Submissions

Date range button:

First seen:

Last seen:

No	Date	Request	Urls	Hosts	IDS	Rule	Score	Zero	VT	Player
44266	2024-05-13 09:04	swizzhis.exe 808c0214e53b576530ee5b4592793bb0 Generic Malware Malicious Library UPX PE File PE32 OS Processor Check VirusTotal Malware PDB unpack itself crashed					2.8	M	41	ZeroCERT

44267	2024-05-13 09:06	go.exe dc540b21dd7ea520b4390010baee443f Generic Malware Malicious Library UPX AntiDebug AntiVM PE File PE32 OS Processor Check MSOffice File VirusTotal Malware Code Injection Check memory Checks debugger buffers extracted RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed	8 Keyword trend analysis Info https://www.google.com/favicon.ico https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AaSxoQzQIIpBZjKNBi40fIhgM04aqMC10RSUh09-oqGjM9r6pC85eFFhK3TqfZOdE-A9GLwgnEJq0Q https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F https://accounts.google.com/_/bscframe https://accounts.google.com/ https://accounts.google.com/generate_204?UAPjyQ https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AaSxoQzQ7rgk_U7qtouG2IWzPuE-48A-cdZOogWaBVud6M8pbV9TDnaV-d3eSsBZ57WIbrdoC1W7&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-1744383557%3A1715558550050150 https://ssl.gstatic.com/images/branding/googlelogo/2x/googlelogo_color_74x24dp.png	6	1		5.8	M	17	ZeroCERT

44268	2024-05-13 09:07	alex.exe 31841361be1f3dc6c2ce7756b490bf0f Generic Malware Malicious Library UPX PE File PE32 OS Processor Check VirusTotal Malware PDB unpack itself DNS crashed		1			3.4	M	57	ZeroCERT

44269	2024-05-13 09:07	toolspub1.exe 6bcbbfac4eb7dbecb5a44983645a75db Generic Malware Malicious Library UPX PE File PE32 OS Processor Check VirusTotal Malware Remote Code Execution					2.2	M	44	ZeroCERT

44270	2024-05-13 09:09	leadiadequatepro.exe b149f82964b1e269ade2686612a9e777 Emotet Gen1 Hide_EXE Malicious Library UPX .NET framework(MSIL) PE64 PE File CAB OS Processor Check .NET EXE PE32 VirusTotal Malware AutoRuns PDB Check memory Checks debugger Creates executable files unpack itself AppData folder Windows ComputerName Remote Code Execution					5.0	M	44	ZeroCERT

44271	2024-05-13 09:11	install.exe 0f52e5e68fe33694d488bfe7a1a71529 Gen1 XMRig Miner Generic Malware Malicious Library UPX Malicious Packer PE File PE32 PE64 OS Processor Check VirusTotal Malware AutoRuns Check memory Checks debugger Creates executable files Windows utilities AppData folder AntiVM_Disk WriteConsoleW anti-virtualization VM Disk Size Check Windows DNS		1			6.6	M	48	ZeroCERT

44272	2024-05-13 09:12	amers.exe 802263fb14b84944b5d41a2abbb4cf55 Amadey RedLine stealer RedlineStealer Gen1 XMRig Miner Generic Malware NSIS Malicious Library .NET framework(MSIL) UPX Malicious Packer PE File PE32 .NET EXE OS Processor Check PE64 Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer VirusTotal Malware Microsoft AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Checks Bios Collect installed applications Detects VMWare Check virtual network interfaces suspicious process AppData folder AntiVM_Disk sandbox evasion WriteConsoleW VMware anti-virtualization VM Disk Size Check installed browsers check Kelihos Tofsee Stealer Windows Browser ComputerName DNS Cryptographic key Software crashed	8 Keyword trend analysis Info http://5.42.96.7/lend/redline1.exe http://5.42.96.7/lend/gold.exe http://185.172.128.19/ghsdh39s/index.php - rule_id: 38300 http://5.42.96.7/zamo7h/index.php https://junglethomas.com/f454baf35775ab21c0861c7e58faa26f/4767d2e713f2021e8fe856e3ea638b58.exe https://bitbucket.org/qwizzi/tt522222/downloads/FlexPremises.exe https://bbuseruploads.s3.amazonaws.com/c238a61a-be46-44a2-84f2-dcbe608a006a/downloads/0c322e92-7ded-485f-8f7e-dcd768dac239/FlexPremises.exe?response-content-disposition=attachment%3B%20filename%3D%22FlexPremises.exe%22&AWSAccessKeyId=ASIA6KOSE3BNMHJ2S2IF&Signature=Pf8uvTsdDXDYpTVnqRU4pbZjxtQ%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEAAaCXVzLWVhc3QtMSJGMEQCIBGUMCTkw8d%2FRQ90rHKxrdBD55Jzp2RUCZ6M%2FgBuZjJtAiBNE956ePSnNUvNowkPys7yxrq3vwJLl37wJOoxjrNVkCqnAghpEAAaDDk4NDUyNTEwMTE0NiIM5YIhZ3rDdQdifF1dKoQC8QVdaNK%2Fpp28r49Lhu%2Fo6HsVBx4yPzhGSc%2B%2BCzA11oIqWUUgqFSrTf2Q8fN6tGrTc33%2Fwx8B6zAKi%2Fmzp5%2Bykv4yPQnI3tgJSss5RTEkBuGXzrbFgQLCcuYP0nNlVeFlC4GBJtviUaRQBTigFG6vB04oh49AlPxZRg5lK5qR6GM6KyN%2BhinlMKKEDzAZW1b1yVQzEeuTw%2FvwF7qZ%2FAs3WIVONJA804wqYsCE5gWyJyXuc9zmxRVX%2FmQA5HQTy9xZ4f9iBjCutyMR8c3QX%2BkjVMi%2B54wlr7YKqphja3okxM3YY4uIhRJ5szfQVKXWSPdVyOU8oq%2Fdbz2i4XrOSiTrftNn0R8wm7CFsgY6ngHJNUt8kiGO1%2BLh5VCo2FcLxOIYQWMu0WfaSBLmRqNt3hQuAzhhjgStuSeR5Y%2BPVi1FWh%2BiaEfr7PF%2BV5%2B1L2%2FXMh45E0xw1zCApxF9GLOeHr0jXzWmv7rSi7dcYtjN%2BrjDF4xhoa329mtQhvlYAincF45Hx51z5sdhnMJ0HZQCnWvpY4wlNvyfSzu9ENrfAXD%2FBAZmRYWIH%2BRM%2BuuPMA%3D%3D&Expires=1715560227 https://parrotflight.com/4767d2e713f2021e8fe856e3ea638b58.exe	16 Info file-file-host6.com(176.113.82.90) - malware junglethomas.com(104.21.92.190) bbuseruploads.s3.amazonaws.com(52.217.227.41) - malware bitbucket.org(104.192.141.1) - malware parrotflight.com(172.67.187.204) 172.67.197.33 77.221.151.47 - malware 176.113.82.90 - malware 172.67.187.204 - mailcious 52.217.83.36 5.42.96.7 - malware 5.42.96.78 - mailcious 104.192.141.1 - mailcious 185.172.128.19 - mailcious 185.172.128.59 - malware 185.215.113.67 - mailcious	15 Info ET DROP Spamhaus DROP Listed Traffic Inbound group 1 ET INFO Executable Download from dotted-quad Host ET POLICY PE EXE or DLL Windows file download HTTP ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response ET MALWARE Possible Kelihos.F EXE Download Common Structure ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 ET DROP Spamhaus DROP Listed Traffic Inbound group 32 ET INFO Microsoft net.tcp Connection Initialization Activity ET MALWARE Redline Stealer TCP CnC Activity ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) ET MALWARE Redline Stealer TCP CnC - Id1Response ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)	1	20.2	M	32	ZeroCERT

44273	2024-05-13 09:27	Scanner.exe 9de1ede890852d25d1a9a37561c85881 Generic Malware Malicious Library UPX PE File PE32 OS Processor Check VirusTotal Malware PDB unpack itself crashed					2.8	M	51	ZeroCERT

44274	2024-05-13 10:53	[Content_Types].xml ded1b06d92c5c6b15c0b12c176ff3355 AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities Windows Exploit DNS crashed					3.8			guest

44275	2024-05-13 10:54	[Content_Types].xml ded1b06d92c5c6b15c0b12c176ff3355 Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed			2		4.2			guest

44276	2024-05-13 10:54	.rels 77bf61733a633ea617a4db76ef769a4d Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed			2		4.8			guest

44277	2024-05-13 10:55	.rels 77bf61733a633ea617a4db76ef769a4d AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities Windows Exploit DNS crashed					3.8			guest

44278	2024-05-13 10:56	[Content_Types].xml ded1b06d92c5c6b15c0b12c176ff3355 Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed			2		4.2			guest

44279	2024-05-13 10:56	.rels 77bf61733a633ea617a4db76ef769a4d Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed			2		4.8			guest

44280	2024-05-14 08:10	msgbox.exe 69592b2d2f12c492e954ff8943b7900a UPX PE64 PE File OS Processor Check VirusTotal Malware PDB					0.6	M	4	ZeroCERT