popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
35446 2022-01-20 09:40 5510542784046312.exe  

f49ec9a85b03f6f03d3e05329ba80f91


RAT Generic Malware Antivirus SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware powershell AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut unpack itself powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW IP Check Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed 		3 6 15.4 M 28 ZeroCERT

35447 2022-01-20 09:40 bryantzx.exe  

98dbb3a09173419e5b0ea454d47f5bd2


PWS Loki[b] Loki.m .NET framework Generic Malware DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Windows Browser Email ComputerName DNS Cryptographic key Software crashed 		1 2 13.8 M 36 ZeroCERT

35448 2022-01-20 09:39 Confirm Invoice Payment.pdf.ex...  

a61ffe0d35b03412243beb998d032775


RAT PWS .NET framework Generic Malware TEST PE File PE32 .NET EXE VirusTotal Malware PDB Malicious Traffic Check memory Checks debugger unpack itself Check virtual network interfaces 		1 2 3.6 22 ZeroCERT

35449 2022-01-20 09:39 JCM.exe  

860b0a92b07e6a2ef28c93195537f86d


RAT PWS .NET framework Generic Malware SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces malicious URLs IP Check Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed 		2 4 13.0 M 20 ZeroCERT

35450 2022-01-20 09:38 0377654_642.xlsm  

f8e68c7017b69142a2ac0aab8cbe8582


Generic Malware Antivirus Malicious Packer Malicious Library UPX PE File OS Processor Check PE32 DLL VirusTotal Malware powershell AutoRuns suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic RWX flags setting unpack itself Auto service powershell.exe wrote Check virtual network interfaces suspicious process sandbox evasion WriteConsoleW Interception Windows ComputerName DNS Cryptographic key 		3 15 16.8 17 ZeroCERT

35451 2022-01-20 09:31 905347967268907.xls  

5be91dbfe71e171c5e33cf97f6e9d018


Generic Malware Antivirus Malicious Packer Malicious Library UPX MSOffice File PE File OS Processor Check PE32 DLL Malware powershell AutoRuns suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic RWX flags setting unpack itself Auto service powershell.exe wrote Check virtual network interfaces suspicious process sandbox evasion WriteConsoleW Interception Windows ComputerName DNS Cryptographic key 		8 30 4 17.0 ZeroCERT

35452 2022-01-20 09:30 RMT18122.vbs  

790d4e4139b05312a0c85ced4466ec02


AgentTesla Gen2 browser info stealer Generic Malware Google Chrome User Data Antivirus Malicious Packer Malicious Library Create Service Socket DNS Code injection Sniff Audio KeyLogger Escalate priviledges Downloader AntiDebug AntiVM PE File PE32 DLL VirusTotal Malware VBScript powershell suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI heapspray wscript.exe payload download Creates shortcut Creates executable files ICMP traffic unpack itself Check virtual network interfaces suspicious process AppData folder WriteConsoleW Windows ComputerName DNS Cryptographic key keylogger Dropper 		1 5 10.0 M 6 ZeroCERT

35453 2022-01-20 09:19 8775220308147463.xls  

76c11124bf3b762351093c424880a516


Generic Malware Antivirus Malicious Packer Malicious Library UPX MSOffice File PE File OS Processor Check PE32 DLL Malware powershell AutoRuns suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic RWX flags setting unpack itself Auto service powershell.exe wrote Check virtual network interfaces suspicious process suspicious TLD sandbox evasion WriteConsoleW Interception Windows ComputerName DNS Cryptographic key 		4 30 17.4 ZeroCERT

35454 2022-01-20 09:18 MFUM-455871.xlsm  

25fde11ef3cfb28d66468b42923961cb


Generic Malware Antivirus Malicious Packer Malicious Library UPX PE File OS Processor Check PE32 DLL VirusTotal Malware powershell AutoRuns suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic RWX flags setting unpack itself Auto service powershell.exe wrote Check virtual network interfaces suspicious process AntiVM_Disk sandbox evasion WriteConsoleW VM Disk Size Check Interception Windows ComputerName DNS Cryptographic key keylogger 		2 15 2 17.8 M 17 ZeroCERT

35455 2022-01-20 09:18 905347967268907.xls  

5be91dbfe71e171c5e33cf97f6e9d018


KeyLogger ScreenShot AntiDebug AntiVM MSOffice File Code Injection unpack itself 		2.0 ZeroCERT

35456 2022-01-20 08:09 http://192.210.214.174/PmtAdv/...  

790d4e4139b05312a0c85ced4466ec02


Create Service DGA Socket DNS Internet API Hijack Network Code injection Sniff Audio HTTP KeyLogger FTP Escalate priviledges Downloader ScreenShot P2P persistence Steal credential Http API AntiDebug AntiVM MSOffice File VirusTotal Malware Code Injection Malicious Traffic Creates executable files RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Windows Exploit DNS crashed 		1 1 6.0 M 6 ZeroCERT

35457 2022-01-20 07:54 AxVZTvof0xPasb9nP  

81e77ccebc0c638812cd75368710b856


Malicious Packer Malicious Library UPX PE File OS Processor Check PE32 DLL VirusTotal Malware Checks debugger ICMP traffic RWX flags setting unpack itself sandbox evasion ComputerName DNS 		13 6.6 21 ZeroCERT

35458 2022-01-19 18:20 pngebanoe.hta.html  

72f2b5e794eb3c55b38720bbaadb3385

VirusTotal Malware unpack itself crashed 		1.0 1 ZeroCERT

35459 2022-01-19 18:04 pngebanoe.hta  

72f2b5e794eb3c55b38720bbaadb3385

unpack itself crashed 		0.6 ZeroCERT

35460 2022-01-19 18:01 054051873-734596.xlsm  

88c58c8bcec46e2ea81ba586254e8098


Generic Malware Malicious Packer Malicious Library UPX Antivirus PE File OS Processor Check PE32 DLL VirusTotal Malware powershell AutoRuns suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic RWX flags setting unpack itself Auto service powershell.exe wrote Check virtual network interfaces suspicious process sandbox evasion WriteConsoleW Interception Windows ComputerName DNS Cryptographic key 		2 16 2 17.4 M 15 ZeroCERT

keyword