Submissions

Date range button:

First seen:

Last seen:

No	Date	Request	Urls	Hosts	IDS	Rule	Score	Zero	VT	Player
45661	2021-04-28 17:39	IvGRnMiDzgderQQteqNjNgKoIYqaLW... e301bc81ee1ef7a1bd3549865719d839 RTF File doc buffers extracted exploit crash unpack itself Exploit crashed	3 Keyword trend analysis	2			2.6			ZeroCERT

45662	2021-04-28 17:38	svch.dot ec2c1840d5ed24b0e0a3316661e5549d AntiDebug AntiVM LokiBot Malware download VirusTotal Malware c&c MachineGuid Malicious Traffic Check memory exploit crash unpack itself Windows Exploit Trojan DNS crashed	2 Keyword trend analysis	3	15 Info ET INFO Executable Download from dotted-quad Host ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 ET INFO DNS Query for Suspicious .ga Domain ET MALWARE Trojan Generic - POST To gate.php with no referer ET MALWARE LokiBot User-Agent (Charon/Inferno) ET MALWARE LokiBot Checkin ET INFO HTTP POST Request to Suspicious *.ga Domain ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 ET POLICY PE EXE or DLL Windows file download HTTP ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response ET MALWARE LokiBot Request for C2 Commands Detected M1 ET MALWARE LokiBot Request for C2 Commands Detected M2 ET MALWARE LokiBot Fake 404 Response	1	5.2	M	27	ZeroCERT

45663	2021-04-28 17:36	svch.exe 372f96b73c0ff71825a027aca714dc7b PWS Loki .NET framework AsyncRAT backdoor Malicious Library DNS Socket AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Windows Browser Email ComputerName Trojan DNS Cryptographic key Software	1 Keyword trend analysis	2	10 Info ET INFO DNS Query for Suspicious .ga Domain ET MALWARE Trojan Generic - POST To gate.php with no referer ET MALWARE LokiBot User-Agent (Charon/Inferno) ET MALWARE LokiBot Checkin ET INFO HTTP POST Request to Suspicious *.ga Domain ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 ET MALWARE LokiBot Request for C2 Commands Detected M1 ET MALWARE LokiBot Request for C2 Commands Detected M2 ET MALWARE LokiBot Fake 404 Response	1	12.6	M	12	ZeroCERT

45664	2021-04-28 17:36	file.exe e716d52efd4cfaa34624d374ca37b65b PE File PE32 OS Processor Check VirusTotal Malware unpack itself DNS					3.2	M	41	ZeroCERT

45665	2021-04-28 17:34	ccc.dot 5ea4015206a069481356dfda12eb2cb9 AntiDebug AntiVM Malware download VirusTotal Malware MachineGuid Malicious Traffic Check memory exploit crash unpack itself Windows Exploit DNS crashed Downloader	1 Keyword trend analysis	1	6 Info ET INFO Executable Download from dotted-quad Host ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 ET POLICY PE EXE or DLL Windows file download HTTP ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response		5.4	M	27	ZeroCERT

45666	2021-04-28 17:33	cred.dll f195dbf9f3449a5434edf834e43b0ff6 PWS Loki PE File PE32 DLL FTP Client Info Stealer ENERGETIC BEAR VirusTotal Email Client Info Stealer Malware Malicious Traffic Check memory Checks debugger unpack itself Email DNS Software	1 Keyword trend analysis	1	1		5.8	M	50	ZeroCERT

45667	2021-04-28 17:21	mazx.exe 342d651660cf2b0587d25f343aff786f AsyncRAT backdoor SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces suspicious process WriteConsoleW Windows Browser Email ComputerName DNS Cryptographic key Software crashed keylogger	2 Keyword trend analysis Info http://ldvamlwhdpetnyn.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-4C040980FB238F42747D4200E39E5134.html - rule_id: 1176 http://ldvamlwhdpetnyn.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-E6414DF053ECE16DD340D40A0368921A.html - rule_id: 1176	2	1	2	14.6	M	33	조광섭

45668	2021-04-28 17:11	uDUxwumDrV.dll ee03a7aafeaa2e4b937066e5efe8016f PE File DLL OS Processor Check PE64 VirusTotal Malware Checks debugger crashed					2.0		31	조광섭

45669	2021-04-28 17:05	uDUxwumDrV.dll ee03a7aafeaa2e4b937066e5efe8016f PE File DLL OS Processor Check PE64 VirusTotal Malware Checks debugger crashed					2.0		31	조광섭

45670	2021-04-28 16:17	uDUxwumDrV.dll ee03a7aafeaa2e4b937066e5efe8016f PE File DLL OS Processor Check PE64 VirusTotal Malware Checks debugger DNS crashed					2.6		31	조광섭

45671	2021-04-28 16:17	uDUxwumDrV.dll ee03a7aafeaa2e4b937066e5efe8016f PE File DLL OS Processor Check PE64 VirusTotal Malware Checks debugger crashed					2.0		31	조광섭

45672	2021-04-28 16:12	uDUxwumDrV.dll ee03a7aafeaa2e4b937066e5efe8016f PE File DLL OS Processor Check PE64 VirusTotal Malware Checks debugger crashed					2.0		31	조광섭

45673	2021-04-28 16:12	uDUxwumDrV.dll ee03a7aafeaa2e4b937066e5efe8016f PE File DLL OS Processor Check PE64 VirusTotal Malware Check memory crashed					2.0		31	조광섭

45674	2021-04-28 16:11	uDUxwumDrV.dll ee03a7aafeaa2e4b937066e5efe8016f PE File DLL OS Processor Check PE64 VirusTotal Malware Checks debugger DNS crashed	2 Keyword trend analysis				2.6		31	조광섭

45675	2021-04-28 16:11	uDUxwumDrV.dll ee03a7aafeaa2e4b937066e5efe8016f PE File DLL OS Processor Check PE64 VirusTotal Malware Checks debugger crashed					2.0		31	조광섭