popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
30766 2022-05-25 09:36 wealthzx.exe  

ada99df555a683678791e279044e3fe5


PWS[m] PWS .NET framework SMTP KeyLogger AntiDebug AntiVM PE32 .NET EXE PE File Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed 		1 2 2 12.4 M 21 ZeroCERT

30767 2022-05-25 09:35 DirectDeposits.vbs  

be69cecfe642a937c9bbad0b3c0a49c3


AgentTesla PWS[m] Gen2 browser info stealer Generic Malware Google Chrome User Data Antivirus Malicious Packer Malicious Library Create Service Socket DNS Internet API Code injection Sniff Audio KeyLogger Downloader Escalate priviledges Hide_URL AntiDebug VirusTotal Malware powershell suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI heapspray Creates shortcut Creates executable files ICMP traffic unpack itself Check virtual network interfaces suspicious process AppData folder Windows ComputerName DNS Cryptographic key keylogger 		2 7 17.0 M 2 ZeroCERT

30768 2022-05-25 09:34 MMS.exe  

4469ca72bc5827911bd370575fe41075


RAT PWS .NET framework DNS AntiDebug AntiVM PE32 .NET EXE PE File VirusTotal Malware Buffer PE AutoRuns PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName DNS DDNS 		4 1 15.8 M 35 ZeroCERT

30769 2022-05-25 09:34 toolspab3.exe  

092ee5d919e1ef891d4483c3fce3543b


Malicious Library AntiDebug AntiVM PE32 PE File VirusTotal Malware PDB Code Injection Checks debugger buffers extracted unpack itself RCE DNS 		1 7.8 M 22 ZeroCERT

30770 2022-05-25 09:33 XUY.exe  

1d43452837e9f7c03353b92a317fef5f


RAT PWS .NET framework DNS AntiDebug AntiVM PE32 .NET EXE PE File Malware download Nanocore VirusTotal Malware c&c Buffer PE AutoRuns PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName DNS DDNS 		2 2 14.8 M 34 ZeroCERT

30771 2022-05-25 07:34 tel.exe  

ee6f57229cd8d1156a7fbab15be254a0


UPX Malicious Library PE32 OS Processor Check PE File VirusTotal Malware PDB unpack itself 		2.0 23 ZeroCERT

30772 2022-05-24 18:36 vbc.exe  

f05a460e312d90267b12335c3c86e6a8


PWS[m] Generic Malware UPX Malicious Library Antivirus Create Service DGA Socket ScreenShot DNS Internet API Code injection Sniff Audio HTTP Steal credential KeyLogger P2P Downloader Escalate priviledges FTP Http API AntiDebug AntiVM PE32 PE File Emotet VirusTotal Malware powershell Buffer PE AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic RWX flags setting unpack itself Windows utilities suspicious process WriteConsoleW Tofsee Windows ComputerName DNS Cryptographic key DDNS crashed 		4 8 2 14.2 M 18 ZeroCERT

30773 2022-05-24 18:36 majMSPharm.exe  

6c53f542fb4bf76bba5492fdcd68241b


Malicious Library PE32 PE File DLL VirusTotal Malware Checks debugger unpack itself AppData folder AntiVM_Disk VM Disk Size Check DNS 		1 2.8 M 25 ZeroCERT

30774 2022-05-24 18:34 csrss.exe  

2fc4ab028a0b12f36f20a929118f42c2


Formbook PWS .NET framework Generic Malware Antivirus KeyLogger AntiDebug AntiVM PE32 .NET EXE PE File FormBook Malware download VirusTotal Malware powershell suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key crashed 		8 16 2 12.2 27 ZeroCERT

30775 2022-05-24 18:34 data64_4.exe  

d76ba31bdfb2bb3b2a14704e7ed1c094


Malicious Library PE32 PE File VirusTotal Malware PDB unpack itself RCE 		2.2 M 26 ZeroCERT

30776 2022-05-24 18:32 csrss.exe  

4ef6c0f9a237f7aed67b79b6e5d3e1cc


Formbook RAT PWS .NET framework Generic Malware Antivirus AntiDebug AntiVM PE32 .NET EXE PE File VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		11.2 M 39 ZeroCERT

30777 2022-05-24 18:32 data64_4.exe  

81df5c60780873d34e488655e3838c4d


Malicious Library PE32 PE File VirusTotal Malware PDB unpack itself RCE 		2.4 M 34 ZeroCERT

30778 2022-05-24 18:30 c7crGdejW4380ORuxqR  

d5e9618a54167e7ad174deee219e51a1


UPX Malicious Packer Malicious Library DLL PE File PE64 Dridex TrickBot VirusTotal Malware Report AutoRuns Checks debugger ICMP traffic unpack itself Auto service suspicious process AntiVM_Disk sandbox evasion VM Disk Size Check Kovter Windows ComputerName RCE DNS 		15 3 8.2 8 ZeroCERT

30779 2022-05-24 18:24 document302.lnk  

e134136d442a5c16465d9d7e8afb5ebe


Generic Malware Antivirus AntiDebug AntiVM GIF Format VirusTotal Malware powershell suspicious privilege Code Injection Check memory Checks debugger Creates shortcut unpack itself powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key crashed 		1 1 5.8 29 guest

30780 2022-05-24 17:39 http://14.128.55.148/daol/daol...  

0c4684f95e29cf2ddee362c7e8abe41f


PWS[m] Create Service DGA Socket ScreenShot DNS Internet API Code injection Hijack Network Sniff Audio HTTP Steal credential KeyLogger P2P Downloader Escalate priviledges persistence FTP Http API AntiDebug AntiVM MSOffice File JPEG Format Malware Code Injection Malicious Traffic RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		5 3 2 5.2 guest

keyword