popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
22516 2022-12-07 09:49 csrss.exe  

fc978e8e9d20edf8f2a0c4b157fe1920


Malicious Library UPX PE32 PE File VirusTotal Malware suspicious privilege Malicious Traffic Check memory Creates executable files unpack itself 		22 24 1 17 4.4 M 34 ZeroCERT

22517 2022-12-07 09:48 lib.hta  

b31d78c45268cf98eb09a4ce81ab7f60


Generic Malware Antivirus PowerShell powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		4.8 ZeroCERT

22518 2022-12-07 09:44 s2lub.exe  

2c7867a1749edef10274f3e34b047865


RedLine stealer[m] Malicious Library UPX AntiDebug AntiVM PE32 OS Processor Check PE File Browser Info Stealer FTP Client Info Stealer VirusTotal Malware Buffer PE PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted ICMP traffic unpack itself Collect installed applications WriteConsoleW installed browsers check Windows Browser ComputerName DNS Cryptographic key Software crashed 		56 13.2 M 35 ZeroCERT

22519 2022-12-07 09:43 lib32.hta  

f959e6882af46c0c9b31d88d596444df


Formbook Generic Malware Antivirus PowerShell Malware powershell suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName DNS Cryptographic key 		2 5 6 9.8 M ZeroCERT

22520 2022-12-07 09:41 .svchost.exe  

ba017a929db6156f1bf1ddef8d6766c7


PWS[m] RAT PWS .NET framework Generic Malware Antivirus SMTP KeyLogger AntiDebug AntiVM PE32 .NET EXE PE File Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware powershell suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities Checks Bios Detects VirtualBox powershell.exe wrote suspicious process WriteConsoleW VMware anti-virtualization Windows Browser Email ComputerName Cryptographic key Software crashed keylogger 		17.6 M 22 ZeroCERT

22521 2022-12-07 09:39 shenaka.exe  

cd97907dfa59649f4a1b346c4e4b8243


Malicious Library UPX PE32 PE File Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Check memory Checks debugger Creates executable files unpack itself Check virtual network interfaces AppData folder IP Check Tofsee Windows Browser Email ComputerName Cryptographic key Software crashed keylogger 		2 2 9.0 M 33 ZeroCERT

22522 2022-12-07 09:37 lfjsdk3.exe  

d1964c1b30d01262eccaee06c600d726


Themida Packer Malicious Library PE File PE64 VirusTotal Malware unpack itself Windows crashed 		3.0 M 19 ZeroCERT

22523 2022-12-07 09:34 Fattura_IT9032003.bat  

6f6c9bcd7104d5265ebaba45e7ccd463


PWS[m] Formbook Generic Malware Downloader Antivirus Create Service DGA Socket ScreenShot DNS Internet API Code injection Sniff Audio HTTP Steal credential KeyLogger P2P Escalate priviledges FTP Http API AntiDebug AntiVM PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		1 2 1 8.0 12 ZeroCERT

22524 2022-12-07 09:26 3_IT02530467861_59_06122022_08...  

6d2e558cabf7ca6f0dc0fb8a5262dad5


Generic Malware VBA_macro MSOffice File VirusTotal Malware RWX flags setting unpack itself 		1.4 13 ZeroCERT

22525 2022-12-07 09:26 6_IT08171506083_31_06122022_05...  

73754273e4f7c0eb246d7ab9807736aa


PWS[m] Generic Malware VBA_macro ScreenShot KeyLogger AntiDebug AntiVM MSOffice File VirusTotal Malware Code Injection unpack itself 		2.6 10 ZeroCERT

22526 2022-12-07 09:21 csrss.exe  

58a93725b592923568ede95c067e81b2


Loki PWS[m] PWS Loki[b] Loki.m Socket DNS AntiDebug AntiVM PE32 .NET EXE PE File Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Browser Email ComputerName DNS Software 		1 1 7 1 14.4 M 25 ZeroCERT

22527 2022-12-07 09:19 vbc.exe  

3374b87be5da25a09046d0b59ccc34c7


RAT PWS .NET framework Generic Malware Antivirus PE32 .NET EXE PE File VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger Creates shortcut unpack itself Windows utilities suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		7.8 M 26 ZeroCERT

22528 2022-12-07 09:19 audiodg.exe  

69fb5dc2536e4d17b234363780a2adaf


Loki PWS[m] PWS Loki[b] Loki.m RAT .NET framework Socket DNS AntiDebug AntiVM PE32 .NET EXE PE File Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Browser Email ComputerName DNS Software 		1 1 7 1 13.2 M 23 ZeroCERT

22529 2022-12-07 09:18 document_133_invoice_PDF.msi  

76bf2b13ab0bdb12c1b8fc474fb9984e


Malicious Library ASPack MSOffice File OS Processor Check CAB IcedID Malware download Malware suspicious privilege Malicious Traffic Check memory Checks debugger unpack itself AntiVM_Disk VM Disk Size Check ComputerName 		1 2 1 2.6 guest

22530 2022-12-07 09:17 .win32.exe  

54987f615d048a1355bea79033808d2b


Malicious Library UPX PE32 OS Processor Check PE File VirusTotal Malware PDB unpack itself RCE DNS 		1 2.6 M 28 ZeroCERT

keyword