popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
40531 2021-10-16 13:33 .wininit.exe  

b007ee7994afb90b45e3fb23d0acc313


PWS .NET framework Generic Malware PE File PE32 .NET EXE VirusTotal Malware PDB suspicious privilege Code Injection Check memory Checks debugger unpack itself 		5.4 M 38 ZeroCERT

40532 2021-10-16 13:32 zool.exe  

87cd2ddf31c62ed3219d2c559d4a9cb6


PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		9 17 1 8 8.4 M 41 ZeroCERT

40533 2021-10-16 13:29 vbc.exe  

7ca5a6d622c55365fda10c9e9ba8ee88


NSIS Malicious Library UPX PE File PE32 DLL FormBook Malware download VirusTotal Malware Phishing suspicious privilege Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder 		24 24 3 14 7.2 M 23 ZeroCERT

40534 2021-10-16 13:29 vbc.exe  

cc92dedec89f09b08729784048f1060b


Admin Tool (Sysinternals etc ...) Malicious Library UPX PE File PE32 VirusTotal Malware RWX flags setting unpack itself Tofsee crashed 		1 2 1 2.8 M 34 ZeroCERT

40535 2021-10-16 13:26 file.exe  

c200e4d07007a35710e92d7dfceb0324


Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself 		1.8 M 28 ZeroCERT

40536 2021-10-16 13:26 Oxqfxohrjqryauuonybvsdergonzry...  

a8521386eacf0f858077249faa381763


Malicious Library UPX Create Service DGA Socket Steal credential DNS Internet API Code injection Sniff Audio HTTP KeyLogger FTP Escalate priviledges Downloader ScreenShot Http API P2P AntiDebug AntiVM PE File PE32 Emotet VirusTotal Malware AutoRuns Code Injection buffers extracted Creates executable files RWX flags setting unpack itself Windows utilities suspicious process WriteConsoleW Tofsee Windows ComputerName crashed 		3 4 1 9.2 M 22 ZeroCERT

40537 2021-10-16 13:24 chrome.exe  

a6654b9757e5cecbd124a6d157c11ec0


RAT PWS .NET framework Generic Malware PE File PE32 .NET EXE VirusTotal Malware Checks debugger buffers extracted unpack itself Tofsee 		1 4 1 2.2 M 22 ZeroCERT

40538 2021-10-16 13:22 kv3.dll  

5c76498485ac6534b1b1aa0d6d543762


Generic Malware Malicious Library UPX PE File PE32 DLL VirusTotal Malware 		1.8 M 46 ZeroCERT

40539 2021-10-16 13:22 ole.exe  

53e0ffb4bae3b44092706ccb01cf99f5


NSIS Malicious Library UPX PE File PE32 DLL Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName DNS Software 		1 1 6 11.2 M 34 ZeroCERT

40540 2021-10-16 13:22 .lsass.exe  

f1d94fcc611053cd5162e70dc36fddfa


RAT PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) UPX PE File PE32 .NET EXE VirusTotal Malware Check memory Checks debugger unpack itself crashed 		2.4 M 38 ZeroCERT

40541 2021-10-16 13:22 rundll32.exe  

09c8e4c071be047a8e47bc7da2144a86


PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		16 19 3 4 8.4 M 17 ZeroCERT

40542 2021-10-16 13:20 csrss.exe  

b2fdec3c92a41a4e140b334184ef4e30


Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself 		2.2 M 47 ZeroCERT

40543 2021-10-16 13:12 TRAN31.exe  

c53015e5e1f2f0fd85f21e00b65f80e2


RAT PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) Anti_VM Malicious Library SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows ComputerName Cryptographic key crashed 		8.4 ZeroCERT

40544 2021-10-16 13:11 clipe.exe  

2c55be40df541743683b7be0cdcd31bc


RAT PWS .NET framework Generic Malware Antivirus AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware powershell suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		11.2 23 ZeroCERT

40545 2021-10-16 13:10 trend-1805140215.xls  

0c9961a5d8c7ee6bda37f75d1a59e8d9


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		3 6 2 4.0 guest

keyword