popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
17566 2023-05-30 13:41 06777499.exe  

6392f9473488585adf633a7fde82f28b


Redline Gen1 Emotet PWS .NET framework RAT RedLine Stealer UPX Malicious Library Admin Tool (Sysinternals etc ...) Confuser .NET SMTP Code injection HTTP PWS[m] Http API Internet API AntiDebug AntiVM CAB PE File PE32 OS Processor Check DLL .NET EXE Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer VirusTotal Malware Cryptocurrency wallets Cryptocurrency Buffer PE AutoRuns PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files RWX flags setting unpack itself Windows utilities Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Ransomware Lumma Stealer Windows Browser ComputerName RCE Firmware DNS Cryptographic key Software crashed 		5 3 14 2 22.8 M 39 ZeroCERT

17567 2023-05-30 10:47 File_pass1234.7z  

0d6f6b6bd8f63cb7ea5854d7fb265cb4


PWS[m] Escalate priviledges KeyLogger AntiDebug AntiVM Malware download VirusTotal Malware suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself IP Check PrivateLoader Tofsee Windows DNS 		11 24 9 3 6.2 M 9 ZeroCERT

17568 2023-05-30 10:25 File_pass1234.7z  

1a2c8653d23e5f54570f9600ea338ab4


PWS[m] Escalate priviledges KeyLogger AntiDebug AntiVM RedLine Malware download Amadey Malware suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself IP Check PrivateLoader Tofsee Stealer Windows DNS 		13 31 14 4 5.8 M ZeroCERT

17569 2023-05-30 10:20 File_pass1234.7z  

1a2c8653d23e5f54570f9600ea338ab4


PWS[m] Escalate priviledges KeyLogger AntiDebug AntiVM suspicious privilege Check memory Checks debugger unpack itself 		1.6 M ZeroCERT

17570 2023-05-30 09:56 foto148.exe  

bd83774449462adfb38deec655db2d53


Gen1 Emotet UPX Malicious Library Malicious Packer Admin Tool (Sysinternals etc ...) CAB PE File PE32 OS Processor Check DLL Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer Malware AutoRuns PDB suspicious privilege Malicious Traffic Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Stealer Windows Browser ComputerName RCE DNS Cryptographic key Software crashed 		3 2 10 3 13.8 M ZeroCERT

17571 2023-05-30 09:54 fotocr06.exe  

990c304a94d6c1421a36461c0b6bee0d


Gen1 Emotet UPX Malicious Library Admin Tool (Sysinternals etc ...) Malicious Packer CAB PE File PE32 OS Processor Check DLL Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer Malware AutoRuns PDB suspicious privilege Malicious Traffic Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Stealer Windows Browser ComputerName RCE DNS Cryptographic key Software crashed 		3 2 10 3 13.8 M ZeroCERT

17572 2023-05-30 09:52 fotocr06.exe  

990c304a94d6c1421a36461c0b6bee0d


Gen1 Emotet UPX Malicious Library Admin Tool (Sysinternals etc ...) Malicious Packer CAB PE File PE32 OS Processor Check DLL Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer Malware AutoRuns PDB suspicious privilege Malicious Traffic Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Stealer Windows Browser ComputerName RCE DNS Cryptographic key Software crashed 		3 2 9 3 13.8 M ZeroCERT

17573 2023-05-30 09:52 foto148.exe  

bd83774449462adfb38deec655db2d53


Gen1 Emotet UPX Malicious Library Malicious Packer Admin Tool (Sysinternals etc ...) CAB PE File PE32 OS Processor Check DLL Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer Malware AutoRuns PDB suspicious privilege Malicious Traffic Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Stealer Windows Browser ComputerName RCE DNS Cryptographic key Software crashed 		3 2 9 3 13.8 M ZeroCERT

17574 2023-05-30 09:45 ddd.xlsb  

0e65c589e0c6edffb3b305e7595a271b


ZIP Format Excel Binary Workbook file format(xlsb) VirusTotal Malware exploit crash unpack itself Exploit crashed 		1.8 M 3 ZeroCERT

17575 2023-05-30 09:40 cc.exe  

6752f0f596295d6281b9f48e291aa5e5


UPX Malicious Library OS Processor Check PE File PE32 VirusTotal Malware unpack itself DNS 		1 2.4 M 27 ZeroCERT

17576 2023-05-30 09:37 macrigan2.1.exe  

c5f9705e5682c03412ec7ca32e22c17c


NSIS UPX Malicious Library PE File PE32 DLL Malware download AveMaria NetWireRC VirusTotal Malware AutoRuns MachineGuid Check memory Creates executable files unpack itself AppData folder Windows RAT ComputerName DNS DDNS keylogger 		3 4 6.0 M 47 ZeroCERT

17577 2023-05-30 09:36 clp6.exe  

d6c0b5e502d7816fa0eb105b10dfa481


UPX Malicious Library OS Processor Check PE64 PE File DNS 		1 2.2 ZeroCERT

17578 2023-05-30 09:36 p0aw25.exe  

8a8c08155bce86d582d32eee9defcfcd


Gen2 Gen1 Malicious Library Malicious Packer PE64 PE File PDB RCE 		0.8 ZeroCERT

17579 2023-05-30 09:35 foto148.exe  

1917a7b5b899f2296d04aea2054e9b15


Gen1 Emotet UPX Malicious Library Admin Tool (Sysinternals etc ...) Malicious Packer CAB PE File PE32 OS Processor Check DLL Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer Malware AutoRuns PDB suspicious privilege Malicious Traffic Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Stealer Windows Browser ComputerName RCE DNS Cryptographic key Software crashed 		3 2 9 3 13.8 M ZeroCERT

17580 2023-05-30 09:34 Zp1TK71j2PhbPpv.exe  

b1fb36fc31e2e9e18b07abc77c833fe8


Suspicious_Script_Bin task schedule Admin Tool (Sysinternals etc ...) ScreenShot AntiDebug AntiVM .NET EXE PE File PE32 Malware download NetWireRC Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces AntiVM_Disk VM Disk Size Check DCRat Windows ComputerName crashed 		4 2 1 9.8 M ZeroCERT

keyword