com(119.207.65.74)
store2.gofile.io(31.14.69.10) - mailcious
31.14.69.10 - mailcious
121.254.136.57
1
Info
×
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
2.8
M
13
ZeroCERT
5
2021-10-08 11:21
IMG_741000106237874.exe
55e2cd3776de61fd52462013c5eea531
RAT
PWS
.NET framework
Generic Malware
PE File
PE32
.NET EXE
VirusTotal
Malware
Check memory
Checks debugger
buffers extracted
unpack itself
Check virtual network interfaces
Tofsee
ComputerName
1
Keyword trend analysis
×
Info
×
http://apps.identrust.com/roots/dstrootcax3.p7c
4
Info
×
apps.identrust.com(119.207.65.81)
store2.gofile.io(31.14.69.10) - mailcious
31.14.69.10 - mailcious
121.254.136.57
1
Info
×
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
3.2
M
36
ZeroCERT
First
1
Last
Total : 5cnts
Delete
×
Do you want to delete it?
View
×
Insert
×
http
domains
hosts
ips
Memo
Tag
Alert
×
Insert error....
keyword