popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
8866 2023-10-13 01:04 Password_exe.txt  

0bfc8082533654edacb07337a575b119


Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		2 4.2 guest

8867 2023-10-13 01:05 Password_dll.txt  

21567881b3d5d574a5ef76c7bda521dc


Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		2 4.8 guest

8868 2023-10-13 04:24 NMemo1Setp.exe  

f12aa4983f77ed85b3a618f7656807c2


Confuser .NET PE File PE32 .NET EXE VirusTotal Malware MachineGuid Check memory Checks debugger unpack itself Check virtual network interfaces Tofsee Ransomware DNS 		3 3 3.8 M 59 guest

8869 2023-10-13 05:58 NMemo1Setp.exe  

f12aa4983f77ed85b3a618f7656807c2


Confuser .NET PE File PE32 .NET EXE VirusTotal Malware MachineGuid Check memory Checks debugger unpack itself Check virtual network interfaces Tofsee Ransomware DNS 		3 3 3.8 M 59 guest

8870 2023-10-13 08:40 stub.exe  

7267c31ceaa3b35c96494360402a4788


Generic Malware Malicious Library UPX Malicious Packer PE File PE64 OS Processor Check Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Telegram MachineGuid Windows utilities Tofsee Ransomware Windows Browser Email DNS Software crashed 		85 4 6.6 M 10 ZeroCERT

8871 2023-10-13 09:22 191.exe  

4c321e07bba6c01aab73acdaa9c28b52


Cutwail Malic Malware download VirusTotal Malware Buffer PE MachineGuid Code Injection Malicious Traffic Check memory buffers extracted ICMP traffic unpack itself Check virtual network interfaces suspicious process suspicious TLD sandbox evasion Tofsee Interception Windows Backdoor ComputerName DNS Cryptographic key DoTNet 		261 1912 9 17.0 M 34 ZeroCERT

8872 2023-10-14 12:53 audiodgse.exe  

9a2273d43305150b70e4cfa69bff2231


LokiBot Generic Malware Antivirus PWS SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed 		2 4 12.2 44 ZeroCERT

8873 2023-10-14 12:59 AppaltQD.exe  

1a687a4c22bfcb3fcf4c19a05d6da9e5


Malicious Library UPX Malicious Packer Antivirus PE File PE32 OS Processor Check VirusTotal Malware PDB Tofsee Remote Code Execution 		2 2 1.8 M 13 ZeroCERT

8874 2023-10-16 09:47 newrock.exe  

5678c3a93dafcd5ba94fd33528c62276


Amadey Malicious Library UPX Malicious Packer AntiDebug AntiVM PE File PE32 .NET EXE OS Processor Check PE64 Malware download Amadey VirusTotal Cryptocurrency Miner Malware AutoRuns Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process AppData folder WriteConsoleW human activity check Kelihos Windows ComputerName Trojan DNS crashed CoinMiner 		5 10 14 4 14.6 M 49 ZeroCERT

8875 2023-10-16 09:56 foto2552.exe  

c7523bca22d87a152b8c10c02736a335


Amadey RedLine stealer Gen1 Emotet Generic Malware Malicious Library UPX Antivirus Admin Tool (Sysinternals etc ...) Malicious Packer ScreenShot PWS AntiDebug AntiVM PE File PE32 CAB PNG Format MSOffice File OS Processor Check DLL Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware powershell Microsoft AutoRuns PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files RWX flags setting exploit crash unpack itself Windows utilities Collect installed applications powershell.exe wrote suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Tofsee Stealc Stealer Windows Exploit Browser Email ComputerName Remote Code Execution DNS Cryptographic key Software crashed Downloader 		49 26 19 3 26.4 M 45 ZeroCERT

8876 2023-10-16 10:57 sihost.exe  

12e015f7ce3f2092a290eccf26de6889


Generic Malware Antivirus PWS SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed 		2 4 12.6 53 ZeroCERT

8877 2023-10-16 11:01 treelatestprores.exe  

ff43aae7083352dc2d8251c1e622c737


Lumma Gen1 Emotet Malicious Library UPX Http API ScreenShot Internet API AntiDebug AntiVM PE File PE64 CAB OS Processor Check MSOffice File PNG Format PE32 .NET EXE JPEG Format Browser Info Stealer Malware download VirusTotal Malware Cryptocurrency wallets Cryptocurrency AutoRuns PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files RWX flags setting exploit crash unpack itself Windows utilities Collect installed applications Check virtual network interfaces suspicious process AppData folder sandbox evasion WriteConsoleW installed browsers check Tofsee Ransomware Lumma Stealer Windows Exploit Browser ComputerName Remote Code Execution Firmware DNS Cryptographic key crashed 		3 5 8 3 20.8 M 49 ZeroCERT

8878 2023-10-16 11:05 humblezx.exe  

9db0aa4d2c28205d89536de9244cb7e8


AgentTesla SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer VirusTotal Email Client Info Stealer Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Browser Email ComputerName DNS crashed 		2 4 9.6 56 ZeroCERT

8879 2023-10-16 11:10 audiodgse.exe  

be17427d37337c71ac701effd983f143


LokiBot Generic Malware Antivirus PWS SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware powershell PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed 		5 4 13.4 53 ZeroCERT

8880 2023-10-16 11:10 schtasks.exe  

72aa1d054af015d3b90588e9e0cf04ae


AsyncRAT UPX Malicious Packer .NET framework(MSIL) PE File PE32 .NET EXE OS Processor Check 		2 ZeroCERT

keyword