popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
30976 2022-05-20 10:37 vbc.exe  

cf67271f2b35c9db343f08eba81c2408


PWS[m] RAT Hide_EXE SMTP KeyLogger AntiDebug AntiVM PE32 .NET EXE PE File Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted WMI unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows Browser Email ComputerName Cryptographic key Software crashed keylogger 		2 2 15.2 34 ZeroCERT

30977 2022-05-20 10:36 52.exe  

244646cab529a829e48f3120d716e82c


PWS[m] RedLine stealer[m] UPX Malicious Library AntiDebug AntiVM PE32 OS Processor Check PE File Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted WMI unpack itself Collect installed applications Check virtual network interfaces installed browsers check Windows Browser ComputerName DNS Cryptographic key Software crashed 		2 2 10.6 26 ZeroCERT

30978 2022-05-20 10:34 vbc.exe  

ecf727ab04283bb4eff09cf58a47f38d


PWS[m] SMTP KeyLogger AntiDebug AntiVM PE32 .NET EXE PE File VirusTotal Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows ComputerName Cryptographic key crashed 		9.4 32 ZeroCERT

30979 2022-05-20 10:34 E3406792198.xls  

6fa95c9fc12894519b4332e029f564db


PWS[m] MS_Excel_Hidden_Macro_Sheet ScreenShot KeyLogger AntiDebug AntiVM MSOffice File VirusTotal Malware Code Injection unpack itself 		2.8 25 guest

30980 2022-05-20 10:11 edi.vbs  

f2fd3e3b8ea581fef8c483c2dad1546d


AgentTesla PWS[m] Gen2 browser info stealer Generic Malware Google Chrome User Data Antivirus Malicious Packer Malicious Library Create Service Socket DNS Internet API Code injection Sniff Audio KeyLogger Downloader Escalate priviledges Hide_URL AntiDebug VirusTotal Malware powershell suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI heapspray Creates shortcut Creates executable files ICMP traffic unpack itself Check virtual network interfaces suspicious process AppData folder Windows ComputerName DNS Cryptographic key 		4 7 16.4 3 ZeroCERT

30981 2022-05-20 09:51 a  

ed13c0f818722108fed4022b48bca1b9


Malicious Packer Malicious Library DLL PE File PE64 Dridex TrickBot ENERGETIC BEAR Malware Report AutoRuns Checks debugger ICMP traffic unpack itself Auto service suspicious process Kovter Windows ComputerName DNS crashed 		10 5 7.0 ZeroCERT

30982 2022-05-20 09:49 3  

814c61968eb47e3b94b880c2e9b2a7d9


Malicious Packer Malicious Library DLL PE File PE64 Dridex TrickBot ENERGETIC BEAR Malware Report AutoRuns Checks debugger ICMP traffic unpack itself Auto service suspicious process Kovter Windows ComputerName DNS crashed 		10 5 7.0 ZeroCERT

30983 2022-05-20 09:47 ff.dotm  

b27e7d922dc99ea500f129ebe4fdcd3c


VBA_macro Malicious Library Word 2007 file format(docx) PE32 PE File Malware download VirusTotal Malware AutoRuns Checks debugger WMI Creates executable files RWX flags setting exploit crash unpack itself Windows utilities suspicious process AppData folder Windows Exploit ComputerName crashed 		1 2 2 9.0 25 ZeroCERT

30984 2022-05-20 09:46 VV.tmp  

7ece5b64d1c796869435a2d6eb5dbd3b


Malicious Library PE32 PE File VirusTotal Malware 		1.4 32 ZeroCERT

30985 2022-05-20 07:39 https://malware.me/analysis/up...  

3cd4478ada7ba0ce0e9a0f3a82a53dae


PWS[m] Anti_VM Create Service DGA Socket ScreenShot DNS Internet API Code injection Hijack Network Sniff Audio HTTP Steal credential KeyLogger P2P Downloader Escalate priviledges persistence FTP Http API AntiDebug AntiVM BitCoin icon PNG Format MSOffice F Code Injection Creates executable files RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		50 10 2 4.6 guest

30986 2022-05-20 00:39 .rels  

77bf61733a633ea617a4db76ef769a4d


AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities Windows Exploit DNS crashed 		3.8 guest

30987 2022-05-20 00:39 .rels  

77bf61733a633ea617a4db76ef769a4d


PWS[m] Create Service DGA Socket ScreenShot DNS Internet API Code injection Hijack Network Sniff Audio HTTP Steal credential KeyLogger P2P Downloader Escalate priviledges persistence FTP Http API AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		2 4.8 guest

30988 2022-05-20 00:38 [Content_Types].xml  

f1a40fee6c937b83ef04e859e2067ef0


PWS[m] Create Service DGA Socket ScreenShot DNS Internet API Code injection Hijack Network Sniff Audio HTTP Steal credential KeyLogger P2P Downloader Escalate priviledges persistence FTP Http API AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		2 4.2 guest

30989 2022-05-20 00:37 [Content_Types].xml  

f1a40fee6c937b83ef04e859e2067ef0


AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities Windows Exploit DNS crashed 		3.8 guest

30990 2022-05-19 11:42 PO4550358074.exe  

ed9c16720462e8381b5048cd57be1532


UPX Malicious Library PE32 PE File FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder suspicious TLD DNS 		21 25 3 7.2 34 ZeroCERT

keyword