popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
9106 2023-11-21 08:00 smo.exe  

d117bdd49deff0dc9c560ed4a03d3a5f


Emotet Gen1 Malicious Library UPX PE32 PE File CAB Lnk Format GIF Format Browser Info Stealer Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency AutoRuns PDB suspicious privilege MachineGuid Check memory Checks debugger Creates shortcut Creates executable files unpack itself Windows utilities Disables Windows Security Collect installed applications suspicious process AntiVM_Disk sandbox evasion WriteConsoleW anti-virtualization IP Check VM Disk Size Check installed browsers check Tofsee Ransomware Windows Update Browser RisePro Email ComputerName Remote Code Execution DNS Cryptographic key Software crashed 		1 5 7 18.4 M 42 ZeroCERT

9107 2023-11-21 18:17 htmlbrowserhistorydeletedbymic...  

0a869df2007f5731f95c5d84aad6bbbf


MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware VBScript Malicious Traffic buffers extracted RWX flags setting exploit crash Tofsee Exploit DNS crashed 		3 6 3 4.6 M 33 ZeroCERT

9108 2023-11-21 18:17 htmlvb.vbs  

a106d0b5d4423dbcb1b7551cc6f011b1


Generic Malware Antivirus PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted wscript.exe payload download Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		4 5 2 9.0 7 ZeroCERT

9109 2023-11-22 13:23 deepweb.exe  

7a51a34ca5ccfe6eb43ef6abc0f92d46


RedlineStealer RedLine Infostealer RedLine stealer .NET framework(MSIL) UPX PE32 PE File .NET EXE OS Processor Check Browser Info Stealer RedLine Malware download FTP Client Info Stealer VirusTotal Malware suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Collect installed applications Check virtual network interfaces installed browsers check Tofsee Stealer Windows Browser ComputerName DNS Cryptographic key Software crashed 		2 3 4 8.0 M 65 ZeroCERT

9110 2023-11-23 07:53 PhXExiF.exe  

607e6e48bb7398dd40783cdf86ee4670


.NET framework(MSIL) UPX PE32 PE File .NET EXE Check memory Checks debugger unpack itself Check virtual network interfaces Tofsee crashed 		2 1 1.4 ZeroCERT

9111 2023-11-23 19:02 tfsoft.exe  

1d6edfa073e4a8f072df28cfd5321bba


PE32 PE File Emotet VirusTotal Malware Buffer PE suspicious privilege Code Injection Malicious Traffic buffers extracted unpack itself Windows utilities Detects VMWare suspicious process AppData folder sandbox evasion VMware Tofsee Windows crashed 		10 17 1 11.6 M 57 guest

9112 2023-11-24 10:58 Invoice.url  

90962de04e13d0f8e7b96a094ec6b77a


AntiDebug AntiVM URL Format MSOffice File VirusTotal Malware Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		1 1 2 5.8 5 ZeroCERT

9113 2023-11-24 11:00 Order_Information.url  

73461871b344c75f77323047fbafd617


AntiDebug AntiVM URL Format MSOffice File VirusTotal Malware Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		1 1 2 5.8 5 ZeroCERT

9114 2023-11-24 11:03 Payment_Information.url  

9eb31a50bbe8cc0146b9f778d270ddd4


AntiDebug AntiVM URL Format MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		1 1 2 5.4 ZeroCERT

9115 2023-11-24 11:12 Payment.url  

1009a583d82ccd724ae13dc4d378de59


AntiDebug AntiVM URL Format MSOffice File VirusTotal Malware Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		1 1 2 6.0 14 ZeroCERT

9116 2023-11-24 11:14 Order_Information.url  

7f4085aab74f2da761e65d5fb41fd40f


AntiDebug AntiVM URL Format MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		1 1 2 5.4 ZeroCERT

9117 2023-11-25 17:55 Loader%20Resou%E2%80%AEnls.scr  

21bc89b62236a92090a9b9732ce09b5e


PE32 PE File .NET EXE PDB Check memory Checks debugger unpack itself Check virtual network interfaces Tofsee 		2 1 1.4 M ZeroCERT

9118 2023-11-25 18:08 PLmp.exe  

d689713e2c880daf649ec894a0761274


PrivateLoader NPKI Gen1 HermeticWiper Generic Malware Suspicious_Script NSIS Malicious Library VMProtect UPX Antivirus Malicious Packer Admin Tool (Sysinternals etc ...) Anti_VM Javascript_Blob AntiDebug AntiVM PE File PE64 PE32 DLL PNG Format JPEG Forma Browser Info Stealer Malware download VirusTotal Malware MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Disables Windows Security AppData folder AntiVM_Disk sandbox evasion WriteConsoleW IP Check VM Disk Size Check PrivateLoader Tofsee Ransomware Windows Browser DNS 		5 10 8 2 19.4 M 43 ZeroCERT

9119 2023-11-25 18:09 updater.exe  

8589b564a5ed7920be4b1b08f3d6d8ed


Gen1 Generic Malware UPX Antivirus Malicious Library PE32 PE File DLL PE64 OS Processor Check ZIP Format Cryptocurrency Miner Malware Cryptocurrency suspicious privilege Malicious Traffic Check memory Checks debugger Creates shortcut Creates executable files unpack itself suspicious process WriteConsoleW Windows ComputerName intelligence DNS Cryptographic key crashed CoinMiner 		1 7 4 6.2 M ZeroCERT

9120 2023-11-25 18:13 Opesi.exe  

51367ff68633e00c8a084cb52534182f


Client SW User Data Stealer LokiBot ftp Client info stealer .NET framework(MSIL) Http API PWS AntiDebug AntiVM PE32 PE File .NET EXE FTP Client Info Stealer Malware Telegram suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process AppData folder malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software 		1 5 3 16.0 M ZeroCERT

keyword