popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
15571 2021-11-18 13:51 15_1637082780_2946.exe  

9733aef1c8ec194a3198ab8e0130b7d4


Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself 		2.0 31 ZeroCERT

15572 2021-11-18 13:52 bird.png  

b56472432fa955761c7b65e7dee8ef60


UPX PE File OS Processor Check PE32 Remote Code Execution 		0.8 ZeroCERT

15573 2021-11-18 13:52 http://msg-intl.qy.net/v5/ypt/...  

d41d8cd98f00b204e9800998ecf8427e


AntiDebug AntiVM MSOffice File VirusTotal Malware Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		2 2 2 4.2 C0d3_22

15574 2021-11-18 13:52 1307_1637053872_8294.exe  

5e435815f049849380d659c3acd2d586


RAT PWS .NET framework Generic Malware UPX PE File OS Processor Check PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege Check memory Checks debugger buffers extracted WMI unpack itself Collect installed applications installed browsers check Windows Browser ComputerName DNS Cryptographic key Software crashed 		1 7.0 36 ZeroCERT

15575 2021-11-18 13:53 123_3k.exe  

6d1eaa01bd0f3d10232bf630175b839b


RAT Generic Malware PE File PE32 .NET EXE VirusTotal Malware Check memory Checks debugger unpack itself ComputerName 		2.2 46 ZeroCERT

15576 2021-11-18 13:54 vbc.exe  

60dcceaab4c8bc1cb2ae40251a8c392c


PWS .NET framework Generic Malware UPX Antivirus AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities suspicious process malicious URLs WriteConsoleW Windows ComputerName Cryptographic key 		2 5 1 10.8 38 ZeroCERT

15577 2021-11-18 13:56 vbc.exe  

26e5c50888216d7043a917cd84b4a5f4


Loki PWS Loki[b] Loki.m .NET framework Generic Malware UPX Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Browser Email ComputerName Software 		2 2 7 1 12.8 37 ZeroCERT

15578 2021-11-18 13:56 .winlogon.exe  

bdecfbc4b9c5903f3aed22d53243d223


Generic Malware Admin Tool (Sysinternals etc ...) UPX SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process AppData folder WriteConsoleW Windows Browser Email ComputerName Cryptographic key Software crashed 		14.6 31 ZeroCERT

15579 2021-11-18 13:58 winlogon.exe  

295acb5c48efe1c1e6c57889667737bd


Malicious Library UPX PE File PE32 OS Processor Check DLL Emotet VirusTotal Malware Code Injection Check memory Creates executable files unpack itself AppData folder 		4.4 33 ZeroCERT

15580 2021-11-18 14:00 XUBS  

bef026b729256d39132f096b48001494


Emotet Malicious Library UPX PE File OS Processor Check PE32 DLL Dridex TrickBot Malware Report Checks debugger unpack itself Kovter ComputerName DNS 		28 5 4.2 ZeroCERT

15581 2021-11-18 14:01 vbc.exe  

0a770b1e9cad5b9c83a9514bc4083aee


Loki Malicious Library UPX PE File PE32 OS Processor Check DLL Browser Info Stealer LokiBot Malware download FTP Client Info Stealer Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName DNS Software 		2 2 10 1 9.6 ZeroCERT

15582 2021-11-18 14:01 winbox.exe  

d6b53ece8c20cf28f16303c1e79bd51c


Generic Malware Admin Tool (Sysinternals etc ...) Malicious Library UPX PE File PE32 Check memory Checks debugger unpack itself Check virtual network interfaces Remote Code Execution 		1.4 C0d3_22

15583 2021-11-18 14:03 Client300US.exe  

50cca6dcc4b8820bc69b0fdd79a9effc


RAT PWS .NET framework Generic Malware Malicious Packer Antivirus Malicious Library UPX PE File PE32 .NET EXE OS Processor Check VirusTotal Malware Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Check virtual network interfaces AppData folder 		1 2 5.0 31 ZeroCERT

15584 2021-11-18 14:05 .csrss.exe  

48230cc4b335325066ecf05f69c021da


PWS Loki[b] Loki.m .NET framework Generic Malware UPX Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Browser Email ComputerName Software 		1 2 7 13.4 35 ZeroCERT

15585 2021-11-18 14:07 UnletDeejay1500.exe  

3e88c11d9b4cbdf2e30c039521a3ba7d


UltraVNC Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB suspicious privilege Check memory Checks debugger WMI unpack itself Collect installed applications installed browsers check Windows Browser ComputerName DNS Cryptographic key crashed 		1 6.4 49 ZeroCERT

keyword