popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
39976 2021-10-29 09:14 pub3.exe  

dc0d13a11537c91ee0436e1cdaaef2ed


Generic Malware Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself RCE 		2.2 30 ZeroCERT

39977 2021-10-29 09:13 maxi.exe  

1bcd242e21181da424e62eba71f13e1d


NSIS Malicious Library UPX PE File PE32 OS Processor Check DLL FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder 		3 7 1 5.8 23 ZeroCERT

39978 2021-10-29 09:13 crocin.exe  

db030d5044011041bfb6d1a919337459


Themida Packer PE64 PE File VirusTotal Malware unpack itself Windows crashed 		2.8 32 ZeroCERT

39979 2021-10-29 09:11 .csrss.exe  

0a7a0226b591a93d521911b140c0ba11


PWS Loki[b] Loki.m .NET framework Generic Malware Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName DNS Software 		1 1 6 1 14.2 M 20 ZeroCERT

39980 2021-10-29 09:10 Mfile.exe  

674fb73b1fd08e6778e47debcb1c3a6c


NSIS Malicious Library UPX PE File PE32 OS Processor Check DLL FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder 		3 6 1 5.8 20 ZeroCERT

39981 2021-10-29 09:08 .wininit.exe  

4f811d4d3659bf698a270ebea91dd3ed


Loki PWS Loki[b] Loki.m .NET framework Generic Malware Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName Software 		2 2 7 1 12.8 17 ZeroCERT

39982 2021-10-29 09:08 oit9ql.jpg  

0cfb719775ab7f2be4454602e6a51d90


Malicious Library UPX PE File OS Processor Check PE32 DLL VirusTotal Malware PDB unpack itself crashed 		1.4 15 ZeroCERT

39983 2021-10-29 09:06 c8u1msi.jpg  

2215b04e57387c4925aff75b65ce2fca


Malicious Library UPX PE File OS Processor Check PE32 DLL VirusTotal Malware PDB unpack itself crashed 		1.4 13 ZeroCERT

39984 2021-10-29 09:06 .lsass.exe  

f6741a7f14669cbb4dffc16029381a91


PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities Checks Bios Detects VirtualBox suspicious process AppData folder WriteConsoleW VMware anti-virtualization Windows ComputerName Cryptographic key Software crashed 		2 5 1 16.2 24 ZeroCERT

39985 2021-10-29 07:56 vbc.exe  

8341a43885eb6960bd658ba5a1c8b84d


Malicious Library UPX PE File PE32 Emotet VirusTotal Malware Buffer PE AutoRuns Code Injection buffers extracted Creates executable files RWX flags setting unpack itself Tofsee Windows DNS DDNS crashed 		3 9 2 11.0 24 ZeroCERT

39986 2021-10-29 07:43 InvoicePO102IndexLtdParamout.e...  

dc738e765ddc4e0a9663ca40239b7df9


RAT PWS .NET framework Generic Malware DNS AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself 		8.8 24 ZeroCERT

39987 2021-10-29 07:43 rundll32.exe  

ad0e9142963cac524f3474d8f9b90a4f


RAT PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		18 16 2 10 8.8 M 22 ZeroCERT

39988 2021-10-29 07:36 invc_0070032233.wbk  

cf62058e0e077981fa8535c0d47f12ea


RTF File doc Malware download VirusTotal Malware Malicious Traffic buffers extracted RWX flags setting exploit crash Tofsee Windows Exploit DNS DDNS crashed Downloader 		4 10 8 6.4 27 ZeroCERT

39989 2021-10-29 07:36 vbc.exe  

1b4af97e5bb29267e445511854e12b87


Loki PWS Loki[b] Loki.m .NET framework Generic Malware Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Browser Email ComputerName Software 		1 2 7 1 12.4 M 19 ZeroCERT

39990 2021-10-28 18:26 Payment_Receipt_ 1791.xls  

c2889891f65e5dec8038d662a03bb2a5


VBA_macro Generic Malware KeyLogger ScreenShot AntiDebug AntiVM MSOffice File VirusTotal Malware Code Injection unpack itself 		2.6 13 ZeroCERT

keyword