popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
9091 2023-11-15 10:49 Agenzia.url  

e8e03b91b2802891c978c8a67999bd10


AntiDebug AntiVM URL Format MSOffice File VirusTotal Malware Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		1 1 2 5.8 6 ZeroCERT

9092 2023-11-15 10:49 Agenzia_Entrate.url  

67b426814bf2530e2de2e85d1146c594


AntiDebug AntiVM URL Format MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		1 1 2 5.4 ZeroCERT

9093 2023-11-16 07:49 open.exe  

16252016f9922916b06ba87604aaaa29


AgentTesla .NET framework(MSIL) UPX PWS KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE OS Processor Check Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer Buffer PE AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed keylogger 		2 4 14.4 M ZeroCERT

9094 2023-11-16 07:56 ama.exe  

a61aac13f8a4841915791fb57aa2e275


Amadey UPX PE32 PE File Malware download Amadey Malware AutoRuns Malicious Traffic Check memory RWX flags setting unpack itself Windows utilities suspicious process AppData folder WriteConsoleW Tofsee Windows ComputerName DNS 		1 4 2 1 7.8 M ZeroCERT

9095 2023-11-16 13:35 lightmuzik2.1.exe  

8a7e5664d1f1d5bf41c6d943299aa1e8


NSIS Malicious Library UPX PE32 PE File OS Processor Check Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Check memory Checks debugger Creates executable files unpack itself Check virtual network interfaces AppData folder IP Check Tofsee Browser Email ComputerName DNS Software crashed 		2 4 7.2 M 47 ZeroCERT

9096 2023-11-16 15:57 htmlbrowserhistorycleanbothfil...  

819445270fd095cf54c6768d1e380e1b


Generic Malware Antivirus VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted wscript.exe payload download Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		3 5 2 9.0 2 ZeroCERT

9097 2023-11-16 18:57 NOV_INQUIRY.js  

b22055de1a1ea49c1b4f7d64ff315471


ActiveXObject wscript.exe payload download unpack itself Check virtual network interfaces Tofsee DNS crashed 		3 5 2 1 2.6 M ZeroCERT

9098 2023-11-16 18:59 AWB No.5839077413pdf.exe  

3192f8ad7bde4add1fd295e08176c383


AgentTesla PWS SMTP KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Software crashed keylogger 		2 4 10.6 ZeroCERT

9099 2023-11-16 19:03 need.exe  

e622baf0198d6821fb4e1a8a23618a17


RedLine stealer Emotet Gen1 Malicious Library UPX ScreenShot PWS Socket Steal credential DNS Code injection AntiDebug AntiVM PE32 PE File CAB Browser Info Stealer RedLine Malware download FTP Client Info Stealer Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency Microsoft AutoRuns PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Collect installed applications malicious URLs AntiVM_Disk sandbox evasion anti-virtualization IP Check VM Disk Size Check installed browsers check Tofsee Ransomware Stealer Windows Browser RisePro Email ComputerName Remote Code Execution DNS Cryptographic key Software crashed 		1 5 11 18.0 M ZeroCERT

9100 2023-11-17 18:37 AWB_Ref#.5839077413pdf.exe  

7ac9bc3020e21341f1c2d8f9e938f9e3


AgentTesla PWS SMTP KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AutoRuns PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Software crashed keylogger 		1 4 5 13.0 19 ZeroCERT

9101 2023-11-17 18:41 OFICIO_DE_EMBARGO_Nro_81_RAMA_...  

b935dc0f2d44f314601d7cc4e6e72989


Generic Malware Antivirus VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted wscript.exe payload download Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		3 5 2 9.0 M 5 ZeroCERT

9102 2023-11-18 12:43 home.exe  

0569253c2d7bbd34d6576729c420930f


Malicious Library Malicious Packer UPX PE32 PE File OS Processor Check ZIP Format Lnk Format GIF Format Browser Info Stealer Malware download FTP Client Info Stealer Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency AutoRuns MachineGuid Check memory Creates shortcut Creates executable files unpack itself Windows utilities Collect installed applications suspicious process AntiVM_Disk sandbox evasion WriteConsoleW anti-virtualization IP Check VM Disk Size Check installed browsers check Tofsee Ransomware Windows Browser RisePro Email ComputerName DNS Software 		1 5 7 11.8 M ZeroCERT

9103 2023-11-20 09:54 v1.exe  

cc78ebc3aad20686d5bef8613aba55be


Client SW User Data Stealer LokiBot ftp Client info stealer .NET framework(MSIL) UPX Http API PWS AntiDebug AntiVM PE32 PE File .NET EXE OS Processor Check FTP Client Info Stealer VirusTotal Malware Telegram Buffer PE suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process AppData folder malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software 		1 5 3 16.8 M 51 ZeroCERT

9104 2023-11-20 09:55 Lwsecure_beta.exe  

5c320953f68110bc451f42495ef0a296


Gen1 Malicious Library UPX PE File PE64 ftp OS Processor Check VirusTotal Malware PDB Tofsee Remote Code Execution crashed 		2 2 2.0 M 38 ZeroCERT

9105 2023-11-20 09:58 conhost.exe  

0c648321522607509014810fa9850703


XMRig Miner Emotet Cryptocurrency Miner Generic Malware Suspicious_Script_Bin CoinHive Cryptocurrency task schedule Downloader Malicious Library UPX Antivirus Malicious Packer .NET framework(MSIL) Create Service Socket DGA Http API ScreenShot Escalate pri VirusTotal Malware AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check Tofsee Windows ComputerName DNS Cryptographic key 		4 3 6 13.4 M 46 ZeroCERT

keyword