popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
10096 2024-06-11 14:45 DocuSign.vbs  

73999f3f3808981c1470956082ebc738


VirusTotal Malware wscript.exe payload download Tofsee 		2 1 1.6 7 ZeroCERT

10097 2024-06-11 14:47 DocuSign.url  

1bb21d7cfa769080240279276bf0da2e


AntiDebug AntiVM URL Format MSOffice File Malware Code Injection Malicious Traffic RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		2 1 2 4.2 ZeroCERT

10098 2024-06-12 07:38 kenzo.exe  

fe7e4a096f69688dc594ef1fe7a776fd


Malicious Packer PE32 PE File ZIP Format Browser Info Stealer Malware download FTP Client Info Stealer Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency AutoRuns MachineGuid Check memory buffers extracted unpack itself Windows utilities Collect installed applications suspicious process AntiVM_Disk sandbox evasion WriteConsoleW anti-virtualization IP Check VM Disk Size Check installed browsers check Tofsee Ransomware Windows Browser RisePro Email ComputerName DNS Software crashed 		1 5 9 12.2 ZeroCERT

10099 2024-06-12 10:09 entirethingscleantogetlionsisa...  

1ea13f7866b6cdb3407f6c7e72857b99


MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware Malicious Traffic RWX flags setting exploit crash Tofsee Exploit DNS crashed 		2 3 2 4.2 M 33 ZeroCERT

10100 2024-06-12 10:11 sevendaytounderstamndhowmuchsw...  

c272b9af2086b381b4e4fc7328897cf4


MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware Malicious Traffic buffers extracted RWX flags setting exploit crash Tofsee Exploit DNS crashed 		2 3 2 4.6 M 37 ZeroCERT

10101 2024-06-12 13:25 bas.bat  

c3d227e82f84533c2918a6239b99ff2d


Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM PNG Format MSOffice File JPEG Format powershell suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut RWX flags setting exploit crash unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW Tofsee Windows Exploit ComputerName Cloudflare DNS Cryptographic key crashed 		2 4 2 7.0 ZeroCERT

10102 2024-06-12 15:17 fb34_gate2.rar  

a229ecb9458451d9691f269857aec75d


Escalate priviledges PWS KeyLogger AntiDebug AntiVM Malware download Cryptocurrency Miner Malware Telegram suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself IP Check Tofsee Windows Discord RisePro DNS CoinMiner 		8 36 24 4 4.2 M ZeroCERT

10103 2024-06-13 11:38 DIP.exe  

3f02a2516380a49f81ae8e15e7f548cc


Process Kill Generic Malware Suspicious_Script_Bin Malicious Library FindFirstVolume CryptGenKey UPX Device_File_Check PE32 PE File OS Processor Check Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed 		1 2 3 7.0 38 ZeroCERT

10104 2024-06-14 07:47 qgtplfgy2.exe  

3d033b03106e5b46abde0df781c164d5


Process Kill Generic Malware Suspicious_Script_Bin Malicious Library FindFirstVolume CryptGenKey UPX Device_File_Check PE32 PE File OS Processor Check Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer suspicious privilege Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Tofsee Windows Browser Email ComputerName Software crashed 		2 2 7.4 M ZeroCERT

10105 2024-06-14 09:20 bin2.doc  

118072abaca518e6ece93908a9fee1f4


MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware RWX flags setting exploit crash suspicious TLD Tofsee Exploit DNS crashed 		17 16 3 4.4 M 33 ZeroCERT

10106 2024-06-14 09:22 bin1.doc  

ab6398c625d0ae23c0582ad07d044581


MS_RTF_Obfuscation_Objects RTF File doc Cobalt Strike Cobalt VirusTotal Malware c&c RWX flags setting exploit crash Tofsee Exploit DNS crashed 		19 4 3.2 M 32 ZeroCERT

10107 2024-06-14 09:24 sharo.doc  

8b049d5e850fc75c1cef5edb8fc68feb


Formbook MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware exploit crash unpack itself suspicious TLD Tofsee Exploit DNS crashed 		21 7 12 3.6 M 33 ZeroCERT

10108 2024-06-14 10:46 file.rar  

c6479683dc4b3a056b853c2f66e20998


Escalate priviledges PWS KeyLogger AntiDebug AntiVM Malware download Cryptocurrency Miner Malware Telegram suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself IP Check Tofsee Windows Discord RisePro DNS CoinMiner 		10 36 25 7 4.2 M ZeroCERT

10109 2024-06-14 18:39 licc.doc  

af079d569c6115b1f3998c7cce495168


MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware Malicious Traffic exploit crash unpack itself Tofsee Exploit DNS crashed 		2 3 2 4.4 M 29 ZeroCERT

10110 2024-06-14 18:40 rothc.doc  

40d18ab9b48c16d917ab69e101fa45eb


Formbook MS_RTF_Obfuscation_Objects RTF File doc Cobalt Strike Cobalt VirusTotal Malware c&c exploit crash unpack itself Tofsee Exploit DNS crashed 		23 7 14 3.2 M 32 ZeroCERT

keyword