popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
8731 2021-06-08 09:02 Inv%20799146.xls  

c72b5321c62c54829b3300ee5d9441e1


VBA_macro MSOffice File VirusTotal Malware unpack itself Tofsee Windows crashed 		1 2 1 5.8 20 ZeroCERT

8732 2021-06-07 17:26 http://23.95.122.53/imo/ana.ex...  

ed74a72fc3b7510936e9768cbf5d6fca


AgentTesla Admin Tool (Sysinternals Devolutions inc) Anti_VM Malicious Library DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Hijack Network Code injection Http API Internet API Steal credential ScreenShot Downloader P2P Malware download VirusTotal Malware Code Injection Malicious Traffic Creates executable files exploit crash unpack itself Windows utilities AppData folder malicious URLs Tofsee Windows Exploit DNS crashed Downloader 		1 6 6.2 M 48 guest

8733 2021-06-06 21:56 d.exe  

95fae5e8246bec2a2c04a331da6950b5


AntiDebug AntiVM PE File .NET EXE PE32 Malware download AsyncRAT Dridex NetWireRC TrickBot VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Kovter DNS crashed 		2 2 8.8 M 32 ZeroCERT

8734 2021-06-06 21:47 update.exe  

a3b54783fd619282ff712dc6e3c6b197


DNS Socket Create Service Escalate priviledges KeyLogger Code injection ScreenShot BitCoin AntiDebug AntiVM PE File PE64 VirusTotal Cryptocurrency Miner Malware AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process malicious URLs WriteConsoleW Windows ComputerName Firmware DNS CoinMiner 		2 1 14.6 44 ZeroCERT

8735 2021-06-05 12:41 http://111.251.36.166  


AgentTesla DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Hijack Network Code injection Http API Internet API Steal credential ScreenShot Downloader P2P persistence AntiDebug AntiVM PNG Format MSOffice File JPEG Format Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		1 2 5.8 guest

8736 2021-06-05 10:51 svchost.exe  

c1e7cb2700292ecd0bc4f4b1d718853d


DNS Socket Code injection ScreenShot AntiDebug AntiVM PE File PE32 VirusTotal Malware Buffer PE AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted WMI unpack itself Tofsee Windows ComputerName keylogger 		2 1 10.8 M 50 ZeroCERT

8737 2021-06-05 06:33 http://114.47.80.66:60/  

5d366dadccfd1a925723ce2afbcffbf6


AgentTesla DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Hijack Network Code injection Http API Internet API Steal credential ScreenShot Downloader P2P persistence AntiDebug AntiVM MSOffice File JPEG Format Code Injection Creates executable files RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		8 3 2 5.2 guest

8738 2021-06-04 18:30 zxcvb.exe  

e02ae8a88df1daa8a2cf8af319a386e3


PWS Loki[b] Loki[m] AgentTesla AsyncRAT backdoor Gen1 Gen2 browser info stealer Google Chrome User Data Malicious Packer Antivirus DNS Socket HTTP KeyLogger Http API Internet API ScreenShot DGA Create Service Sniff Audio Escalate priviledges FTP Code Malware download ENERGETIC BEAR VirusTotal Email Client Info Stealer Malware powershell AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic RWX flags setting unpack itself Windows utilities Disables Windows Security Collect installed applications powershell.exe wrote Check virtual network interfaces suspicious process AppData folder malicious URLs AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Tofsee Ransomware Windows Browser Email ComputerName DNS Cryptographic key crashed Downloader 		17 11 7 24.6 M 22 ZeroCERT

8739 2021-06-04 18:14 cc.exe  

a366fb953227608061d99b578d6a31c1


AgentTesla DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Code injection Http API Internet API Steal credential ScreenShot Downloader P2P AntiDebug AntiVM PE File PE32 Code Injection buffers extracted Creates executable files RWX flags setting unpack itself Windows utilities suspicious process WriteConsoleW Tofsee Windows ComputerName Remote Code Execution 		1 2 1 9.2 M ZeroCERT

8740 2021-06-04 13:23 5.exe  

26c1fa9d93b8875b52d84e0e1b268d3e


AsyncRAT backdoor BitCoin KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer FTP Client Info Stealer ENERGETIC BEAR VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Collect installed applications Check virtual network interfaces malicious URLs installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software crashed 		2 3 3 12.2 14 ZeroCERT

8741 2021-06-04 12:12 flashplayer.exe  

c25218fcf7bce8f3b6431d8125e2e898


AsyncRAT backdoor Emotet Generic Malware VMProtect AntiDebug AntiVM PE File .NET EXE PE32 DLL GIF Format Browser Info Stealer VirusTotal Malware suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic unpack itself Check virtual network interfaces suspicious process AppData folder sandbox evasion WriteConsoleW IP Check Tofsee Ransomware Windows Browser DNS Cryptographic key crashed 		8 15 3 4 17.6 M 34 ZeroCERT

8742 2021-06-04 12:10 file31s.exe  

6a763fac0951021be4b351dddf62bb1d


PWS .NET framework BitCoin AntiDebug AntiVM PE File .NET EXE PE32 MSOffice File Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted RWX flags setting unpack itself Windows utilities Collect installed applications Check virtual network interfaces installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software crashed 		5 7 3 12.8 M 27 ZeroCERT

8743 2021-06-04 12:09 0b1.exe  

e7287f303c0b70b8f23c67c962a84f81


AsyncRAT backdoor PWS .NET framework PE File .NET EXE PE32 VirusTotal Malware AutoRuns suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted ICMP traffic unpack itself Windows utilities Check virtual network interfaces suspicious process Tofsee Windows DNS 		1 8 1 10.0 M 43 ZeroCERT

8744 2021-06-04 11:40 file32.exe  

5e3c86d15d42bb7d2b0987377d556880


AsyncRAT backdoor BitCoin AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces suspicious TLD Tofsee Windows DNS Cryptographic key 		1 5 1 11.0 M 36 ZeroCERT

8745 2021-06-04 11:38 svch.exe  

38c02aa6d06437949ae91666ffe8cacd


AsyncRAT backdoor PWS .NET framework Admin Tool (Sysinternals Devolutions inc) DNS Sniff Audio KeyLogger Code injection AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder human activity check Tofsee Windows ComputerName DNS Cryptographic key keylogger 		2 8 1 15.2 15 ZeroCERT

keyword