popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
9196 2023-12-23 18:23 f305ba-b4b69ab5.exe  

683c060ccca9ee3a5dad65946c8c9a88


Generic Malware UPX Antivirus PWS AntiDebug AntiVM PE32 PE File .NET EXE OS Processor Check PNG Format ZIP Format Browser Info Stealer VirusTotal Malware Cryptocurrency wallets Cryptocurrency powershell PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates shortcut unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces suspicious process IP Check Tofsee Ransomware Windows Discord Browser ComputerName DNS Cryptographic key crashed 		3 9 4 15.4 M 49 ZeroCERT

9197 2023-12-23 18:31 Rby1.exe  

e0bc2140d5a10035fb6d3b4e1b46cdfe


Emotet NSIS Generic Malware UPX Malicious Library Antivirus Admin Tool (Sysinternals etc ...) Malicious Packer Anti_VM AntiDebug AntiVM PE File PE64 PNG Format PE32 OS Processor Check BMP Format MZP Format ZIP Format JPEG Format CHM Format DLL icon C VirusTotal Malware Buffer PE AutoRuns Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files RWX flags setting unpack itself Check virtual network interfaces AppData folder malicious URLs AntiVM_Disk suspicious TLD IP Check VM Disk Size Check Tofsee Ransomware Windows ComputerName Firmware DNS 		17 35 12 5 16.8 M 29 ZeroCERT

9198 2023-12-25 23:49 IMG_7005_21603pdf.exe  

733a47d0689018b00e9017be3a92b4de


AgentTesla .NET framework(MSIL) UPX PWS SMTP KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed 		1 6 6 15.4 55 guest

9199 2023-12-26 08:03 wlanext.exe  

cb52c8b5a81a6576eb7d75963f44eab0


Formbook PWS SMTP KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed keylogger 		4 5 11.4 M ZeroCERT

9200 2023-12-26 08:03 288c47bbc1871b42239df19ff4df68...  

3954cc01c26d1962284f3b95602f2367


Generic Malware NSIS Malicious Library UPX Antivirus Admin Tool (Sysinternals etc ...) Malicious Packer Anti_VM AntiDebug AntiVM PE32 PE File .NET EXE PNG Format OS Processor Check MZP Format ZIP Format JPEG Format BMP Format CHM Format DLL icon PE64 CA Malware Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself AppData folder AntiVM_Disk IP Check VM Disk Size Check Tofsee Ransomware Windows DNS 		4 12 10 2 13.4 M ZeroCERT

9201 2023-12-26 08:07 wlanext.exe  

a2f55bda1a5d9cee3bfcc7f30f2c6b44


.NET framework(MSIL) PWS SMTP KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces malicious URLs IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed keylogger 		4 5 12.8 M ZeroCERT

9202 2023-12-27 07:47 valid.exe  

a42c8531e8e1fc631b80fac9f688609c


EnigmaProtector UPX PE32 PE File .NET EXE ZIP Format DLL OS Processor Check Lnk Format GIF Format Browser Info Stealer Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency AutoRuns suspicious privilege MachineGuid Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files unpack itself Windows utilities Collect installed applications Check virtual network interfaces suspicious process AppData folder IP Check installed browsers check Tofsee Ransomware Windows Browser RisePro Email ComputerName Remote Code Execution DNS Cryptographic key Software crashed 		2 4 7 15.2 M 37 ZeroCERT

9203 2023-12-27 07:49 foxi.exe  

25be69edbd38d09faf01adfe59e39da2


Emotet Gen1 SmokeLoader EnigmaProtector Malicious Library UPX PE32 PE File CAB ZIP Format Lnk Format GIF Format DLL OS Processor Check .NET EXE Browser Info Stealer Malware download FTP Client Info Stealer Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency AutoRuns PDB suspicious privilege MachineGuid Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files unpack itself Windows utilities Collect installed applications Check virtual network interfaces suspicious process AppData folder AntiVM_Disk IP Check VM Disk Size Check human activity check installed browsers check Tofsee Ransomware Windows Browser RisePro Email ComputerName Remote Code Execution DNS Cryptographic key Software crashed 		2 4 7 15.0 ZeroCERT

9204 2023-12-28 07:55 Klassikas.exe  

66f5f2edbd70030763f4d19266889288


PE32 PE File VirusTotal Malware unpack itself Tofsee crashed 		1 2 2 2.2 37 ZeroCERT

9205 2024-01-05 07:54 newbuild.exe  

51d74fa113ee4efae8e73626e9277dff


Malicious Library Malicious Packer UPX PE32 PE File OS Processor Check Malware download Amadey VirusTotal Malware AutoRuns Malicious Traffic Check memory Creates executable files unpack itself Windows utilities suspicious process AppData folder WriteConsoleW Tofsee Windows ComputerName DNS 		3 9 3 8.6 55 ZeroCERT

9206 2024-01-05 07:58 bongo.exe  

98e589da2cf91986d1e703189919dec1


RedLine stealer Emotet Gen1 Amadey RedlineStealer NSIS Generic Malware Malicious Library UPX .NET framework(MSIL) Malicious Packer Admin Tool (Sysinternals etc ...) Antivirus ScreenShot PWS Anti_VM AntiDebug AntiVM PE32 PE File CAB .NET EXE OS Processor Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency Microsoft Buffer PE AutoRuns PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files RWX flags setting exploit crash unpack itself Windows utilities Disables Windows Security Collect installed applications Check virtual network interfaces suspicious process AppData folder AntiVM_Disk WriteConsoleW IP Check VM Disk Size Check installed browsers check Kelihos Tofsee Ransomware Stealer Windows Exploit Browser RisePro Email ComputerName Remote Code Execution DNS Cryptographic key Software crashed 		29 23 27 1 26.6 M 38 ZeroCERT

9207 2024-01-06 10:41 test3.doc  

4333cf43659835679e5f6e9371611b46


VBA_macro Generic Malware AntiDebug AntiVM MSOffice File Vulnerability VirusTotal Malware Code Injection wscript.exe payload download unpack itself Tofsee 		2 2 6.6 M 31 ZeroCERT

9208 2024-01-06 10:48 test2.doc  

794004e79c07dbba60e1307549c04c3d


VBA_macro Generic Malware AntiDebug AntiVM MSOffice File VirusTotal Malware Code Injection wscript.exe payload download RWX flags setting exploit crash unpack itself Tofsee Exploit crashed 		2 2 7.0 M 30 ZeroCERT

9209 2024-01-08 09:38 newrock.exe  

3133d3642bfa4a27451dc4ba649d0c50


Generic Malware Malicious Packer UPX Malicious Library PE32 PE File .NET EXE PE64 VirusTotal Malware MachineGuid Check memory Checks debugger Creates executable files unpack itself Check virtual network interfaces AppData folder Tofsee crashed 		2 3 1 5.8 M 45 ZeroCERT

9210 2024-01-10 08:07 288c47bbc187122b439df19ff4df68...  

d872ad98ce3e3db8497ccd15e0baad33


NPKI HermeticWiper Generic Malware Suspicious_Script NSIS Malicious Library UPX Antivirus Admin Tool (Sysinternals etc ...) Malicious Packer Anti_VM Javascript_Blob PE32 PE File .NET EXE PNG Format JPEG Format OS Processor Check MZP Format ZIP Format ico VirusTotal Malware Malicious Traffic Check memory Checks debugger Creates executable files unpack itself AppData folder AntiVM_Disk IP Check VM Disk Size Check Tofsee Ransomware Windows DNS 		3 6 9 1 10.2 M 51 ZeroCERT

keyword