popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
32986 2022-03-30 00:21 https://tdwcontent.telkomsel.c...  

0582129c935566982f5fa309fe6fb379


AntiDebug AntiVM MSOffice File PNG Format JPEG Format Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		2 2 3.8 Greytroya

32987 2022-03-30 00:19 https://tdwcontent.telkomsel.c...  

0582129c935566982f5fa309fe6fb379


AntiDebug AntiVM MSOffice File PNG Format JPEG Format Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		2 2 3.8 guest

32988 2022-03-29 22:17 H6xxeLefX1I2vgJFM1Y  

7eee2607e8e08b3716c0e91b553682a6


Malicious Packer Malicious Library UPX OS Processor Check DLL PE32 PE File Dridex TrickBot VirusTotal Malware Report Checks debugger ICMP traffic RWX flags setting unpack itself Kovter ComputerName RCE DNS 		26 10 5.4 M 14 ZeroCERT

32989 2022-03-29 22:15 SCAN959_00079.xls  

93bf45cf075f4d8e690046ba964e348f


Excel with Emotet MS_Excel_Hidden_Macro_Sheet Malicious Packer Malicious Library UPX MSOffice File OS Processor Check DLL PE32 PE File Malware download Dridex TrickBot VirusTotal Malware Report AutoRuns Creates shortcut Creates executable files ICMP traffic RWX flags setting exploit crash unpack itself Auto service suspicious process AntiVM_Disk sandbox evasion VM Disk Size Check Kovter Windows Exploit ComputerName DNS crashed 		3 21 11 3 10.4 M 16 ZeroCERT

32990 2022-03-29 22:09 top.exe  

3f6d29bb9a3ddd6cb68799ddc458d147


Malicious Library PE32 PE File VirusTotal Malware PDB unpack itself 		2.0 39 ZeroCERT

32991 2022-03-29 22:05 SCAN959_00079.xls  

93bf45cf075f4d8e690046ba964e348f


PWS[m] Excel with Emotet MS_Excel_Hidden_Macro_Sheet ScreenShot KeyLogger AntiDebug AntiVM MSOffice File VirusTotal Malware Code Injection unpack itself 		6 2.6 16 ZeroCERT

32992 2022-03-29 22:03 BB7  

9a7ac94938452767041f763270f313e2


Malicious Packer Malicious Library UPX OS Processor Check DLL PE32 PE File Dridex TrickBot VirusTotal Malware Report Checks debugger ICMP traffic RWX flags setting unpack itself sandbox evasion Kovter ComputerName RCE DNS 		28 10 5.8 13 ZeroCERT

32993 2022-03-29 18:45 fattura richiesta offerta 0022...  

b1e6b5e71c78e1ced0f1202c45d52ec3


RAT .NET EXE PE32 PE File VirusTotal Malware Check memory Checks debugger unpack itself Windows ComputerName Cryptographic key crashed 		2.4 16 ZeroCERT

32994 2022-03-29 18:44 exploit.html  

aab78c3ac73fe6c1e3440793f9f2fde0


AntiDebug AntiVM PNG Format MSOffice File JPEG Format Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		2 3.8 ZeroCERT

32995 2022-03-29 18:42 csrss.exe  

52352e2a92e0f413f7d97051580823c9


RAT UPX Admin Tool (Sysinternals etc ...) AntiDebug AntiVM .NET EXE PE32 PE File FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process AppData folder malicious URLs WriteConsoleW Windows ComputerName Cryptographic key 		6 6 2 12.8 M 28 ZeroCERT

32996 2022-03-29 18:39 vbc.exe  

2bc50055320d813246c25f14af24ad43


Loki Malicious Library UPX PE32 PE File Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself installed browsers check Browser Email ComputerName DNS Software 		1 2 9 1 9.2 M 29 ZeroCERT

32997 2022-03-29 18:37 vbc.exe  

2452325885751050fd5e987386068a06


Malicious Library UPX PE32 PE File Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself installed browsers check Browser Email ComputerName DNS Software 		1 2 9 9.4 M 35 ZeroCERT

32998 2022-03-29 18:36 vbc.exe  

064fd42a1630d44f682005a653d323af


RAT PWS .NET framework AntiDebug AntiVM .NET EXE PE32 PE File FormBook Malware download VirusTotal Malware Phishing suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		7 16 2 8.0 M 22 ZeroCERT

32999 2022-03-29 18:35 vbc.exe  

156005b919d333c1f8c84128803fca45


Malicious Library UPX PE32 PE File Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName DNS Software 		1 1 7 10.4 M 32 ZeroCERT

33000 2022-03-29 18:33 vet.exe  

be5a9260212bf1ad09d582507cd83c31


PWS[m] PWS .NET framework Generic Malware task schedule UPX Antivirus Create Service DGA Socket ScreenShot DNS Internet API Code injection Sniff Audio HTTP Steal credential KeyLogger P2P Downloader Escalate priviledges FTP Http API AntiDebug AntiVM .NET E VirusTotal Malware powershell AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process AppData folder WriteConsoleW Windows ComputerName Cryptographic key 		12.0 M 20 ZeroCERT

keyword