popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
1966 2024-07-24 09:24 DRWG-347RB1.pd.xls  

c433eae598bb293ae5c2f28ad9a61c3b


MSOffice File VirusTotal Malware unpack itself Tofsee DNS 		3 3 1 3.0 15 ZeroCERT

1967 2024-07-24 09:20 Wasabi.msi  

1cd72a4f59963a1fee86e0d98f47e17d


Generic Malware Malicious Library Antivirus UPX Malicious Packer MSOffice File OS Processor Check PE File DLL PE32 VirusTotal Malware suspicious privilege Check memory Checks debugger unpack itself AppData folder AntiVM_Disk VM Disk Size Check ComputerName 		1 2 3.0 M 9 ZeroCERT

1968 2024-07-24 09:17 thissystemchangingentireproces...  

485c8b0bbaec4e72949307d766a4bfba


MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware VBScript Malicious Traffic RWX flags setting exploit crash Tofsee Exploit DNS crashed 		2 6 4 1 4.6 M 37 ZeroCERT

1969 2024-07-24 09:15 wegivemebackwithentiresituatio...  

45b6040d50bff71bd32e8d7a0bc56bd4


MS_RTF_Obfuscation_Objects RTF File doc Malware download VirusTotal Malware Telegram Malicious Traffic RWX flags setting exploit crash IP Check Tofsee Windows Exploit DNS DDNS crashed keylogger 		3 7 14 5.4 M 36 ZeroCERT

1970 2024-07-24 09:14 pw.ps1  

2ffeb8859aa9c7142ed094588a5442b8


Lnk Format GIF Format VirusTotal Malware powershell AutoRuns Malicious Traffic Check memory WMI Creates shortcut Creates executable files unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces WriteConsoleW Tofsee Windows ComputerName DNS Cryptographic key 		1 3 1 9.0 M 19 ZeroCERT

1971 2024-07-24 09:14 simpleweightcreatednicething.g...  

bc2278089ce81da106bd59335fa9e998


Generic Malware Antivirus PowerShell Malware download VirusTotal Malware VBScript powershell suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted wscript.exe payload download Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName DNS Cryptographic key Dropper 		2 3 5 2 10.0 M 7 ZeroCERT

1972 2024-07-24 09:13 simplethingseverywherehappenin...  

adfee8b962087fe5108f615806ce6903


MS_RTF_Obfuscation_Objects RTF File doc Malware download VirusTotal Malware Malicious Traffic RWX flags setting exploit crash Tofsee Exploit DNS crashed 		3 4 5 2 4.6 M 37 ZeroCERT

1973 2024-07-24 09:10 mydatinglifeissoggod.vbs  

3d6214efa393e9c67ecfbd8ca4bda0a7


Generic Malware Antivirus PowerShell VirusTotal Malware VBScript powershell suspicious privilege Check memory Checks debugger buffers extracted wscript.exe payload download Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName DNS Cryptographic key Dropper 		2 4 3 1 10.0 M 7 ZeroCERT

1974 2024-07-24 07:53 winiti.exe  

2d0799f49041670aafa005363a5577ab


Generic Malware Malicious Library .NET framework(MSIL) Antivirus PWS SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer Malware PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed keylogger 		2 4 6 16.0 M ZeroCERT

1975 2024-07-24 07:51 rinqu.exe  

8e5286e3caa11c78e275892a38f2e772


Vidar Client SW User Data Stealer LokiBot ftp Client info stealer Malicious Library .NET framework(MSIL) UPX ASPack Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 OS Processor Check FTP Client Info Stealer Malware Telegram PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Software 		2 5 3 1 16.0 M ZeroCERT

1976 2024-07-24 07:49 winiti.exe  

632bc57649205a43aab8ab7f6e3fb744


AgentTesla Generic Malware Malicious Library .NET framework(MSIL) Antivirus PWS SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer Malware AutoRuns PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed 		2 4 5 14.6 ZeroCERT

1977 2024-07-24 07:46 winiti.exe  

33f3dc03864d8d5cce813683d49ad2dd


Malicious Library .NET framework(MSIL) PE File .NET EXE PE32 PDB Check memory Checks debugger unpack itself 		1.4 ZeroCERT

1978 2024-07-24 07:44 JxTcJM84e3NbGP4.exe  

adbe420a49db30f75d4665ea0014af43


XWorm Generic Malware WebCam Malicious Library Antivirus AntiDebug AntiVM PE File .NET EXE PE32 suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself suspicious process AntiVM_Disk WriteConsoleW VM Disk Size Check Windows ComputerName DNS Cryptographic key 		1 9.8 M ZeroCERT

1979 2024-07-24 07:43 doc_00394039424.exe  

e34683e560b0c2a5cddcffe98956ea62


Client SW User Data Stealer Backdoor RemcosRAT browser info stealer Generic Malware Google Chrome User Data Downloader Malicious Library .NET framework(MSIL) Antivirus Create Service Socket ScreenShot Escalate priviledges PWS Sniff Audio DNS Internet API powershell AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut RWX flags setting exploit crash unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW Tofsee Windows Exploit ComputerName DNS Cryptographic key crashed 		1 3 4 13.2 ZeroCERT

1980 2024-07-24 07:42 jrn10.exe  

675737d9b22bcfefe651c11bd47d404c


Malicious Library .NET framework(MSIL) UPX ScreenShot AntiDebug AntiVM PE File .NET EXE PE32 PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself 		6.8 M ZeroCERT

keyword