popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
9151 2023-12-07 11:45 build.exe  

6aaf4093cc7a18c1b3635f6078993bc7


RedlineStealer RedLine Infostealer RedLine stealer .NET framework(MSIL) UPX PE32 PE File .NET EXE OS Processor Check Browser Info Stealer RedLine Malware download FTP Client Info Stealer VirusTotal Malware suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Collect installed applications Check virtual network interfaces installed browsers check Tofsee Stealer Windows Browser ComputerName DNS Cryptographic key Software crashed 		2 3 5 7.4 M 65 ZeroCERT

9152 2023-12-07 16:35 sostener.vbs  

6b28299322157cbfd18c65db5e060c1f


Generic Malware Antivirus PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		2 3 1 8.4 3 ZeroCERT

9153 2023-12-07 16:35 envifa.vbs  

18bb62e29138d9c8dd098e5be9a4c13c


Generic Malware Antivirus VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		2 3 1 8.4 2 ZeroCERT

9154 2023-12-07 16:40 line.exe  

fcfc4a3e70883dc993ee49241e40c393


Emotet Gen1 SmokeLoader Generic Malware Malicious Library UPX Malicious Packer PE32 PE File CAB OS Processor Check Lnk Format GIF Format Browser Info Stealer Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency AutoRuns PDB MachineGuid Check memory Creates shortcut Creates executable files unpack itself Windows utilities Disables Windows Security Collect installed applications suspicious process AppData folder AntiVM_Disk sandbox evasion WriteConsoleW anti-virtualization IP Check VM Disk Size Check human activity check installed browsers check Tofsee Ransomware Windows Browser RisePro Email ComputerName Remote Code Execution DNS Software crashed 		1 5 6 15.2 M 41 ZeroCERT

9155 2023-12-08 09:42 MicrosoftHealthcheck.vbs  

61fee3f2dd4255c687072b4eac7cdb0d


Generic Malware Antivirus PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		1 3 1 9.0 4 ZeroCERT

9156 2023-12-08 18:38 Microsoftdecidedtodeleteentire...  

684c997cc1b2dc1290b00576e884f425


MS_RTF_Obfuscation_Objects RTF File doc Malware download VirusTotal Malware Malicious Traffic RWX flags setting exploit crash Tofsee Windows Exploit DNS crashed 		3 7 4.2 M 36 ZeroCERT

9157 2023-12-08 18:40 microsoftdecidedtodeleteentire...  

49ad634e1dfd465013beb3ce092015de


MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware VBScript Malicious Traffic buffers extracted exploit crash unpack itself Tofsee Exploit DNS crashed 		2 4 2 4.6 M 33 ZeroCERT

9158 2023-12-11 14:24 release_ver9.rar  

a64249c49fd7686653154060beaa68dc


Stealc Escalate priviledges PWS KeyLogger AntiDebug AntiVM Malware download Vidar Open Directory Malware c&c suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself suspicious TLD IP Check PrivateLoader Tofsee Stealc Stealer Windows Exploit Browser RisePro DNS Downloader plugin 		15 28 36 2 5.6 M ZeroCERT

9159 2023-12-11 19:21 DLL%20Injector%20Resou%E2%80%A...  

b6d15bc82d811c30d7e9633402bee9c2


Malicious Packer PE File PE64 VirusTotal Malware MachineGuid Check virtual network interfaces Tofsee crashed DoTNet 		1 3 2 3.8 M 42 ZeroCERT

9160 2023-12-11 19:27 InstallSetup9.exe  

9277e82030f3f80d2acb91ca8a2e21bb


NSIS Generic Malware Malicious Library UPX Antivirus Malicious Packer Admin Tool (Sysinternals etc ...) Anti_VM PE32 PE File PNG Format OS Processor Check ZIP Format JPEG Format BMP Format CHM Format DLL icon PE64 CAB MZP Format MSOffice File Word 2007 fi VirusTotal Malware Malicious Traffic Check memory Creates executable files unpack itself AppData folder AntiVM_Disk IP Check VM Disk Size Check Tofsee Ransomware Windows DNS 		4 6 9 9.0 M 44 ZeroCERT

9161 2023-12-11 19:32 SynapseExploit.exe  

2cd9b5d48c0904c90537d3eb0f1becad


RedLine stealer XMRig Miner Emotet Suspicious_Script_Bin Generic Malware task schedule Downloader Malicious Library UPX Malicious Packer Antivirus .NET framework(MSIL) Obsidium protector Create Service Socket DGA Http API ScreenShot Escalate priviledges Browser Info Stealer RedLine Malware download FTP Client Info Stealer VirusTotal Malware Microsoft AutoRuns PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files unpack itself Windows utilities Collect installed applications Check virtual network interfaces suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Kelihos Tofsee Stealer Windows Browser ComputerName Trojan DNS Cryptographic key Software crashed 		3 6 11 1 22.8 M 55 ZeroCERT

9162 2023-12-11 19:38 Winlock.exe  

18563c62462e92e3c81dfe737e3a8997


Emotet Malicious Library UPX PE32 PE File OS Processor Check DLL VirusTotal Malware AutoRuns Check memory Creates executable files RWX flags setting Windows utilities suspicious process AppData folder sandbox evasion WriteConsoleW Tofsee Windows Browser Advertising Google ComputerName 		2 4 1 8.6 M 51 ZeroCERT

9163 2023-12-11 20:03 microsoftunderstandhowimportan...  

c4cde68e89e1c045c73591c40eeb439f


MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware VBScript Malicious Traffic buffers extracted exploit crash unpack itself Tofsee Exploit DNS crashed 		2 5 2 4.6 31 guest

9164 2023-12-12 07:47 ucdutchzx.exe  

723bccfa9d5be24b8a064f547cf1c039


AgentTesla .NET framework(MSIL) PWS SMTP KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Tofsee Browser Email ComputerName Software crashed 		2 2 10.8 ZeroCERT

9165 2023-12-12 07:53 ama.exe  

294593fcb93a6d6694c9670e86e649bf


Amadey UPX Malicious Library .NET framework(MSIL) PWS AntiDebug AntiVM PE32 PE File JPEG Format DLL PE64 OS Processor Check .NET EXE Browser Info Stealer Malware download Amadey FTP Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency Buffer PE AutoRuns MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files RWX flags setting unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder sandbox evasion WriteConsoleW installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software crashed Downloader 		4 5 9 1 18.6 M ZeroCERT

keyword