popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
45286 2024-06-14 07:41 setup%E4%B8%8B%E8%BD%BD%E5%90%...  

13f784b718e0d45057b628f504a11235


UPX PE64 PE File DNS 		1 1 2.4 ZeroCERT

45287 2024-06-14 07:43 setup%E4%B8%8B%E8%BD%BD%E5%90%...  

fecba5d90715f5235477b67cc514855b


Generic Malware Malicious Library PE64 PE File DNS 		1 1 2.0 ZeroCERT

45288 2024-06-14 07:44 realtekaft.exe  

20878a60ab358f3ce3f3f15245ff85ee


Hide_EXE Malicious Library .NET framework(MSIL) Socket Http API HTTP DNS Internet API Anti_VM AntiDebug AntiVM .NET EXE PE32 PE File Buffer PE AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows Cryptographic key crashed 		8.2 M ZeroCERT

45289 2024-06-14 07:45 luma22222.exe  

f4d57589a7db46677d1ced8f8123feda


PE32 PE File 		0.4 M ZeroCERT

45290 2024-06-14 07:46 motruhjgmawes.exe  

57a6a83482ce2897e8cdec17accbd662


Generic Malware Downloader Malicious Library UPX VMProtect Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM PE64 PE File OS Processo PDB Code Injection Creates executable files RWX flags setting unpack itself AppData folder Remote Code Execution 		4.4 M ZeroCERT

45291 2024-06-14 07:47 qgtplfgy2.exe  

3d033b03106e5b46abde0df781c164d5


Process Kill Generic Malware Suspicious_Script_Bin Malicious Library FindFirstVolume CryptGenKey UPX Device_File_Check PE32 PE File OS Processor Check Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer suspicious privilege Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Tofsee Windows Browser Email ComputerName Software crashed 		2 2 7.4 M ZeroCERT

45292 2024-06-14 07:49 setup%E4%B8%8B%E8%BD%BD%E5%90%...  

4dc6a0aa29fc47b343521af82014af0f


Malicious Library PE64 PE File DNS crashed 		1 1 2.2 M ZeroCERT

45293 2024-06-14 07:51 lummac2.exe  

6e3d83935c7a0810f75dfa9badc3f199


PE32 PE File 		0.4 M ZeroCERT

45294 2024-06-14 09:17 setup%E7%9B%AE%E5%BD%95%E8%A1%...  

7fbc6a95fc41c5bb0fecdd659d641ae9


Malicious Library PE64 PE File VirusTotal Malware DNS 		1 1 2.4 6 ZeroCERT

45295 2024-06-14 09:20 setup%E7%9B%AE%E5%BD%95%E8%A1%...  

b8cc81e57efd30cab09d0256f79f7098


Malicious Library PE64 PE File VirusTotal Malware DNS 		1 1 2.6 16 ZeroCERT

45296 2024-06-14 09:20 bin2.doc  

118072abaca518e6ece93908a9fee1f4


MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware RWX flags setting exploit crash suspicious TLD Tofsee Exploit DNS crashed 		17 16 3 4.4 M 33 ZeroCERT

45297 2024-06-14 09:22 bin1.doc  

ab6398c625d0ae23c0582ad07d044581


MS_RTF_Obfuscation_Objects RTF File doc Cobalt Strike Cobalt VirusTotal Malware c&c RWX flags setting exploit crash Tofsee Exploit DNS crashed 		19 4 3.2 M 32 ZeroCERT

45298 2024-06-14 09:24 sharo.scr  

3935f15dafdd5edfca70895940dce681


Formbook Generic Malware Malicious Library .NET framework(MSIL) UPX AntiDebug AntiVM .NET EXE PE32 PE File DLL Browser Info Stealer VirusTotal Malware Buffer PE Code Injection Check memory Checks debugger buffers extracted Creates executable files ICMP traffic unpack itself AppData folder malicious URLs Browser 		15 1 12 12.6 M 42 ZeroCERT

45299 2024-06-14 09:24 sharo.doc  

8b049d5e850fc75c1cef5edb8fc68feb


Formbook MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware exploit crash unpack itself suspicious TLD Tofsee Exploit DNS crashed 		21 7 12 3.6 M 33 ZeroCERT

45300 2024-06-14 09:25 OfferedBuilt.exe  

00614852dbe5c98d84c4501702d04e93


NSIS Generic Malware Downloader Malicious Library UPX Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM PE suspicious privilege Code Injection Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities suspicious process AppData folder malicious URLs sandbox evasion WriteConsoleW Windows ComputerName 		6.4 M ZeroCERT

keyword