popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
17896 2023-05-11 09:21 NDA_D673_May_10.wsf  

883bbc5030fbf590ef98edc18c49565b


Malware VBScript Malicious Traffic WMI heapspray wscript.exe payload download ComputerName DNS Dropper 		6 6 10.0 ZeroCERT

17897 2023-05-11 09:16 koIWDRc.exe  

c0578edb37d43cc63a01b287436f4e67


Generic Malware Suspicious_Script_Bin UPX Malicious Library Antivirus Anti_VM MZP Format PE File PE32 BMP Format OS Processor Check VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut Creates executable files unpack itself powershell.exe wrote suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check Windows ComputerName DNS Cryptographic key 		1 6.4 16 ZeroCERT

17898 2023-05-11 09:15 photo_570.exe  

9521fd6fc4a58dd4ae3c47d95eb91557


Gen1 Emotet PWS .NET framework RAT UltraVNC UPX Malicious Library Admin Tool (Sysinternals etc ...) Malicious Packer Confuser .NET CAB PE File PE32 OS Processor Check DLL .NET EXE Browser Info Stealer Malware download Amadey FTP Client Info Stealer Malware AutoRuns PDB suspicious privilege Malicious Traffic Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities Disables Windows Security Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Windows Update Browser ComputerName RCE DNS Cryptographic key Software crashed 		6 2 6 3 16.0 M ZeroCERT

17899 2023-05-11 09:11 i.exe  

5093a300dc7623ead1d35860a6312011


UPX Malicious Library OS Processor Check PE File PE32 VirusTotal Malware unpack itself RCE 		2.4 M 55 ZeroCERT

17900 2023-05-11 09:08 Yezmtqs.js  

353e7a94b3f5723043d83640fe5d85fd


Generic Malware Antivirus Hide_URL AntiDebug AntiVM PowerShell powershell suspicious privilege Code Injection Check memory Checks debugger Creates shortcut unpack itself suspicious process Windows ComputerName Cryptographic key 		1 6.2 ZeroCERT

17901 2023-05-11 09:08 Lscwklt.js  

72794cef000741d517cab446ccb3b4e6


Generic Malware Antivirus Hide_URL AntiDebug AntiVM PowerShell powershell suspicious privilege Code Injection Check memory Checks debugger Creates shortcut unpack itself suspicious process Windows ComputerName Cryptographic key 		1 6.2 ZeroCERT

17902 2023-05-11 09:08 Aqrwa.js  

92fae833978ae39133e33b9c17d782ec


Generic Malware Antivirus Hide_URL AntiDebug AntiVM PowerShell powershell suspicious privilege Code Injection Check memory Checks debugger Creates shortcut unpack itself suspicious process Windows ComputerName Cryptographic key 		6.2 ZeroCERT

17903 2023-05-10 18:57 vbc.exe  

24429aa11d39dddc2e9daec4bcba9ed0


Formbook KeyLogger AntiDebug AntiVM .NET EXE PE File PE32 Browser Info Stealer Telegram PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Tofsee Windows Browser ComputerName DNS crashed keylogger 		2 4 9.6 M ZeroCERT

17904 2023-05-10 18:56 vbc.exe  

953db0fa8e971527b18ae9abc387f7a2


Formbook KeyLogger AntiDebug AntiVM .NET EXE PE File PE32 VirusTotal Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows ComputerName crashed keylogger 		9.6 M 25 ZeroCERT

17905 2023-05-10 18:40 QQQQQ%23%23%23%23%23%23%23%23%...  

74f63aa2d67f8c772a62b45904c46caf


MS_RTF_Obfuscation_Objects RTF File doc Malware download VirusTotal Malware Telegram Malicious Traffic buffers extracted exploit crash unpack itself Tofsee Windows Exploit DNS crashed Downloader 		1 3 11 4.8 M 29 ZeroCERT

17906 2023-05-10 18:21 PO.exe  

c884d60fea6f63974e134023a934894a


AntiDebug AntiVM PE64 PE File FormBook Malware download VirusTotal Malware PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		10 12 2 8.6 M 12 ZeroCERT

17907 2023-05-10 18:18 build.exe  

c9baa6f493c047ea988df511eae16cc8


PWS .NET framework RAT UPX OS Processor Check .NET EXE PE File PE32 VirusTotal Malware Check memory Checks debugger unpack itself Check virtual network interfaces Windows DNS Cryptographic key 		1 5.2 M 64 ZeroCERT

17908 2023-05-10 18:16 path  

7fc09e90a6b01b4e45dfb74a398ab841


PWS .NET framework RAT UPX Malicious Library VMProtect OS Processor Check PE File PE32 .NET EXE VirusTotal Malware PDB Check memory Checks debugger Creates executable files unpack itself AppData folder RCE DNS 		1 6.0 M 36 ZeroCERT

17909 2023-05-10 18:16 vbc.exe  

992a0de4e5038847edbe7f400f3ccfd2


Formbook NSIS UPX Malicious Library PE File PE32 DLL FormBook Malware download VirusTotal Malware suspicious privilege Malicious Traffic Check memory Creates executable files ICMP traffic unpack itself AppData folder DNS 		21 25 2 20 6.2 M 36 ZeroCERT

17910 2023-05-10 18:12 loki.exe  

49f6547db1a057139da206876f7cac86


Generic Malware UPX Malicious Library OS Processor Check PE File PE32 VirusTotal Malware PDB unpack itself RCE 		2.2 M 32 ZeroCERT

keyword