popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
33016 2022-03-29 18:15 vbc.exe  

6b348f9bfa46990cff38dfe9ba3adbda


Malicious Library UPX PE32 PE File Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself AntiVM_Disk suspicious TLD VM Disk Size Check installed browsers check Browser Email ComputerName DNS Software 		1 2 9 10.0 M 27 ZeroCERT

33017 2022-03-29 18:15 Sexnamz.exe  

976f76ebeda1d3bb4c28e66aa9afea51


RAT .NET EXE PE32 PE File VirusTotal Malware Check memory Checks debugger unpack itself Check virtual network interfaces Tofsee ComputerName 		2 2 2.4 M 19 ZeroCERT

33018 2022-03-29 18:13 data64_6.exe  

546e3319cfb508ace94e05e61269feed


Malicious Library UPX OS Processor Check PE32 PE File DLL VirusTotal Malware PDB unpack itself AppData folder RCE 		2.2 26 ZeroCERT

33019 2022-03-29 18:13 data64_4.exe  

ab432b2f52c18153165a9a06494151e7


Obsidium protector UPX .NET EXE PE32 PE File Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege Check memory Checks debugger buffers extracted WMI RWX flags setting unpack itself Collect installed applications sandbox evasion installed browsers check Windows Browser ComputerName DNS Cryptographic key Software crashed 		1 1 11.2 33 ZeroCERT

33020 2022-03-29 18:01 1. [Walter Jennings] Personal ...  

b274a86e2acedf8865ee95edc4f3f47d


MSOffice File 		0.8 ZeroCERT

33021 2022-03-29 17:59 Password.txt.lnk  

36e0d86d3f4200b532abbf11fee58926


PWS[m] Create Service DGA Socket ScreenShot DNS Internet API Code injection Sniff Audio HTTP Steal credential KeyLogger P2P Downloader Escalate priviledges FTP Http API AntiDebug AntiVM GIF Format VirusTotal Malware Code Injection Check memory Creates shortcut RWX flags setting unpack itself Check virtual network interfaces suspicious process malicious URLs WriteConsoleW Tofsee Interception DNS 		2 4 2 5.8 4 ZeroCERT

33022 2022-03-29 15:04 13541207303175.xls  

b930948a5a4d40f0a930e4be34cd25aa


PWS[m] Excel with Emotet MS_Excel_Hidden_Macro_Sheet ScreenShot KeyLogger AntiDebug AntiVM MSOffice File Code Injection unpack itself 		2.0 guest

33023 2022-03-29 14:59 83643725299106680614.xls  

740c2fd49ffd35f90ee0b03d1040a28a


emotet Excel with Emotet MS_Excel_Hidden_Macro_Sheet Malicious Packer Malicious Library UPX MSOffice File OS Processor Check PE32 DLL PE File Malware download Dridex TrickBot VirusTotal Malware Report AutoRuns Creates executable files RWX flags setting unpack itself Auto service suspicious process sandbox evasion Kovter Windows ComputerName DNS 		1 26 13 1 8.2 M 16 r0d

33024 2022-03-29 14:55 83643725299106680614.xls  

740c2fd49ffd35f90ee0b03d1040a28a


emotet Excel with Emotet Malicious Packer Malicious Library UPX MSOffice File OS Processor Check DLL PE File PE32 Malware download Dridex TrickBot VirusTotal Malware Report AutoRuns Creates executable files RWX flags setting unpack itself Auto service suspicious process sandbox evasion Kovter Windows ComputerName DNS 		1 26 13 1 8.2 M 16 r0d

33025 2022-03-29 13:58 83643725299106680614.xls  

740c2fd49ffd35f90ee0b03d1040a28a


Malicious Packer Malicious Library UPX MSOffice File OS Processor Check DLL PE File PE32 Malware download Dridex TrickBot VirusTotal Malware Report AutoRuns Creates shortcut Creates executable files RWX flags setting exploit crash unpack itself Auto service suspicious process AntiVM_Disk sandbox evasion VM Disk Size Check Kovter Windows Exploit ComputerName DNS crashed 		6 26 13 9.6 M 16 ZeroCERT

33026 2022-03-29 13:56 aM099L  

ea0c35e43ddf4445527be47eeaf30791


Malicious Packer Malicious Library UPX OS Processor Check DLL PE File PE32 Dridex TrickBot VirusTotal Malware Report Checks debugger RWX flags setting unpack itself sandbox evasion Kovter ComputerName RCE DNS 		24 10 5.4 M 18 ZeroCERT

33027 2022-03-29 13:49 setup.exe  

3ee6ee71af56cf7112b4a5540e2368d3


PE File PE32 unpack itself crashed 		1.2 ZeroCERT

33028 2022-03-29 10:16 WW14.bmp  

5546c1ab6768292b78c746d9ea627f4a


Gen2 HermeticWiper Emotet Malicious Library UPX Malicious Packer OS Processor Check PE File PE32 DLL PE64 Browser Info Stealer Malware download VirusTotal Malware Malicious Traffic Check memory Checks debugger WMI Creates executable files RWX flags setting unpack itself Disables Windows Security Checks Bios Check virtual network interfaces AppData folder suspicious TLD sandbox evasion anti-virtualization IP Check Tofsee Windows Discord Browser ComputerName DNS crashed 		12 21 13 1 13.6 M 28 ZeroCERT

33029 2022-03-29 10:11 fixtool.exe  

181257a9a48b6d3ba1b58ca7cd857916


RAT Emotet Gen2 Gen1 Formbook PWS .NET framework Trojan_PWS_Stealer Generic Malware Credential User Data Downloader Malicious Library UPX VMProtect Malicious Packer Anti_VM Admin Tool (Sysinternals etc ...) Obsidium protector SQLite Cookie AntiDebug Anti Browser Info Stealer NetWireRC VirusTotal Malware suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files ICMP traffic RWX flags setting unpack itself Windows utilities Checks Bios Detects VirtualBox Detects VMWare Check virtual network interfaces suspicious process AppData folder AntiVM_Disk sandbox evasion WriteConsoleW VMware anti-virtualization VM Disk Size Check installed browsers check Tofsee Ransomware Interception Windows Browser RAT ComputerName Firmware DNS crashed 		11 29 7 1 23.0 M 38 ZeroCERT

33030 2022-03-29 10:10 XRwzF.exe  

d351703bda08a7ecedd5dc0567b2686c


Formbook PE File PE32 FormBook Malware download VirusTotal Malware suspicious privilege Malicious Traffic ICMP traffic unpack itself DNS 		11 28 2 4.6 M 46 ZeroCERT

keyword