popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
30931 2022-05-20 13:40 csrsrv.exe  

37710c8c1faa69416e6fd5ef93bff1b2


Emotet Gen1 Hide_EXE UPX Malicious Library PE32 PE File OS Processor Check PNG Format Browser Info Stealer Malware download VirusTotal Malware Buffer PE AutoRuns PDB suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Collect installed applications Check virtual network interfaces AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check SectopRAT Windows Browser Backdoor ComputerName RCE DNS Cryptographic key crashed 		1 4 1 14.4 35 ZeroCERT

30932 2022-05-20 13:39 asdf.EXE  

c7a310982da68b10360854f9cd78e718


PWS[m] PWS Loki[b] Loki.m RAT Formbook Hide_EXE UPX Malicious Library ASPack Socket ScreenShot DNS Internet API HTTP KeyLogger Http API AntiDebug AntiVM PE32 .NET EXE PE File OS Processor Check Browser Info Stealer Malware download Vidar VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files ICMP traffic unpack itself Windows utilities Collect installed applications Check virtual network interfaces suspicious process AppData folder malicious URLs WriteConsoleW anti-virtualization installed browsers check Mars Stealer Stealer Windows Browser Email ComputerName crashed Downloader 		6 3 9 2 19.2 M 52 ZeroCERT

30933 2022-05-20 13:39 vbc.exe  

4bd0d6054b35f571797a9b8390f3bcb1


Formbook UPX AntiDebug AntiVM PE32 .NET EXE PE File FormBook Malware download VirusTotal Malware PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows DNS Cryptographic key 		10 26 2 9 9.4 M 43 ZeroCERT

30934 2022-05-20 13:37 cpwsfmvg.exe  

fbdd6ec733a992431f55c00f88600fbd


[m] Generic Malware task schedule Admin Tool (Sysinternals etc ...) AntiDebug AntiVM PE32 .NET EXE PE File VirusTotal Malware PDB Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities WriteConsoleW Windows ComputerName Cryptographic key 		8.6 39 ZeroCERT

30935 2022-05-20 13:36 vbc.exe  

c3d24ca1d36fa354df3de6ca57a979d4


UPX Malicious Library PE32 PE File FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Creates executable files ICMP traffic unpack itself DNS 		23 24 4 8.0 45 ZeroCERT

30936 2022-05-20 13:35 vbc.exe  

0ffe5b11dd9dd40ecd5351b0b49d740c


PWS[m] RAT PWS .NET framework SMTP KeyLogger AntiDebug AntiVM PE32 .NET EXE PE File VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows ComputerName Cryptographic key crashed 		9.0 25 ZeroCERT

30937 2022-05-20 13:35 MMgPaaTLnCEW9ld.exe  

dd85efd89363d750152bd9216dd9141d


Formbook RAT PWS .NET framework AntiDebug AntiVM PE32 .NET EXE PE File FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted ICMP traffic unpack itself Windows Cryptographic key 		7 14 1 10.2 39 ZeroCERT

30938 2022-05-20 13:35 domla.exe  

aee375e4146251b66ba38231c842eb87


UPX Malicious Library PE32 PE File FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Creates executable files unpack itself DNS 		2 6 2 1 5.6 M 36 ZeroCERT

30939 2022-05-20 13:34 .wininit.exe  

6fe5d177bbb51993bd295d3246551743


Loki PWS[m] PWS Loki[b] Loki.m RAT Socket DNS AntiDebug AntiVM PE32 .NET EXE PE File Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Windows Browser Email ComputerName DNS Cryptographic key Software 		1 2 9 1 13.0 M 27 ZeroCERT

30940 2022-05-20 13:34 vbc.exe  

765610beaf98118cdb0ce8c382c3f22e


Formbook UPX AntiDebug AntiVM PE32 .NET EXE PE File FormBook Malware download VirusTotal Malware PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows Cryptographic key 		11 25 2 10 9.4 M 27 ZeroCERT

30941 2022-05-20 13:30 rtst1058.exe  

3d955768ec92553ed5ce8763951ea94b


Malicious Library VMProtect PE File PE64 VirusTotal Malware crashed 		2.4 42 ZeroCERT

30942 2022-05-20 13:29 .winlogon.exe  

e5de3d7a842f077da31aec68eec0a6e5


PWS[m] RAT NPKI email stealer Socket DNS Code injection KeyLogger Downloader Escalate priviledges persistence AntiDebug AntiVM PE32 .NET EXE PE File Browser Info Stealer VirusTotal Email Client Info Stealer Malware PDB MachineGuid Code Injection Check memory Checks debugger buffers extracted WMI unpack itself AntiVM_Disk VM Disk Size Check installed browsers check Windows Browser Email ComputerName DNS Cryptographic key crashed 		1 11.2 38 ZeroCERT

30943 2022-05-20 13:27 7  

a779b4298cfb967f3dad8155e41bb53c


Malicious Packer Malicious Library DLL PE File PE64 Dridex TrickBot ENERGETIC BEAR Malware Report AutoRuns Checks debugger ICMP traffic unpack itself Auto service suspicious process AntiVM_Disk VM Disk Size Check Kovter Windows ComputerName DNS crashed 		10 5 7.4 ZeroCERT

30944 2022-05-20 13:26 wlanext32.exe  

c62851430b3ba42e3f5137a554596167


Malicious Packer Malicious Library PE File PE64 VirusTotal Malware Checks debugger RCE crashed 		2.0 21 ZeroCERT

30945 2022-05-20 13:22 smss.exe  

ac918dea5d3998bb8794d4826ffc0b79


Loki PWS[m] PWS Loki[b] Loki.m RAT .NET framework Socket DNS AntiDebug AntiVM PE32 .NET EXE PE File Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Windows Browser Email ComputerName DNS Cryptographic key Software 		1 2 9 1 14.4 M 26 ZeroCERT

keyword