popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
9256 2024-01-19 08:04 room.exe  

b716baea0866421f013912e77e5db815


EnigmaProtector Malicious Library UPX Malicious Packer Code injection Socket ScreenShot Steal credential DNS AntiDebug AntiVM PE32 PE File .NET EXE MSOffice File OS Processor Check Browser Info Stealer Malware download FTP Client Info Stealer Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency AutoRuns PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files RWX flags setting exploit crash unpack itself Windows utilities Disables Windows Security suspicious process AppData folder malicious URLs AntiVM_Disk sandbox evasion WriteConsoleW anti-virtualization IP Check VM Disk Size Check installed browsers check Tofsee Ransomware Windows Update Exploit Browser RisePro Email ComputerName DNS Software crashed Downloader 		13 14 12 2 23.8 M ZeroCERT

9257 2024-01-19 08:05 conhost.exe  

9c477f0a3dc97e81cd2a76e339b38c7c


AgentTesla UPX PWS SMTP KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Software crashed keylogger 		2 4 11.0 M ZeroCERT

9258 2024-01-19 08:07 conhost.exe  

db2097a73708c43f88d3fd6d7a017b13


Generic Malware .NET framework(MSIL) Antivirus PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer AutoRuns suspicious privilege Check memory Checks debugger Creates shortcut unpack itself Windows utilities Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed 		3 4 9.8 M ZeroCERT

9259 2024-01-19 15:00 Adobe_acrobat_installer.exe  

e2cb17fc7f799e6c39fdbe4aa2c8c06e


AgentTesla Generic Malware .NET framework(MSIL) Antivirus PWS KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware powershell Telegram PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed keylogger 		4 6 14.2 32 guest

9260 2024-01-19 18:19 vimu.exe  

520050ab79ad5b13e6de5d3d7941d4d2


Malicious Packer UPX Anti_VM PE32 PE File Malware download Malware AutoRuns MachineGuid buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW IP Check Tofsee Windows RisePro ComputerName DNS crashed 		1 5 5 7.0 ZeroCERT

9261 2024-01-20 18:19 zonak.exe  

d1d8db81157f989532108d62c64cbc33


Amadey Malicious Packer UPX Malicious Library Anti_VM AntiDebug AntiVM PE32 PE File .NET EXE MSOffice File OS Processor Check DLL ZIP Format Browser Info Stealer Malware download Amadey FTP Client Info Stealer Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files RWX flags setting exploit crash unpack itself Windows utilities Disables Windows Security suspicious process AppData folder AntiVM_Disk sandbox evasion WriteConsoleW anti-virtualization IP Check VM Disk Size Check Tofsee Ransomware Windows Update Exploit Browser RisePro Email ComputerName DNS Software crashed Downloader 		21 17 18 7 19.6 M ZeroCERT

9262 2024-01-22 12:32 rty45.exe  

c5431ed88227d6f2e201da982db63f38


Malicious Packer UPX PE File PE64 VirusTotal Malware PDB MachineGuid unpack itself Check virtual network interfaces Tofsee Remote Code Execution 		1 3 1 3.0 46 ZeroCERT

9263 2024-01-22 12:35 rty27.exe  

90ab18d69c8c28f797acf90b61d656df


Malicious Packer UPX PE File PE64 PDB MachineGuid unpack itself Check virtual network interfaces Tofsee Remote Code Execution 		1 3 1 1.8 ZeroCERT

9264 2024-01-22 12:39 build.exe  

57935225dcb95b6ed9894d5d5e8b46a8


RedlineStealer RedLine Infostealer RedLine stealer .NET framework(MSIL) UPX Malicious Library Malicious Packer Antivirus PE32 PE File .NET EXE OS Processor Check Browser Info Stealer RedLine Malware download FTP Client Info Stealer VirusTotal Malware suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Collect installed applications Check virtual network interfaces AppData folder installed browsers check Tofsee Stealer Windows Browser ComputerName DNS Cryptographic key Software crashed 		3 3 9 9.2 62 ZeroCERT

9265 2024-01-22 12:45 RisePro_1.4_oCtFry7ogY0hng063r...  

1c8918482b9cd613ba75ab7a16463e18


Generic Malware Malicious Library Malicious Packer UPX PE32 PE File OS Processor Check ZIP Format PNG Format Browser Info Stealer Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency AutoRuns MachineGuid Check memory buffers extracted Windows utilities Disables Windows Security Collect installed applications suspicious process AntiVM_Disk sandbox evasion WriteConsoleW anti-virtualization IP Check VM Disk Size Check installed browsers check Tofsee Ransomware Windows Browser RisePro Email ComputerName DNS Software crashed 		1 5 7 13.2 M 14 ZeroCERT

9266 2024-01-23 08:04 face.exe  

b367a4da8177d0be7638599aad1caa9b


Amadey Generic Malware NSIS Malicious Packer Malicious Library UPX Antivirus Admin Tool (Sysinternals etc ...) Anti_VM AntiDebug AntiVM PE32 PE File PNG Format OS Processor Check DLL .NET EXE ZIP Format MZP Format JPEG Format BMP Format CHM Format Browser Info Stealer Malware download Amadey FTP Client Info Stealer Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files RWX flags setting exploit crash unpack itself Windows utilities Disables Windows Security Collect installed applications Check virtual network interfaces suspicious process AppData folder AntiVM_Disk sandbox evasion WriteConsoleW anti-virtualization IP Check VM Disk Size Check installed browsers check Tofsee Ransomware Windows Update Exploit Browser RisePro Email ComputerName DNS Software crashed Downloader 		19 23 19 8 25.8 M ZeroCERT

9267 2024-01-23 14:15 PrivateCheat.exe  

92d5541274a80650bf7fc9d40f2be865


Generic Malware Downloader Malicious Library UPX MPRESS Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM PE32 PE File OS Processor C VirusTotal Malware PDB Code Injection Creates executable files AppData folder suspicious TLD Tofsee ComputerName Remote Code Execution crashed 		2 1 5.4 M 28 ZeroCERT

9268 2024-01-23 14:19 IEbrowserUpdates.vbs  

b188e3740962ca8e83f9a86ab3889c9f

VirusTotal Malware wscript.exe payload download Tofsee 		2 2 2 2.6 M 3 ZeroCERT

9269 2024-01-23 14:50 http://www.amazon.ca  

f0d918f20a6893435e7ed9012fffbce2


Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM icon MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		4 6 2 4.2 guest

9270 2024-01-24 07:58 dd.exe  

cce53392d805e6fbfdbccf4527d53c26


AgentTesla Generic Malware .NET framework(MSIL) Antivirus PWS SMTP KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed keylogger 		2 4 13.6 38 ZeroCERT

keyword