popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
1 2025-04-15 09:45 loader.hta  

3d38ab222579d17632acd5d383490a05


Check memory RWX flags setting unpack itself Tofsee DNS 		3 2 1.6 ZeroCERT

2 2025-04-11 15:34 wecashourdrgoodnewthingsgoodbu...  

49a635b773f1351cdb4e4fb457e5008b


Generic Malware Downloader Antivirus AntiDebug AntiVM PowerShell PE File DLL PE32 .NET DLL VirusTotal Malware powershell suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger Creates shortcut Creates executable files RWX flags setting unpack itself Windows utilities powershell.exe wrote suspicious process AppData folder Windows ComputerName DNS Cryptographic key 		1 1 4 13.0 M 30 ZeroCERT

3 2025-04-11 15:34 hhu.hta  

852ff9407aae6f2ef4fc6c61c8b6a815


Generic Malware Antivirus Downloader AntiDebug AntiVM PE File DLL PE32 .NET DLL VirusTotal Malware powershell suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger Creates shortcut Creates executable files RWX flags setting unpack itself Windows utilities powershell.exe wrote suspicious process AppData folder Windows ComputerName DNS Cryptographic key 		1 1 4 13.0 M 31 ZeroCERT

4 2025-04-09 11:14 weneedbestthingswithgreatnewse...  

69a8457d73f1171b37da05e4c9869b05


Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM VBScript Code Injection Check memory wscript.exe payload download Creates executable files suspicious process malicious URLs Tofsee DNS Dropper 		1 2 4 10.0 ZeroCERT

5 2025-04-09 10:42 greatnicegirlbackontheearthwit...  

efb65d67dc764eb12f65fc12dd8eb542


Generic Malware Antivirus Downloader AntiDebug AntiVM PE File DLL PE32 .NET DLL VirusTotal Malware VBScript powershell suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger heapspray wscript.exe payload download Creates shortcut Creates executable files RWX flags setting unpack itself Windows utilities powershell.exe wrote suspicious process AppData folder Tofsee Windows ComputerName DNS Cryptographic key Dropper 		2 3 4 10.0 13 ZeroCERT

6 2025-04-03 10:55 wecaninsertforgoodforeeturnche...  

d7a6bc4df00171791fbcbf33763bf5cb


Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM VBScript powershell suspicious privilege Code Injection Check memory Checks debugger wscript.exe payload download Creates shortcut Creates executable files unpack itself Check virtual network interfaces suspicious process malicious URLs WriteConsoleW Tofsee Windows ComputerName DNS Cryptographic key Dropper 		3 3 1 1 10.0 ZeroCERT

7 2025-03-28 15:15 sfmw.hta  

f32e7891e2cfc58230057a506325c3c8


AntiDebug AntiVM PowerShell VirusTotal Malware powershell Code Injection RWX flags setting unpack itself Windows utilities suspicious process Windows 		5.2 3 ZeroCERT

8 2025-03-27 11:09 tarksloader.hta  

3ffacc93b7d3de5d0d47f31853807f49


AntiDebug AntiVM MSOffice File Code Injection RWX flags setting unpack itself Windows utilities Tofsee Windows 		1 4 1 2.6 ZeroCERT

9 2025-03-27 10:49 globalshippingservice.hta  

fba293bd1c8fecdb94afa3c5089fdf7a


Generic Malware Antivirus AntiDebug AntiVM PowerShell PE File DLL PE32 .NET DLL VirusTotal Malware powershell suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger Creates shortcut Creates executable files RWX flags setting unpack itself Windows utilities powershell.exe wrote suspicious process AppData folder Windows ComputerName DNS Cryptographic key 		1 1 3 11.8 32 ZeroCERT

10 2025-03-27 10:46 givemebestthingsforgivemebest....  

2d104c8499a3ab875902770edcbbc899


Generic Malware Antivirus AntiDebug AntiVM PE File DLL PE32 .NET DLL VirusTotal Malware powershell suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger Creates shortcut Creates executable files RWX flags setting unpack itself Windows utilities powershell.exe wrote suspicious process AppData folder Windows ComputerName DNS Cryptographic key 		1 1 4 11.6 28 ZeroCERT

11 2025-03-27 10:46 bestkissingdayswithgreatnicebe...  

69acfbaa7a154e390ee9e1b270b90a32


Generic Malware Antivirus Downloader AntiDebug AntiVM PE File DLL PE32 .NET DLL VirusTotal Malware VBScript powershell suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger Creates shortcut Creates executable files RWX flags setting unpack itself Windows utilities powershell.exe wrote suspicious process AppData folder Windows ComputerName DNS Cryptographic key 		1 1 1 11.8 33 ZeroCERT

12 2025-03-27 10:33 tarksloader.hta  

cc3c0e6f75302fb6c2d9b5e7f487efe8

VirusTotal Malware Check memory RWX flags setting unpack itself WriteConsoleW Tofsee Windows 		1 2 2 3.0 23 ZeroCERT

13 2025-03-27 10:29 goodgirlwithbestbattingwithgoo...  

febc29c5bb6fc7a34e6965a539041138


Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM VirusTotal Malware VBScript Code Injection Check memory wscript.exe payload download Creates executable files RWX flags setting unpack itself suspicious process malicious URLs Tofsee DNS Dropper 		1 2 4 10.0 18 ZeroCERT

14 2025-03-27 10:28 tarksloader.hta  

3ffacc93b7d3de5d0d47f31853807f49

Check memory RWX flags setting unpack itself Tofsee 		2 1 1.0 ZeroCERT

15 2025-03-27 09:52 creatingbestthingsforhisbestst...  

287ddf351810cc030f2eca5307052023


Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM VirusTotal Malware VBScript Code Injection Check memory wscript.exe payload download Creates executable files suspicious process malicious URLs Tofsee DNS Dropper 		1 2 4 10.0 22 ZeroCERT

keyword