Submissions

Date range button:

First seen:

Last seen:

No	Date	Request	Urls	Hosts	IDS	Rule	Score	Zero	VT	Player
15241	2021-11-11 18:03	1827_1636530810_6708.exe e9b67e6f0a059589c1961058240cb838 RAT PWS .NET framework Generic Malware UPX PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Malware Cryptocurrency wallets Cryptocurrency suspicious privilege MachineGuid Check memory Checks debugger buffers extracted WMI unpack itself Collect installed applications anti-virtualization Windows Browser ComputerName DNS Cryptographic key Software crashed		1			7.6		22	ZeroCERT

15242	2021-11-11 18:04	2498_1636548319_2155.exe b73c34e7b239cf0d14810c17fecefbe7 AntiDebug AntiVM PE File PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Malware Buffer PE Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Checks Bios Collect installed applications Detects VirtualBox Detects VMWare Check virtual network interfaces VMware anti-virtualization installed browsers check Tofsee Windows Browser ComputerName Firmware Cryptographic key Software crashed	1 Keyword trend analysis	4	1		15.2		21	ZeroCERT

15243	2021-11-11 18:05	monsterbez.exe 4be4a8e13248732ef335846c1c698f41 Generic Malware PE64 PE File VirusTotal Malware					1.6		46	ZeroCERT

15244	2021-11-11 18:05	vbc.exe 79de3bce09570e3bb85fd9d25129b66e Loki Malicious Library UPX PE File PE32 DLL Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder installed browsers check Browser Email ComputerName DNS Software	1 Keyword trend analysis	2	10 Info ET INFO DNS Query for Suspicious .gq Domain ET MALWARE LokiBot User-Agent (Charon/Inferno) ET MALWARE LokiBot Checkin ET INFO HTTP POST Request to Suspicious .gq domain ET INFO HTTP Request to a .gq domain ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 ET MALWARE LokiBot Request for C2 Commands Detected M1 ET MALWARE LokiBot Request for C2 Commands Detected M2 ET MALWARE LokiBot Fake 404 Response	1	10.0	M	27	ZeroCERT

15245	2021-11-11 18:08	mani.exe c69a436220ad459a2d95b676b2117ed4 Generic Malware Antivirus PE File PE32 VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself powershell.exe wrote Check virtual network interfaces suspicious process suspicious TLD WriteConsoleW Tofsee Windows ComputerName Cryptographic key Downloader	2 Keyword trend analysis	2	1		10.0		45	ZeroCERT

15246	2021-11-11 18:08	3692_1636556145_8677.exe bc6f4099025d6db07f5b02263373669a RAT Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware Code Injection Check memory Checks debugger buffers extracted unpack itself Windows DNS Cryptographic key		1			8.2		26	ZeroCERT

15247	2021-11-11 18:10	man.exe 8c7c7e3c8fc3a994a3c750b630659288 Generic Malware PE64 PE File VirusTotal Malware					1.6		46	ZeroCERT

15248	2021-11-11 18:10	wing.exe 879a851bd78644ebba209795a77b5a52 RAT BitCoin Generic Malware UPX AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Collect installed applications Check virtual network interfaces installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software crashed	2 Keyword trend analysis	3	1		12.0		45	ZeroCERT

15249	2021-11-11 18:12	9794_1636547330_2341.exe 435b9c498c170c228aaa2006c59e91d0 Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself					2.4		31	ZeroCERT

15250	2021-11-11 18:12	soldd.exe 9b2f6be44e539ac5d83f67e625b19250 Generic Malware Antivirus PE File PE32 VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key Downloader	2 Keyword trend analysis	2	1		10.0		47	ZeroCERT

15251	2021-11-11 18:14	main.exe 469608ac8c6416d714329e77660c1d14 Generic Malware PE64 PE File VirusTotal Malware					1.2		28	ZeroCERT

15252	2021-11-11 18:14	kolopl.exe dc1db19dc72e4fc4dd1b96d694d37eca Generic Malware Antivirus PE File PE32 VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key Downloader	2 Keyword trend analysis	2	1		10.0		42	ZeroCERT

15253	2021-11-11 18:16	cold.exe cd9f3adc821e4e49280cb5ee057fb876 Generic Malware PE64 PE File VirusTotal Malware					1.6		45	ZeroCERT

15254	2021-11-11 18:19	222.exe 2142910c24f15815b247e457891beab4 Generic Malware Antivirus PE64 PE File VirusTotal Malware powershell AutoRuns suspicious privilege MachineGuid Check memory Checks debugger Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process Windows ComputerName Cryptographic key					5.8		40	ZeroCERT

15255	2021-11-11 18:21	kolop.exe 256e66c0fef525db6cec42d72971d846 Generic Malware PE64 PE File VirusTotal Malware					1.6		48	ZeroCERT