popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
30871 2022-05-23 07:41 pppp.exe  

523e3a307421539d0d7288098359a3e1


UPX Malicious Library PE32 PE File VirusTotal Malware suspicious privilege Code Injection Check memory Creates executable files unpack itself AppData folder 		5.6 M 38 ZeroCERT

30872 2022-05-23 07:40 update.exe  

9d46b723ec666db3e73ae900c474d660


RAT njRAT backdoor Generic Malware UPX Malicious Library PE32 OS Processor Check PE File .NET EXE VirusTotal Malware AutoRuns PDB suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files ICMP traffic unpack itself Check virtual network interfaces suspicious process AppData folder WriteConsoleW Windows ComputerName RCE DNS 		5 3 11.8 M 54 ZeroCERT

30873 2022-05-23 07:39 key.exe  

30a8841666deb07c981ce7280225ccc9


PWS[m] RAT PWS .NET framework UPX SMTP KeyLogger AntiDebug AntiVM PE32 OS Processor Check .NET EXE PE File Browser Info Stealer Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AgentTesla suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Windows Browser Email ComputerName Cryptographic key Software crashed 		2 2 11.4 M 41 ZeroCERT

30874 2022-05-23 07:37 s1.exe  

40fdf86711473f5ea0f0ba120234f9e2


PE32 PE File VirusTotal Malware DNS 		3 2.6 M 39 ZeroCERT

30875 2022-05-23 07:35 polx.exe  

c65326b66f8e1799d3b4b62ced8431ad


UPX Malicious Library Admin Tool (Sysinternals etc ...) PE32 OS Processor Check PE File VirusTotal Malware AutoRuns unpack itself AntiVM_Disk VM Disk Size Check Windows RCE DNS 		1 4.4 M 37 ZeroCERT

30876 2022-05-23 01:12 jordanwiresharkcapture.pcapng  

05254e8b9b15ef97100a8c0948faad4c


AntiDebug AntiVM Email Client Info Stealer suspicious privilege Checks debugger Creates shortcut unpack itself installed browsers check Browser Email ComputerName 		3.4 guest

30877 2022-05-22 20:32 kingz.exe  

a6ba70f75f6fab4748bffe1784e7e8ff


RAT PWS .NET framework PDF Suspicious Link PDF PE32 .NET EXE PE File icon VirusTotal Malware suspicious privilege Check memory Checks debugger Creates shortcut AppData folder 		1 2 1 4.0 35 ZeroCERT

30878 2022-05-22 20:30 fart.exe  

b8ee75a53bc59d914dbeb41872191014


UPX Malicious Library PE32 OS Processor Check PE File PDB unpack itself RCE DNS 		1 1.8 ZeroCERT

30879 2022-05-22 20:29 vbc.exe  

b3a25f8fa62494ca8b99b28c4b4bb9b7


Formbook RAT PWS .NET framework Generic Malware UPX Antivirus AntiDebug AntiVM PE32 OS Processor Check .NET EXE PE File FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		12 16 2 11 11.0 M 40 ZeroCERT

30880 2022-05-20 17:56 boy.exe  

dbf26c4b639792e4ea4f934f7795bf51


Formbook RAT Hide_EXE AntiDebug AntiVM PE32 .NET EXE PE File FormBook Malware download VirusTotal Malware Phishing suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself suspicious process WriteConsoleW Windows ComputerName Cryptographic key crashed 		17 20 3 10.8 33 ZeroCERT

30881 2022-05-20 17:51 bcg.exe  

24435824ef7a6d34dc007456dd22ade4


RAT AntiDebug AntiVM PE32 .NET EXE PE File FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces suspicious process WriteConsoleW Windows ComputerName DNS Cryptographic key crashed 		2 6 4 9.4 17 ZeroCERT

30882 2022-05-20 17:44 update.exe  

b4aa27a1339c69d99121a4fe4fac94f7


Generic Malware UPX Antivirus PE File PE64 VirusTotal Malware powershell AutoRuns suspicious privilege MachineGuid Check memory Checks debugger Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process Windows ComputerName DNS Cryptographic key 		3 7.8 46 ZeroCERT

30883 2022-05-20 17:43 Protected%20Client.vbs  

55229dd65a8d4ee3d454fe9d2da3b194


AgentTesla PWS[m] Gen2 browser info stealer Generic Malware Google Chrome User Data Malicious Packer Malicious Library Antivirus Create Service Socket ScreenShot DNS Code injection Sniff Audio KeyLogger Downloader Escalate priviledges Hide_URL AntiDebug A VirusTotal Malware powershell suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI heapspray Creates shortcut Creates executable files ICMP traffic unpack itself Check virtual network interfaces suspicious process AppData folder Windows ComputerName Cryptographic key 		3 6 15.8 22 ZeroCERT

30884 2022-05-20 17:41 pm.exe  

22e6d862d6f51b6283b60badf02b6f81


RAT Hide_EXE PE32 .NET EXE PE File VirusTotal Malware Check memory Checks debugger unpack itself 		2.4 48 ZeroCERT

30885 2022-05-20 17:39 smss.exe  

0e69f6e65c1499ec9529d74f53bfe8d0


Loki PWS[m] PWS Loki[b] Loki.m RAT .NET framework UPX Socket DNS AntiDebug AntiVM PE32 OS Processor Check .NET EXE PE File Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Windows Browser Email ComputerName DNS Cryptographic key Software 		1 2 9 1 13.4 M 14 ZeroCERT

keyword