popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
15301 2021-11-12 11:01 papizx.exe  

779f94d5fe55e6d397d40e438954edae


PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		7 16 2 8.0 24 ZeroCERT

15302 2021-11-12 11:05 wnserve.exe  

ecbdb6be1aa503f9a9a7c783677b639a


RAT PWS .NET framework Generic Malware Malicious Packer Malicious Library UPX PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Malicious Traffic Check memory Checks debugger unpack itself Disables Windows Security Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed 		2 4 3 8.6 43 ZeroCERT

15303 2021-11-12 11:06 vbc.exe  

f7058072591bbc7032cc0daedbccbf85


Generic Malware Malicious Packer Malicious Library UPX PE File OS Processor Check PE32 Check memory RWX flags setting unpack itself crashed 		1.2 ZeroCERT

15304 2021-11-12 11:10 uqiwang.exe  

2fa17055cbe751f03a57d8b8ec3c6cd4


Emotet Gen1 Gen2 Generic Malware Malicious Packer Malicious Library UPX MPRESS Anti_VM ASPack VMProtect Socket KeyLogger Escalate priviledges ScreenShot AntiDebug AntiVM PE File OS Processor Check PE32 DLL PE64 GIF Format VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory buffers extracted WMI Creates shortcut Creates executable files unpack itself Check virtual network interfaces suspicious process AntiVM_Disk sandbox evasion WriteConsoleW anti-virtualization VM Disk Size Check ComputerName Remote Code Execution 		5 21 13.0 18 ZeroCERT

15305 2021-11-12 15:38 OCT STATEMENT 2021.exe  

8c6bfb5a2b22475020ac017903981236


PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process AppData folder malicious URLs WriteConsoleW Windows Browser Email ComputerName Cryptographic key Software crashed 		14.4 25 Kim.GS

15306 2021-11-13 11:01 skyzx.exe  

add49d5c2fd2a4cd8e535828536a22b5


Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		9 20 1 8.0 20 ZeroCERT

15307 2021-11-13 11:06 low-1087878423.xls  

8d7a8ba815b3f83ef3200028f23e0b9d


Downloader MSOffice File RWX flags setting unpack itself 		0.8 ZeroCERT

15308 2021-11-13 11:09 lianzhanst.exe  

96e4d115b0edc2d77fb7b447e11fda39


ASPack UPX PE File PE32 VirusTotal Malware Detects VMWare Check virtual network interfaces AntiVM_Disk sandbox evasion VMware anti-virtualization VM Disk Size Check Remote Code Execution Software crashed 		3 5.4 21 ZeroCERT

15309 2021-11-13 11:11 242.exe  

75adcf794cf086e354c4534f2a6f2369


RAT PWS .NET framework Generic Malware UPX PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Malware Cryptocurrency wallets Cryptocurrency suspicious privilege MachineGuid Check memory Checks debugger buffers extracted unpack itself Collect installed applications anti-virtualization installed browsers check Windows Browser ComputerName DNS Cryptographic key Software crashed 		1 1 7.4 34 ZeroCERT

15310 2021-11-13 11:14 toolspab2.exe  

bc4940fd19fe5e89a56a42833a39ef68


Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32 Malware PDB Code Injection Checks debugger buffers extracted unpack itself 		6.0 ZeroCERT

15311 2021-11-13 11:14 ry.exe  

6b37045bf22d1a6617551099626f4dec


PWS Loki[b] Loki.m RAT Generic Malware Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName Software 		1 2 7 12.8 16 ZeroCERT

15312 2021-11-13 11:16 8577_1636402824_8748.exe  

b1a0bc55343edb874ec4c54cbb5a21b4


Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself 		2.6 50 ZeroCERT

15313 2021-11-13 11:16 hk.exe  

d80556615215eb36fa163f14720e6411


Loki PWS Loki[b] Loki.m RAT Generic Malware Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Browser Email ComputerName Software 		2 2 7 1 12.8 33 ZeroCERT

15314 2021-11-13 11:18 sefile.exe  

e05a1928cd4ad6e8ffd8258bf653670b


Darkside Ransomware Cobalt Strike Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself 		1.8 20 ZeroCERT

15315 2021-11-13 11:18 2113_1636729338_8051.exe  

44ad735bb80385db6f54e921733dbf48


RAT Generic Malware PE File PE32 .NET EXE VirusTotal Malware Check memory Checks debugger unpack itself ComputerName 		1.8 24 ZeroCERT

keyword