popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
39931 2021-10-29 18:20 PE.txt.ps1  

964c031b3cca7673f0af28adf461f2b3


PowerShell MZ Generic Malware Antivirus VirusTotal Malware Check memory unpack itself WriteConsoleW Windows Cryptographic key 		1.6 17 ZeroCERT

39932 2021-10-29 18:11 .csrss.exe  

c2c509a61a1d811d29ade6067e54c011


PWS Loki[b] Loki.m RAT Generic Malware UPX Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName Software 		1 2 7 14.4 14 ZeroCERT

39933 2021-10-29 18:02 vbc.exe  

8980a24aeb5d63283add48c1391ebc40


Malicious Library UPX PE File PE32 FormBook Emotet Malware download VirusTotal Malware Buffer PE AutoRuns Code Injection Malicious Traffic buffers extracted Creates executable files RWX flags setting unpack itself Tofsee Windows DNS crashed 		15 26 4 2 8.0 6 ZeroCERT

39934 2021-10-29 18:00 awsa.exe  

d23ca1a68c0067ad0bd32dda2109c7db


PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		4 8 1 9.2 18 ZeroCERT

39935 2021-10-29 17:55 awsa.exe  

d23ca1a68c0067ad0bd32dda2109c7db


PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted ICMP traffic unpack itself 		2 7.8 18 ZeroCERT

39936 2021-10-29 17:50 .csrss.exe  

c2c509a61a1d811d29ade6067e54c011


PWS Loki[b] Loki.m RAT Generic Malware UPX Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName Software 		1 1 12.2 14 ZeroCERT

39937 2021-10-29 16:53 23410028317313.exe  

f6b2bced4580a167eae96eb2c8501670


RAT Generic Malware UPX SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows ComputerName crashed 		9.8 20 guest

39938 2021-10-29 16:40 23410028317313.tgz  

00ec9a97b93697a509ef1123e0b5704c

VirusTotal Malware 		0.6 11 guest

39939 2021-10-29 15:03 temp.dll  

cd3e23cddeb92b7397eaf960da34c237


TA551 BazarLoader PE64 PE File DLL VirusTotal Malware Check memory ICMP traffic unpack itself Windows utilities WriteConsoleW Windows 		3.4 14 r0d

39940 2021-10-29 14:16 pop-up_excel_calendar_setup.ex...  

aa1966419284a4a503c101bd7db7a2a0


RAT PWS .NET framework Gen1 Generic Malware Malicious Library UPX Malicious Packer Admin Tool (Sysinternals etc ...) PE File OS Processor Check PE32 .NET EXE PE64 DLL GIF Format VirusTotal Malware MachineGuid Check memory Checks debugger Creates shortcut Creates executable files unpack itself suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check human activity check installed browsers check Browser ComputerName 		7.0 3 guest

39941 2021-10-29 11:06 stash-266976238.xls  

9c6aa1a04e32f40f6f0c0206a5f9a0b1


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		3 6 4 3.6 guest

39942 2021-10-29 11:04 stash-266322727.xls  

6ad4c6c9e7f2a68596dc2c7cc7af10a8


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		3 6 4 3.6 guest

39943 2021-10-29 10:50 hta.hta  

d12cde9ca145f75251c08af9cef0b7f3


NPKI AntiDebug AntiVM MSOffice File VirusTotal Malware Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		2 4.2 1 ZeroCERT

39944 2021-10-29 10:10 hta.hta  

d12cde9ca145f75251c08af9cef0b7f3


NPKI AntiDebug AntiVM MSOffice File VirusTotal Malware Code Injection RWX flags setting exploit crash unpack itself Windows utilities Windows Exploit DNS crashed 		4.2 1 ZeroCERT

39945 2021-10-29 10:08 temp.dll  

1788ff60c96f28ec0386a838edaa48fb


Malicious Library UPX PE64 PE File OS Processor Check DLL VirusTotal Malware unpack itself 		1.0 2 ZeroCERT

keyword