popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
9061 2023-11-07 07:58 IGCC.exe  

a3bb5280d95d7c638240975925c013ac


AgentTesla Generic Malware Antivirus PWS KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer powershell AutoRuns PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed 		2 4 14.4 M ZeroCERT

9062 2023-11-07 10:13 bRoC.exe  

07807c652283c997837c931b41c45f24


PE File PE32 .NET EXE VirusTotal Malware Tofsee 		1 3 1 1.6 53 ZeroCERT

9063 2023-11-07 10:59 File.rar  

f990fd3d664b4a2cd89a21cb6e2a9911


PrivateLoader Escalate priviledges PWS KeyLogger AntiDebug AntiVM RedLine Malware download Malware c&c Microsoft Telegram suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself suspicious TLD IP Check PrivateLoader Tofsee Stealc Stealer Windows Discord Browser RisePro DNS Downloader plugin 		62 93 57 10 7.2 M ZeroCERT

9064 2023-11-07 19:14 WinRar.exe  

12ad5dac08fffe484f5bece941c6ee4e


AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		2 1 3.8 ZeroCERT

9065 2023-11-07 19:21 WWW14_64.exe  

b79c2d99b9899e66e9a3c16b5bc407cb


PrivateLoader NPKI RedLine Infostealer RedLine stealer HermeticWiper Generic Malware NSIS Suspicious_Script UPX Malicious Library Antivirus Malicious Packer .NET framework(MSIL) Confuser .NET Admin Tool (Sysinternals etc ...) Anti_VM Javascript_Bl Browser Info Stealer RedLine Malware download FTP Client Info Stealer Malware Microsoft suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files RWX flags setting unpack itself Windows utilities Disables Windows Security Collect installed applications Check virtual network interfaces AppData folder AntiVM_Disk sandbox evasion IP Check VM Disk Size Check installed browsers check PrivateLoader Tofsee Ransomware Stealer Windows Browser ComputerName Trojan DNS Cryptographic key Software crashed 		23 40 23 9 22.2 M ZeroCERT

9066 2023-11-08 09:39 ORDER-23116FC.pdf.js  

cf34cf3dc725d0145cb4b3ecfba459e7

VirusTotal Malware VBScript wscript.exe payload download Tofsee Dropper 		1 2 2 10.0 20 ZeroCERT

9067 2023-11-08 09:51 File.rar  

c49151503a28c917e2857760532d8ef0


PrivateLoader Stealc Escalate priviledges PWS KeyLogger AntiDebug AntiVM RedLine Malware download Malware c&c Microsoft Telegram suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself suspicious TLD IP Check PrivateLoader Tofsee Stealc Stealer Windows RisePro DNS 		53 76 46 15 6.6 M ZeroCERT

9068 2023-11-09 07:57 IGCC.exe  

1007f94e20df5535b81e25138316ac57


AgentTesla Confuser .NET PWS SMTP KeyLogger AntiDebug AntiVM PE File PE64 Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Tofsee Windows Browser Email ComputerName Software crashed keylogger 		1 3 2 10.0 M ZeroCERT

9069 2023-11-09 08:00 IGCC.exe  

dad01083f1469e5ffa79e73f6c4252b3


AgentTesla .NET framework(MSIL) PWS SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Browser Email ComputerName DNS Software crashed 		3 4 10.0 M ZeroCERT

9070 2023-11-09 08:08 smss.exe  

62c8a57ed7d641bc8b4e451e37452df1


Malicious Library UPX PE File PE32 MZP Format DllRegisterServer dll RWX flags setting unpack itself Tofsee Interception crashed 		2 1 3.0 M ZeroCERT

9071 2023-11-09 09:27 HtmlIEbrowsercachehistoryclean...  

6d852c09f951469e5265373380460ebf


MS_RTF_Obfuscation_Objects RTF File doc Malware download VirusTotal Malware Malicious Traffic exploit crash unpack itself IP Check Tofsee Windows Exploit DNS crashed 		1 3 9 4.6 M 31 ZeroCERT

9072 2023-11-09 09:27 HTMLIEbrowserChromehtml.vbs  

63c71d97a2625c3537e9edde15f3d34b


Generic Malware Antivirus VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted wscript.exe payload download Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		4 5 2 10.0 1 ZeroCERT

9073 2023-11-09 09:31 ngown.vbs  

02a3397b2d50409559121caee5c82d81


Generic Malware Antivirus PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted wscript.exe payload download Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		4 5 2 9.0 M 3 ZeroCERT

9074 2023-11-09 10:25 2000215005_20231107_20231127_r...  

015ba89bce15c66baebc5fd94d03d19e


Generic Malware Antivirus AntiDebug AntiVM Lnk Format GIF Format PowerShell MSOffice File VirusTotal Malware VBScript powershell suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted wscript.exe payload download Creates shortcut Creates executable files RWX flags setting exploit crash unpack itself Windows utilities suspicious process installed browsers check Tofsee Windows Exploit Browser ComputerName DNS Cryptographic key crashed Dropper 		6 4 1 10.0 8 ZeroCERT

9075 2023-11-09 10:34 2023년 10월4주차 주간 국제안보군사정세(통권 제2...  

337bbc45280073edd0ec63a9cffeacbc


Client SW User Data Stealer browser info stealer Generic Malware Downloader Google Chrome User Data Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyL Browser Info Stealer VirusTotal Malware powershell suspicious privilege Code Injection Check memory Checks debugger Creates shortcut Creates executable files exploit crash unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces suspicious process AppData folder malicious URLs WriteConsoleW installed browsers check Tofsee Windows Exploit Browser ComputerName Cryptographic key crashed 		1 2 2 14.2 21 ZeroCERT

keyword