popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
17821 2023-05-14 17:32 ProtonVPN.exe  

d8560a7c131d8313f0f95e49e1aa0b73


Gen1 Gen2 UPX Malicious Library AntiDebug AntiVM OS Processor Check PE File PE32 DLL JPEG Format Browser Info Stealer Malware download VirusTotal Malware RecordBreaker Buffer PE MachineGuid Code Injection Malicious Traffic Check memory buffers extracted Creates executable files unpack itself Collect installed applications AppData folder WriteConsoleW installed browsers check Stealer Windows Browser DNS crashed 		9 2 6 12.4 M 44 ZeroCERT

17822 2023-05-14 17:32 build.exe  

1e0be6fd7600c7218b3542af67ab2a0d


PWS .NET framework RAT UPX OS Processor Check .NET EXE PE File PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Collect installed applications Check virtual network interfaces installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software crashed 		2 3 2 7.4 M 62 ZeroCERT

17823 2023-05-14 17:32 44444444.exe  

4fda10dd689cf07faf7ccad6eeb5b8b3


PWS .NET framework RAT UPX Confuser .NET OS Processor Check .NET EXE PE File PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Malware Check memory Checks debugger buffers extracted unpack itself Collect installed applications installed browsers check Windows Browser ComputerName DNS Cryptographic key Software crashed 		1 5.8 M 49 ZeroCERT

17824 2023-05-14 17:32 clip64.dll  

73c0c85e39b9a63b42f6c4ff6d634f8b


UPX Malicious Library Admin Tool (Sysinternals etc ...) OS Processor Check DLL PE File PE32 VirusTotal Malware PDB Checks debugger unpack itself 		2.0 M 59 ZeroCERT

17825 2023-05-14 17:19 tungbot.exe  

1789934e3f3f870ab38fb363701f5b88


PWS .NET framework RAT UPX OS Processor Check .NET EXE PE File PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Collect installed applications Check virtual network interfaces installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software crashed 		2 3 2 7.4 M 57 ZeroCERT

17826 2023-05-14 17:12 STnew.exe  

9698ef1c3c72a67865b27847f3fcb633


Emotet Gen2 Generic Malware UPX Malicious Library AntiDebug AntiVM OS Processor Check PE File PE32 .NET EXE Malware Buffer PE AutoRuns PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder WriteConsoleW Windows ComputerName RCE DNS Cryptographic key DDNS crashed 		1 3 5 16.4 M ZeroCERT

17827 2023-05-14 17:12 server.exe  

30260b612d994b6c7e5ff1febcb9a157


Formbook RAT .NET EXE PE File PE32 VirusTotal Malware VBScript AutoRuns Check memory Checks debugger WMI wscript.exe payload download Creates executable files unpack itself AntiVM_Disk IP Check VM Disk Size Check Tofsee Interception Windows ComputerName DNS DDNS Dropper 		4 6 6 10.0 M 37 ZeroCERT

17828 2023-05-14 17:10 Widgets.bat  

b03d77953c460064e03d928ce56b1976


Downloader Create Service DGA Socket DNS Code injection HTTP PWS[m] Sniff Audio Steal credential Http API P2P Internet API Escalate priviledges FTP KeyLogger ScreenShot AntiDebug AntiVM suspicious privilege Code Injection Check memory Checks debugger Creates shortcut unpack itself Windows utilities suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		4.0 ZeroCERT

17829 2023-05-14 17:09 file4.ps1  

97b66f50d529a72add418aaf982a6b10


Generic Malware Antivirus PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		1 4.8 M 2 ZeroCERT

17830 2023-05-14 17:09 bild202.exe  

a17af46e9c7bba005d9907ad2b722560


Loki_b Loki_m RedLine stealer[m] Gen1 PWS .NET framework RAT Generic Malware Downloader UPX Malicious Library Antivirus Malicious Packer Create Service DGA Socket DNS Code injection HTTP PWS[m] Sniff Audio Steal credential Http API P2P Internet API Escala Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency Telegram suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger WMI Creates shortcut Creates executable files unpack itself Collect installed applications Check virtual network interfaces suspicious process AppData folder malicious URLs sandbox evasion anti-virtualization installed browsers check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software 		4 6 3 16.6 M 48 ZeroCERT

17831 2023-05-14 17:08 lega.exe  

72361b9ac961ae2ec3e94022f1ccb0a6


RedLine stealer[m] Gen1 Emotet PWS .NET framework RAT RedLine Stealer UPX Malicious Library Confuser .NET SMTP PWS[m] AntiDebug AntiVM CAB PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer AutoRuns PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Disables Windows Security Collect installed applications AppData folder AntiVM_Disk VM Disk Size Check installed browsers check Windows Update Browser ComputerName RCE DNS Cryptographic key Software crashed 		1 14.0 M ZeroCERT

17832 2023-05-14 17:07 HalogenSySCheck.exe  

ee0da89ff62475fe63a8cd12c7134c5e


RedLine stealer[m] RAT PWS .NET framework Generic Malware Downloader UPX Malicious Library Antivirus Confuser .NET Create Service DGA Socket DNS Code injection HTTP PWS[m] Sniff Audio Steal credential Http API P2P Internet API Escalate priviledges FTP Key Browser Info Stealer VirusTotal Malware powershell Telegram suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut Creates executable files unpack itself Collect installed applications powershell.exe wrote Check virtual network interfaces suspicious process AppData folder installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key crashed 		3 4 9.8 M 42 ZeroCERT

17833 2023-05-14 17:05 sonbot2.exe  

862025de8445a34f8543dcc96c806362


PWS .NET framework RAT UPX OS Processor Check .NET EXE PE File PE32 VirusTotal Malware Check memory Checks debugger unpack itself Check virtual network interfaces Windows DNS Cryptographic key 		1 1 3.2 M 57 ZeroCERT

17834 2023-05-14 17:03 file1.ps1  

a02ae4594adc3ed2a6160c84f5cb3a9e


Generic Malware Antivirus PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		1 4.8 M 4 ZeroCERT

17835 2023-05-14 17:03 crypted%20%282%29.exe  

7934a25163e1500d54aded65ce354308


AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		4 2 4.8 M ZeroCERT

keyword