popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
9181 2023-12-18 10:03 microsoftprofiledeletedhistory...  

b2acb6f83affabe12ebf11bade4940de


MS_RTF_Obfuscation_Objects RTF File doc Malware download Malware Malicious Traffic buffers extracted RWX flags setting exploit crash Tofsee Windows Exploit DNS crashed 		1 3 7 3.6 M ZeroCERT

9182 2023-12-18 10:07 film.exe  

da044811ca4ac1cc04b14153dccbbf37


Themida Packer Generic Malware UPX PE32 PE File .NET EXE Lnk Format GIF Format DLL OS Processor Check ZIP Format Browser Info Stealer Malware download FTP Client Info Stealer Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency AutoRuns suspicious privilege MachineGuid Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files unpack itself Windows utilities Checks Bios Collect installed applications Detects VMWare Check virtual network interfaces suspicious process AppData folder VMware anti-virtualization IP Check installed browsers check Tofsee Ransomware Windows Browser RisePro Email ComputerName Remote Code Execution Firmware DNS Cryptographic key Software crashed 		2 4 7 17.6 M ZeroCERT

9183 2023-12-18 10:28 hotcock.vbs  

eb4e97fbd44e49363137ec846b846271


Generic Malware Antivirus Hide_URL PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted wscript.exe payload download Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		5 5 2 1 9.0 3 ZeroCERT

9184 2023-12-19 07:35 plugmanzx.exe  

3e76e206fa47934466616d05600d8caf


AgentTesla Formbook PWS SMTP KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed keylogger 		2 4 10.8 ZeroCERT

9185 2023-12-19 12:21 Updationavailableformisofficet...  

1990c5debf314b3860557e285f8c00ac


MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware VBScript Malicious Traffic buffers extracted RWX flags setting exploit crash Tofsee Exploit DNS crashed 		3 6 3 4.6 M 34 ZeroCERT

9186 2023-12-19 18:35 microsoftprofile.vbs  

7469ff142c0075494c1225977f91ddf5


Generic Malware Antivirus Hide_URL PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted wscript.exe payload download Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		4 5 2 9.0 3 ZeroCERT

9187 2023-12-20 07:48 alex.exe  

794fc2da25b437ba1f88c2276b336c4d


AgentTesla .NET framework(MSIL) PWS SMTP KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed 		2 4 9.6 M ZeroCERT

9188 2023-12-20 07:51 spfasiazx.exe  

89ebe827b46d7e08adb6aa47e3761fed


Formbook PWS AntiDebug AntiVM PE32 PE File .NET EXE PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted ICMP traffic unpack itself Check virtual network interfaces Tofsee Windows ComputerName Cryptographic key crashed 		2 2 10.2 ZeroCERT

9189 2023-12-20 23:29 https://www.luxuryshield.org/?...  


Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		3 2 2 4.2 guest

9190 2023-12-21 07:59 Microsoftdigitalwallettechnolo...  

f306b23f34ca0c9d62c74d45f399d21a


MS_RTF_Obfuscation_Objects RTF File doc Malware download Malware Malicious Traffic buffers extracted exploit crash unpack itself Tofsee Windows Exploit DNS crashed 		1 3 7 3.6 M ZeroCERT

9191 2023-12-21 17:09 file.rar  

6b0f8a62bc4fec439739c021445942f5


Stealc Escalate priviledges PWS KeyLogger AntiDebug AntiVM RedLine Malware download Open Directory Malware c&c Microsoft suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself IP Check PrivateLoader Tofsee Stealc Stealer Windows Discord Exploit RisePro DNS 		52 62 35 5 5.2 M guest

9192 2023-12-22 08:08 rest.exe  

7e267bec235e3a97a82cbc14780e5af1


Themida Packer Malicious Library Admin Tool (Sysinternals etc ...) UPX Anti_VM AntiDebug AntiVM PE32 PE File .NET EXE OS Processor Check PNG Format ZIP Format MSOffice File DLL JPEG Format Lnk Format GIF Format Browser Info Stealer Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files RWX flags setting exploit crash unpack itself Windows utilities Checks Bios Collect installed applications Detects VMWare Check virtual network interfaces suspicious process AppData folder VMware anti-virtualization IP Check installed browsers check Tofsee Ransomware Windows Exploit Browser RisePro Email ComputerName Firmware DNS Cryptographic key Software crashed 		2 6 7 20.0 54 ZeroCERT

9193 2023-12-22 08:13 build2.exe  

e23c839edb489081120befe1e44b04db


Client SW User Data Stealer LokiBot ftp Client info stealer Malicious Library UPX Http API PWS Code injection AntiDebug AntiVM PE32 PE File OS Processor Check VirusTotal Malware Telegram PDB MachineGuid Code Injection Malicious Traffic Checks debugger buffers extracted WMI unpack itself malicious URLs Tofsee ComputerName Remote Code Execution DNS crashed 		1 5 3 11.0 58 ZeroCERT

9194 2023-12-22 15:00 OperaGXSetup.exe  

46431992aa566007949fc4acbc058856


Generic Malware PE32 PE File VirusTotal Malware Malicious Traffic unpack itself Tofsee ComputerName 		1 2 2 3.2 M 47 ZeroCERT

9195 2023-12-23 03:12 SHIPMENT.html  

eee94ac7a87b9751276ff8a8f2dd1545


AntiDebug AntiVM MSOffice File PNG Format Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		1 2 2 3.8 guest

keyword