popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
18106 2023-04-28 21:49 Info.plist  

f657748c487be57acf2028a6b0cbe26c


AntiDebug AntiVM Email Client Info Stealer suspicious privilege Checks debugger Creates shortcut unpack itself installed browsers check Browser Email ComputerName 		3.4 BRY

18107 2023-04-28 17:14 sddd.exe  

f30050237e1e4b07f13d8b4e4ecf8209


Formbook NSIS UPX Malicious Library PE32 PE File FormBook Malware download VirusTotal Malware suspicious privilege Malicious Traffic Check memory Creates executable files unpack itself Windows 		17 20 4 15 6.0 M 43 ZeroCERT

18108 2023-04-28 17:14 originalbuild.exe  

9f9583b07cf9622b9db6299ca6157012


RAT Generic Malware Antivirus .NET EXE PE32 PE File PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName DNS Cryptographic key 		1 6.0 M 28 ZeroCERT

18109 2023-04-28 17:14 locals.ps1  

f5e06be9bc58695ff043f1d9465fb519


Generic Malware Antivirus VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		4.8 2 ZeroCERT

18110 2023-04-28 17:13 build(3).exe  

8bc904cbf806e8b28b6c21f1321fa019


PWS .NET framework RAT Downloader Create Service DGA Socket DNS Code injection HTTP PWS[m] Sniff Audio Steal credential Http API P2P Internet API Escalate priviledges FTP KeyLogger ScreenShot AntiDebug AntiVM .NET EXE PE32 PE File Browser Info Stealer VirusTotal Malware Cryptocurrency wallets Cryptocurrency Telegram AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder WriteConsoleW IP Check Tofsee Ransomware Windows Browser ComputerName DNS 		2 7 5 10.0 M 52 ZeroCERT

18111 2023-04-28 17:12 vbc.exe  

3a15cf1904040c1ce7e87d05c6468d1e


Formbook PWS .NET framework AntiDebug AntiVM .NET EXE PE32 PE File VirusTotal Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself DNS 		1 8.2 M 30 ZeroCERT

18112 2023-04-28 17:12 vbc.exe  

ec0a5abf67bd616d4b77dd264a10c643


UPX Malicious Library OS Processor Check PE32 PE File VirusTotal Malware PDB unpack itself RCE 		2.0 M 23 ZeroCERT

18113 2023-04-28 17:10 vpn.exe  

4b32941cd92e048e6a2d16c6069edf62


NPKI Generic Malware UPX MPRESS Antivirus PE32 PE File Browser Info Stealer VirusTotal Malware Cryptocurrency wallets Cryptocurrency powershell suspicious privilege Check memory Checks debugger buffers extracted WMI heapspray Creates shortcut unpack itself Windows utilities Checks Bios Detects VMWare powershell.exe wrote suspicious process VMware anti-virtualization Ransomware Windows Browser ComputerName RCE Firmware DNS Cryptographic key crashed 		1 14.6 M 50 ZeroCERT

18114 2023-04-28 09:43 ProjectFunding_B496.wsf  

de0e6380f06d01c12e312b58221c1fcd

VirusTotal Malware VBScript wscript.exe payload download ICMP traffic DNS Dropper 		1 1 10.0 2 ZeroCERT

18115 2023-04-28 09:10 ads.exe  

cd675f6fa51e9a1bca95f3eb11c78fc2


UPX Malicious Library OS Processor Check PE32 PE File VirusTotal Malware Checks debugger RWX flags setting unpack itself DNS crashed 		1 3.0 12 ZeroCERT

18116 2023-04-28 09:09 photo_410.exe  

522ae0a94eb64b2124168a956e661bc3


Gen1 Emotet PWS .NET framework RAT UPX Malicious Library Confuser .NET Malicious Packer Admin Tool (Sysinternals etc ...) CAB PE32 PE File OS Processor Check .NET EXE DLL Browser Info Stealer Malware download Amadey FTP Client Info Stealer Malware AutoRuns PDB suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Disables Windows Security Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Windows Update Browser ComputerName RCE DNS Cryptographic key Software crashed 		5 2 7 15.8 M ZeroCERT

18117 2023-04-28 09:08 ProjectFunding_D305.wsf  

254f413905e4ba561b0a85fa7c3a4790

VBScript wscript.exe payload download ICMP traffic DNS Dropper 		1 1 10.0 guest

18118 2023-04-28 09:07 ProjectFunding_B496.wsf  

de0e6380f06d01c12e312b58221c1fcd

VirusTotal Malware unpack itself crashed 		1.0 2 guest

18119 2023-04-28 09:07 Xjpclientser40.exe  

ffa8c73e6d2a1a51812008ec7f31105b


PWS .NET framework NPKI RAT Generic Malware Downloader UPX Create Service DGA Socket DNS Code injection HTTP PWS[m] Sniff Audio Steal credential Http API P2P Internet API Escalate priviledges FTP KeyLogger ScreenShot AntiDebug AntiVM OS Processor Check .N VirusTotal Malware AutoRuns PDB suspicious privilege Code Injection Check memory Checks debugger Creates shortcut Creates executable files unpack itself Windows utilities suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		5.6 4 ZeroCERT

18120 2023-04-28 07:48 payload  

994bde201ba16c5e33bba7d4e6cbe3f4


Loki_b Loki_m UPX Malicious Packer Malicious Library OS Processor Check PE32 PE File Browser Info Stealer VirusTotal Malware Cryptocurrency wallets Cryptocurrency Malicious Traffic buffers extracted unpack itself Collect installed applications installed browsers check Ransomware Browser ComputerName RCE Firmware DNS 		1 1 1 8.0 M 41 ZeroCERT

keyword