popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
8836 2021-05-13 08:23 kn.exe  

167f0a829df709cc4107369ed23fbdfb


Malicious Library DNS AntiDebug AntiVM .NET EXE PE File PE32 VirusTotal Malware Buffer PE PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW human activity check Tofsee Windows ComputerName DNS DDNS 		2 5 4 16.6 31 ZeroCERT

8837 2021-05-12 17:58 generated order 257404.xlsm  

77838fe56970ec040ea084f6c5b3def6


VBA_macro VirusTotal Malware unpack itself Tofsee 		8 20 2 4.2 M 31 ZeroCERT

8838 2021-05-12 17:55 r1oo.exe  

85725f2ce8ff2e36e9a3849e512e8db5


BitCoin Antivirus AntiDebug AntiVM .NET EXE PE File PE32 Browser Info Stealer FTP Client Info Stealer ENERGETIC BEAR VirusTotal Malware powershell suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files unpack itself Windows utilities Disables Windows Security Collect installed applications powershell.exe wrote Check virtual network interfaces suspicious process AppData folder sandbox evasion WriteConsoleW installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software crashed 		2 3 3 1 16.8 M 16 ZeroCERT

8839 2021-05-12 15:42 http://premcogroup.com/bin/sui...  

a7a26d57df53b79b97f904d5b5133f66


AgentTesla DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Hijack Network Code injection Http API Internet API Steal credential ScreenShot Downloader P2P persistence AntiDebug AntiVM MSOffice File PE File PE32 VirusTotal Malware Code Injection Creates executable files exploit crash unpack itself Windows utilities AppData folder malicious URLs Tofsee Windows Exploit DNS crashed 		2 3 5.2 M 25 guest

8840 2021-05-12 12:31 2roxy.txt  

2f4bcc44bf320f3cd7e8961802ffe3e5


BitCoin Antivirus AntiDebug AntiVM .NET EXE PE File PE32 Browser Info Stealer FTP Client Info Stealer ENERGETIC BEAR VirusTotal Malware powershell suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files unpack itself Windows utilities Disables Windows Security Collect installed applications powershell.exe wrote Check virtual network interfaces suspicious process AppData folder sandbox evasion WriteConsoleW installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software crashed 		2 3 3 16.8 M 17 ZeroCERT

8841 2021-05-12 12:14 Taxicab.txt  

df92371c2f2a4b170d14e2b22b352d26


AsyncRAT backdoor PWS .NET framework .NET EXE PE File PE32 VirusTotal Malware Malicious Traffic suspicious TLD Tofsee DNS 		1 2 1 2.8 M 36 ZeroCERT

8842 2021-05-12 10:27 racopp.txt  

a73349885f36cdef7315984ad948a1ab


PWS .NET framework Gen1 Gen2 Http API Steal credential ScreenShot AntiDebug AntiVM .NET EXE PE File PE32 DLL OS Processor Check JPEG Format VirusTotal Email Client Info Stealer Malware MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files ICMP traffic unpack itself Collect installed applications AppData folder suspicious TLD installed browsers check Tofsee Ransomware Windows Browser Email ComputerName DNS Cryptographic key crashed 		7 5 4 14.6 M 46 ZeroCERT

8843 2021-05-12 10:02 4fcr.exe  

d73fd4127cedd82ec566aecf62676d1e


AsyncRAT backdoor PWS .NET framework Gen1 Gen2 Antivirus Http API Steal credential ScreenShot AntiDebug AntiVM .NET EXE PE File PE32 DLL OS Processor Check VirusTotal Email Client Info Stealer Malware powershell suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files unpack itself Collect installed applications powershell.exe wrote suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Tofsee Ransomware Windows Browser Email ComputerName DNS Cryptographic key 		4 3 4 15.6 M 51 ZeroCERT

8844 2021-05-11 17:20 http://alshamaleh-ye.com/xplt/...  

5f4725f701ced44640eaa5c979bc01a6


AgentTesla AsyncRAT backdoor PWS .NET framework Malicious Library DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Hijack Network Code injection Http API Internet API Steal credential ScreenShot Downloader P2P persistence VirusTotal Malware Code Injection Creates executable files exploit crash unpack itself Windows utilities AppData folder malicious URLs Tofsee Windows Exploit DNS crashed 		2 3 5.2 M 11 Kim.GS

8845 2021-05-11 09:19 Giwdmzf.exe  

49fc90c6abbe70021eaac6d8dd41c7dd


AsyncRAT backdoor AgentTesla SMTP KeyLogger AntiDebug AntiVM .NET EXE PE File PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Malicious Traffic Check memory Checks debugger unpack itself Check virtual network interfaces malicious URLs IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed 		2 4 4 8.6 M 21 ZeroCERT

8846 2021-05-11 09:00 한국사_교과서(smdv).js  

9ea397a03f2e5f3b0bfbd8f70f9f82cd


AntiDebug AntiVM MSOffice File VirusTotal Malware Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		2 4.2 4 ZeroCERT

8847 2021-05-11 07:38 Mcnzurtic.exe  

6989acbd9d6104b59fdbf6cb0473cd35


AsyncRAT backdoor AgentTesla SMTP KeyLogger AntiDebug AntiVM .NET EXE PE File PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Malicious Traffic Check memory Checks debugger unpack itself Check virtual network interfaces malicious URLs IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed 		2 4 4 8.8 M 31 ZeroCERT

8848 2021-05-10 12:21 BankStatement009810.xlsb  

4bedb6631269e591cdfe5c981cd4d219


VBA_macro VirusTotal Malware unpack itself Tofsee 		1 2 2 3.2 M 27 ZeroCERT

8849 2021-05-07 12:25 akon.exe  

0690de55a2a4081dd2ebc1f658bba4da


PWS .NET framework Malicious Library AntiDebug AntiVM .NET EXE PE File PE32 VirusTotal Malware PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs Tofsee Windows DNS Cryptographic key 		2 2 4 10.0 M 32 ZeroCERT

8850 2021-05-07 11:34 cutscroll.png  

5ceaa6deb3ee0395632e64da64077689


tor Gen1 Emotet PE File PE32 Dridex TrickBot Malware Report suspicious privilege Malicious Traffic buffers extracted unpack itself Check virtual network interfaces suspicious process Kovter ComputerName DNS crashed 		1 4 4 1 6.4 M ZeroCERT

keyword