Submissions

Date range button:

First seen:

Last seen:

No	Date	Request	Urls	Hosts	IDS	Score	Zero	VT	Player
1681	2025-03-08 12:11	8.exe 02320b5a9ffb3aa91fc2fe0f0906c575 Malicious Packer PE File PE64 VirusTotal Malware suspicious privilege Check memory Checks debugger unpack itself Windows utilities suspicious process WriteConsoleW Windows ComputerName				4.0	M	53	ZeroCERT

1682	2025-03-08 12:10	67a4ea0f-a626-4118-b393-80fb7f... a8a583a880111a63bc81037ee0248e19 PE File .NET EXE PE32 VirusTotal Malware Code Injection Check memory Checks debugger unpack itself				5.0	M	59	ZeroCERT

1683	2025-03-08 12:07	pwHxMTy.exe d3f96bf44cd5324ee9109a7e3dd3acb4 PE File .NET EXE PE32 VirusTotal Malware Check memory Checks debugger unpack itself ComputerName				2.8		50	ZeroCERT

1684	2025-03-08 12:07	223ed60e-7c3f-4203-ab46-549662... 93e601392dd24741a740d6d63c248c60 PE File .NET EXE PE32 VirusTotal Malware Check memory Checks debugger unpack itself ComputerName				2.8		55	ZeroCERT

1685	2025-03-08 12:05	2c723a71-ac56-4b53-8a88-a24224... 4ca928ae23fcfa668b951b98f847a10c Malicious Library PE File .NET EXE PE32 VirusTotal Malware Check memory Checks debugger unpack itself ComputerName				2.8		52	ZeroCERT

1686	2025-03-08 12:05	3158e964-6e73-4443-84f8-ddb304... ce869420036665a228c86599361f0423 Downloader PE File PE64 Malware download VirusTotal Malware Malicious Traffic Checks debugger Creates executable files sandbox evasion Windows Browser RCE DNS	1 Keyword trend analysis	2	6 Info ET DROP Spamhaus DROP Listed Traffic Inbound group 12 ET MALWARE Possible Malicious Macro DL EXE Feb 2016 ET INFO Executable Download from dotted-quad Host ET INFO TLS Handshake Failure ET POLICY PE EXE or DLL Windows file download HTTP ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	5.2	M	55	ZeroCERT

1687	2025-03-08 12:03	WindowsAutHost.exe dcde423f70ce1bcb0b6cc519c15d7ab6 ROMCOM RAT Malicious Library PE File PE64 VirusTotal Malware				1.8		47	ZeroCERT

1688	2025-03-08 12:03	10.exe 8f1f692c2e839e6f821e42057f8b1c01 Malicious Packer PE File PE64 VirusTotal Malware suspicious privilege MachineGuid Check memory Checks debugger unpack itself Windows utilities suspicious process WriteConsoleW Windows				4.0		55	ZeroCERT

1689	2025-03-07 18:26	ji5E4ie.exe f0ad59c5e3eb8da5cbbf9c731371941c Gen1 Generic Malware Admin Tool (Sysinternals etc ...) Malicious Library UPX Malicious Packer PE File PE32 DLL OS Processor Check Browser Info Stealer Malware download Vidar VirusTotal Malware c&c Malicious Traffic Check memory Checks debugger Creates executable files unpack itself Checks Bios Collect installed applications Detects VMWare sandbox evasion VMware anti-virtualization installed browsers check Stealc Stealer Windows Browser ComputerName crashed plugin	9 Keyword trend analysis Info http://dugong.ydns.eu//kj2h34kj23h4/msvcp140.dll http://dugong.ydns.eu//kj2h34kj23h4/vcruntime140.dll http://dugong.ydns.eu//kj2h34kj23h4/nss3.dll http://dugong.ydns.eu//kj2h34kj23h4/sqlite3.dll http://dugong.ydns.eu//kj2h34kj23h4/softokn3.dll http://dugong.ydns.eu//gtthfbsb2h.php http://dugong.ydns.eu/ http://dugong.ydns.eu//kj2h34kj23h4/freebl3.dll http://dugong.ydns.eu//kj2h34kj23h4/mozglue.dll	2	14 Info ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in ET MALWARE Win32/Stealc Requesting browsers Config from C2 ET MALWARE Win32/Stealc Active C2 Responding with browsers Config M1 ET MALWARE Win32/Stealc Requesting plugins Config from C2 ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 ET MALWARE Win32/Stealc Submitting System Information to C2 ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity ET POLICY PE EXE or DLL Windows file download HTTP ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity	11.2	M	50	ZeroCERT

1690	2025-03-07 18:26	ADFoyxP.exe 45c1abfb717e3ef5223be0bfc51df2de Generic Malware Downloader Malicious Library UPX Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM PE File VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities suspicious process AppData folder malicious URLs sandbox evasion WriteConsoleW Windows ComputerName				7.6	M	20	ZeroCERT

1691	2025-03-07 18:21	9hUDDVk.exe 87fc5821b29f5cdef4d118e71c764501 Generic Malware Malicious Library PE File PE32 VirusTotal Malware unpack itself				1.4	M	37	ZeroCERT

1692	2025-03-07 18:19	HmngBpR.exe cac77e1df9d179c4febe6e2a557bb32b Malicious Library UPX PE File PE64 OS Processor Check MZP Format VirusTotal Malware unpack itself RCE crashed				2.0		15	ZeroCERT

1693	2025-03-07 18:18	AvKILpK.exe 62e0e13255e6d691f0769e9cab0215ed PE File .NET EXE PE32 VirusTotal Malware Check memory Checks debugger unpack itself ComputerName				2.6	M	37	ZeroCERT

1694	2025-03-07 09:58	black.exe 37bace39942a74fbd02c012ac0901a9c RedLine Infostealer RedLine stealer Malicious Library .NET framework(MSIL) Confuser .NET UPX PE File .NET EXE PE32 OS Processor Check VirusTotal Malware Check memory Checks debugger unpack itself Windows DNS Cryptographic key		1		3.8	M	58	ZeroCERT

1695	2025-03-07 09:55	green.exe 2bef804009372c028d63cf411764147d RedLine Infostealer RedLine stealer Malicious Library .NET framework(MSIL) Confuser .NET UPX PE File .NET EXE PE32 OS Processor Check VirusTotal Malware Check memory Checks debugger unpack itself Windows DNS Cryptographic key		2		3.8	M	59	ZeroCERT