popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
35536 2022-01-19 09:34 12999000002490152554.xls  

0c890caa5574298838e2463f2a9eec1f


Generic Malware Antivirus Malicious Packer Malicious Library UPX MSOffice File PE File OS Processor Check PE32 DLL VirusTotal Malware powershell AutoRuns suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic RWX flags setting unpack itself Auto service powershell.exe wrote Check virtual network interfaces suspicious process AntiVM_Disk sandbox evasion WriteConsoleW VM Disk Size Check Interception Windows ComputerName DNS Cryptographic key 		5 38 16.6 9 ZeroCERT

35537 2022-01-19 09:33 YOCJA-19842.xlsm  

e7fa5369947b139f8f5d636791b236b8


Generic Malware Malicious Packer Malicious Library UPX Antivirus PE File OS Processor Check PE32 DLL Malware powershell AutoRuns suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic RWX flags setting unpack itself Auto service powershell.exe wrote Check virtual network interfaces suspicious process sandbox evasion WriteConsoleW Interception Windows ComputerName DNS Cryptographic key 		3 16 17.4 ZeroCERT

35538 2022-01-18 18:29 yyyy.exe  

5e22f82de536045419032c6f7d8a366b


NSIS Malicious Library UPX PE File PE32 OS Processor Check DLL VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder 		15 30 6.4 20 ZeroCERT

35539 2022-01-18 16:47 invoice.exe  

9fca8332a98b2475b8c5243f70ce5058


Darkside Ransomware Cobalt Strike Malicious Library UPX PE File PE32 VirusTotal Malware PDB unpack itself RCE 		2.8 M 30 ZeroCERT

35540 2022-01-18 16:46 8879_1642270780_4802.exe  

236b3dc043d26a121949e4d5cfb13d1d


RedLine stealer[m] Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Malware Buffer PE suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Collect installed applications Check virtual network interfaces installed browsers check Windows Browser ComputerName Cryptographic key Software crashed 		2 6 12.4 M 29 ZeroCERT

35541 2022-01-18 16:45 645_1642427720_7114.exe  

80ea5601dfddd352cad47e20c2e77f86


Malicious Library UPX PE File PE32 VirusTotal Malware PDB unpack itself RCE 		2.8 M 31 ZeroCERT

35542 2022-01-18 16:43 Updated_Payments_Statements.li...  

8bdf50e9270b6f6e3c461be75999305d


Darkside Ransomware Cobalt Strike Generic Malware Antivirus Malicious Library UPX AntiDebug AntiVM GIF Format PE File PE32 OS Processor Check VirusTotal Malware powershell suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted heapspray Creates shortcut Creates executable files unpack itself powershell.exe wrote Check virtual network interfaces suspicious process AppData folder WriteConsoleW Interception Windows ComputerName DNS Cryptographic key 		1 13.6 M 9 ZeroCERT

35543 2022-01-18 16:43 payment.exe  

fae3f90c433730f1920f947057a90bde


Malicious Library UPX PE File OS Processor Check PE32 PDB unpack itself 		1.0 M ZeroCERT

35544 2022-01-18 16:43 9.exe  

e5b9c0f6e09af4b902ea432a0ccf55e5


UPX PE File PE32 .NET EXE VirusTotal Malware Check memory Checks debugger RWX flags setting unpack itself sandbox evasion Windows ComputerName RCE DNS Cryptographic key crashed 		1 8.0 M 29 ZeroCERT

35545 2022-01-18 15:46 invoice.hta  

c56e30a3b967a477d4bc2cf74a3e5a52

unpack itself crashed 		0.6 ZeroCERT

35546 2022-01-18 15:36 8888_1642260354_4389.exe  

7b1fb663b7c0fd28682a0ee052cb9827


Generic Malware PE64 PE File VirusTotal Malware 		2 1.4 M 35 ZeroCERT

35547 2022-01-18 15:35 EYe3DEfcw7LCaU6T  

f977d2d82e01d8c453495502ef834d98


Malicious Packer Malicious Library UPX PE File OS Processor Check PE32 DLL VirusTotal Malware Checks debugger ICMP traffic RWX flags setting unpack itself sandbox evasion ComputerName DNS 		13 6.4 M 10 ZeroCERT

35548 2022-01-18 14:06 Athens.dll  

61295ca80fbecf05b60915d8f6ce8c31


VMProtect Malicious Library PE64 PE File DLL VirusTotal Malware 		1.6 11 ZeroCERT

35549 2022-01-18 14:06 Athens.dll  

61295ca80fbecf05b60915d8f6ce8c31


VMProtect Malicious Library PE64 PE File DLL VirusTotal Malware 		1.6 11 ZeroCERT

35550 2022-01-18 13:33 Athens.dll  

61295ca80fbecf05b60915d8f6ce8c31


VMProtect Malicious Library PE64 PE File DLL VirusTotal Malware 		1.6 11 JYC

keyword