popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
9136 2023-11-29 00:10 [Content_Types].xml  

10720bd1e11273d47d78cc6f2d215894


Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		2 4.2 guest

9137 2023-11-29 00:10 .rels  

69984e911a8e36d7f6eab75bf36c6d01


Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		2 4.8 guest

9138 2023-11-29 14:28 O.ini  

15909167c6a125757e0a931c7c486269


Emotet AgentTesla Malicious Library Malicious Packer UPX PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Check memory Checks debugger unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed 		2 4 5.4 M 49 ZeroCERT

9139 2023-11-29 14:33 123.exe  

5ab89a96be7570dfe4f49e6b9a42bc88


Malicious Library UPX PE32 PE File MZP Format OS Processor Check JPEG Format DLL VirusTotal Malware AutoRuns Creates executable files unpack itself AppData folder Tofsee Windows Advertising Google ComputerName DNS DDNS crashed keylogger 		2 8 4 9.6 M 67 ZeroCERT

9140 2023-11-29 16:00 file_ver_9.rar  

0626f8e71d8a91fd6185df77a50b9fbc


Escalate priviledges PWS KeyLogger AntiDebug AntiVM RedLine Malware download Vidar Malware c&c Microsoft suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself suspicious TLD IP Check PrivateLoader Tofsee Stealc Stealer Windows Browser RisePro DNS plugin 		36 46 49 3 6.6 M ZeroCERT

9141 2023-11-30 17:01 soyaorjaga.exe  

1abc02588884a0d1d0c29117da4c8969


AgentTesla Malicious Library Malicious Packer UPX PE32 PE File .NET EXE OS Name Check OS Memory Check OS Processor Check Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Check memory Checks debugger unpack itself Check virtual network interfaces IP Check Tofsee Browser Email ComputerName DNS Software crashed 		2 4 5.2 41 ZeroCERT

9142 2023-12-01 10:43 hv.exe  

b4e0409a6822da1a960bf71ce05fba6f


Admin Tool (Sysinternals etc ...) .NET framework(MSIL) Malicious Library UPX PWS AntiDebug AntiVM PE32 PE File MSOffice File .NET EXE DLL OS Processor Check VirusTotal Malware Buffer PE PDB Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Check virtual network interfaces AppData folder Tofsee Windows DNS Cryptographic key crashed 		1 3 1 12.4 24 ZeroCERT

9143 2023-12-01 13:08 conhost.exe  

d026406ee553f49e6526b612274544d3


XMRig Miner Emotet Suspicious_Script_Bin Generic Malware task schedule Downloader Malicious Library UPX Malicious Packer Antivirus .NET framework(MSIL) Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HT VirusTotal Malware AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check Tofsee Windows ComputerName DNS Cryptographic key 		4 3 5 1 12.8 M 15 ZeroCERT

9144 2023-12-04 18:03 good.exe  

28417328b64f515c71ceab7b1ee5766b


Generic Malware Malicious Library Malicious Packer UPX PE32 PE File OS Processor Check ZIP Format Lnk Format GIF Format Browser Info Stealer Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency AutoRuns MachineGuid Check memory Creates shortcut Creates executable files unpack itself Windows utilities Disables Windows Security Collect installed applications suspicious process AntiVM_Disk sandbox evasion WriteConsoleW anti-virtualization IP Check VM Disk Size Check human activity check installed browsers check Tofsee Ransomware Windows Browser RisePro Email ComputerName DNS Software crashed 		1 5 7 14.4 M 50 ZeroCERT

9145 2023-12-04 18:27 good.exe  

8ea7dc740a4d382a7dc9322b1649f6f2


Generic Malware Malicious Library Malicious Packer UPX PE32 PE File OS Processor Check Lnk Format GIF Format Malware download VirusTotal Malware AutoRuns suspicious privilege MachineGuid Creates shortcut Creates executable files Windows utilities Disables Windows Security suspicious process WriteConsoleW IP Check human activity check Tofsee Windows RisePro ComputerName DNS 		1 5 4 9.2 M 50 ZeroCERT

9146 2023-12-04 18:29 Stealer%20Resou%E2%80%AEnls.sc...  

87e782c7ef3f46a86d7df12b399d6fcb


PE32 PE File .NET EXE VirusTotal Malware PDB Check memory Checks debugger unpack itself Check virtual network interfaces Tofsee 		2 1 2.6 M 49 ZeroCERT

9147 2023-12-06 12:12 p.ps1  

3dc32f74db9c2b56bca483d6e56316be


Generic Malware Antivirus powershell Check memory unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces WriteConsoleW Tofsee Windows Gmail ComputerName Cryptographic key 		2 2 6.8 ZeroCERT

9148 2023-12-06 12:19 obizx.exe  

12f10d15b25ffad6e27f76029516058a


AgentTesla PWS SMTP KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Tofsee Browser Email ComputerName Software crashed 		2 2 13.0 M 43 ZeroCERT

9149 2023-12-06 12:23 LjYLHSho7Xgoi1P.exe  

77e7f5ee129d7a0eb6a063c6700083f6


AgentTesla .NET framework(MSIL) PWS SMTP KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AutoRuns PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Software crashed keylogger 		1 4 5 15.4 M 46 ZeroCERT

9150 2023-12-07 06:54 GameCenter.exe  

054c92c15c2574860d1fe07b9fad1b23


HermeticWiper Gen1 PhysicalDrive Generic Malware Malicious Library Malicious Packer Admin Tool (Sysinternals etc ...) ASPack Antivirus UPX Anti_VM PE32 PE File MZP Format OS Processor Check MachineGuid Check memory unpack itself Check virtual network interfaces AntiVM_Disk suspicious TLD VM Disk Size Check Tofsee Firmware crashed 		1 3 1 5.2 guest

keyword