popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
39961 2021-10-29 09:38 ens.exe  

e38e18c6b8fc1f9abd0ed7ce9aa45fda


Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself RCE 		2.4 30 ZeroCERT

39962 2021-10-29 09:37 EgAXWEL.exe  

a21083e3799762685013f624ef688c60


Emotet NPKI Malicious Library UPX Anti_VM Create Service DGA Socket Steal credential DNS Internet API Hijack Network Code injection Sniff Audio HTTP KeyLogger FTP Escalate priviledges Downloader ScreenShot Http API P2P persistence AntiDebug AntiVM PE File Browser Info Stealer Malware download VirusTotal Malware Buffer PE AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Collect installed applications Check virtual network interfaces AppData folder malicious URLs AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check SectopRAT Windows Browser Backdoor ComputerName RCE DNS Cryptographic key crashed 		1 4 1 16.6 16 ZeroCERT

39963 2021-10-29 09:36 A540bo3mQDlYqpH30620D.exe  

781fb23a988efab21e4ab321aa932b09


RAT Generic Malware PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Check memory Checks debugger unpack itself ComputerName 		2.4 17 ZeroCERT

39964 2021-10-29 09:34 bin.exe  

cf7c842dfbf541a670dc5bc914516847


RAT Generic Malware UPX PE File PE32 .NET EXE VirusTotal Malware Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Tofsee Windows Cryptographic key 		1 2 1 3.2 12 ZeroCERT

39965 2021-10-29 09:34 pd.exe  

c7b844578dca69166f414ea0c28e0384


PWS .NET framework Generic Malware PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger unpack itself 		4.8 17 ZeroCERT

39966 2021-10-29 09:34 out.exe  

671eb2b7682de507f36f6d57ca812b1c


RAT Generic Malware UPX AntiDebug AntiVM PE File OS Processor Check PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted ICMP traffic unpack itself ComputerName 		18 20 1 10.8 40 ZeroCERT

39967 2021-10-29 09:32 kon.exe  

d013f086c852f0855b884b09d6273894


NSIS Malicious Library UPX PE File PE32 OS Processor Check DLL Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AutoRuns suspicious privilege Code Injection Check memory Checks debugger Creates executable files unpack itself AppData folder Windows Browser Email ComputerName Cryptographic key Software crashed keylogger 		9.8 23 ZeroCERT

39968 2021-10-29 09:31 ss.exe  

be4f9863a63917e9e55cf5350c617363


RAT Generic Malware UPX AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself ComputerName 		16 21 1 8.6 23 ZeroCERT

39969 2021-10-29 09:29 trze3v.tar  

8c6258bd9f567fed899aeb3f68aaa861


Malicious Library UPX PE File OS Processor Check PE32 DLL VirusTotal Malware PDB unpack itself crashed 		1.4 15 ZeroCERT

39970 2021-10-29 09:27 vbc.exe  

cb37241bc90fefcc0d61becffbe4d1ce


Loki NSIS Generic Malware Malicious Library UPX PE File PE32 OS Processor Check DLL Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName DNS Software 		1 2 10 1 10.4 M 29 ZeroCERT

39971 2021-10-29 09:27 ss.exe  

b2ae544b04a0936cd1ac3ca6783cf134


PWS Loki[b] Loki.m RAT .NET framework Generic Malware Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Browser Email ComputerName DNS Software 		1 3 7 13.8 42 ZeroCERT

39972 2021-10-29 09:24 pig.dll  

5adaaad9852f8358aeeb367f1cd26b76


Emotet Gen1 Malicious Packer Malicious Library UPX PE File OS Processor Check PE32 DLL Dridex TrickBot VirusTotal Malware Report suspicious privilege Malicious Traffic Checks debugger buffers extracted RWX flags setting unpack itself Check virtual network interfaces suspicious process Kovter ComputerName DNS crashed 		1 5 4 8.6 39 ZeroCERT

39973 2021-10-29 09:21 vbc.exe  

0c8a26b69495724a46d7299ed9a8dd69


RAT PWS .NET framework Generic Malware DNS SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW Windows ComputerName crashed 		11.2 16 ZeroCERT

39974 2021-10-29 09:19 vbc.exe  

1d03eee90db5e3881e7111490bd0d76d


PWS Loki[b] Loki.m .NET framework Generic Malware Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Browser Email ComputerName Software 		1 2 7 12.4 16 ZeroCERT

39975 2021-10-29 09:17 dllhost.exe  

fdebcac35105439faeecb9658e617a8c


PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		1 3 1 8.0 21 ZeroCERT

keyword