Submissions

Date range button:

First seen:

Last seen:

No	Date	Request	Urls	Hosts	IDS	Rule	Score	Zero	VT	Player
46261	2024-07-24 09:14	simpleweightcreatednicething.g... bc2278089ce81da106bd59335fa9e998 Generic Malware Antivirus PowerShell Malware download VirusTotal Malware VBScript powershell suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted wscript.exe payload download Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName DNS Cryptographic key Dropper	2 Keyword trend analysis	3	5 Info ET INFO Pastebin-like Service Domain in DNS Lookup (pastecode .dev) ET MALWARE Base64 Encoded MZ In Image ET INFO Observed Pastebin-like Service Domain (pastecode .dev) in TLS SNI SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET MALWARE Malicious Base64 Encoded Payload In Image	2	10.0	M	7	ZeroCERT

46262	2024-07-24 09:14	pw.ps1 2ffeb8859aa9c7142ed094588a5442b8 Lnk Format GIF Format VirusTotal Malware powershell AutoRuns Malicious Traffic Check memory WMI Creates shortcut Creates executable files unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces WriteConsoleW Tofsee Windows ComputerName DNS Cryptographic key	1 Keyword trend analysis	3	1		9.0	M	19	ZeroCERT

46263	2024-07-24 09:15	wegivemebackwithentiresituatio... 45b6040d50bff71bd32e8d7a0bc56bd4 MS_RTF_Obfuscation_Objects RTF File doc Malware download VirusTotal Malware Telegram Malicious Traffic RWX flags setting exploit crash IP Check Tofsee Windows Exploit DNS DDNS crashed keylogger	3 Keyword trend analysis	7	14 Info ET HUNTING Telegram API Domain in DNS Lookup ET INFO TLS Handshake Failure ET POLICY External IP Lookup - checkip.dyndns.org ET INFO 404/Snake/Matiex Keylogger Style External IP Check ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) ET INFO Executable Download from dotted-quad Host SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI ET POLICY PE EXE or DLL Windows file download HTTP ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org) ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)		5.4	M	36	ZeroCERT

46264	2024-07-24 09:17	thissystemchangingentireproces... 485c8b0bbaec4e72949307d766a4bfba MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware VBScript Malicious Traffic RWX flags setting exploit crash Tofsee Exploit DNS crashed	2 Keyword trend analysis	6	4	1	4.6	M	37	ZeroCERT

46265	2024-07-24 09:20	Wasabi.msi 1cd72a4f59963a1fee86e0d98f47e17d Generic Malware Malicious Library Antivirus UPX Malicious Packer MSOffice File OS Processor Check PE File DLL PE32 VirusTotal Malware suspicious privilege Check memory Checks debugger unpack itself AppData folder AntiVM_Disk VM Disk Size Check ComputerName	1 Keyword trend analysis	2			3.0	M	9	ZeroCERT

46266	2024-07-24 09:24	DRWG-347RB1.pd.xls c433eae598bb293ae5c2f28ad9a61c3b MSOffice File VirusTotal Malware unpack itself Tofsee DNS	3 Keyword trend analysis	3	1		3.0		15	ZeroCERT

46267	2024-07-24 15:30	scan0001.doc e96e2ed88e2f2fb80d02e7cd99a1420d Doc XML Downloader Generic Malware Malicious Library UPX Word 2007 file format(docx) ZIP Format PE File DLL PE32 .NET DLL OS Processor Check RTF File doc VirusTotal Malware Microsoft buffers extracted Creates executable files unpack itself AppData folder Tofsee DNS	9 Keyword trend analysis Info http://office-updatecentral.com/armorer/opposing/stratifies/ http://office-updatecentral.com/armorer/opposing http://office-updatecentral.com/armorer/opposing/stratifies/beachheads/canto http://office-updatecentral.com/armorer/opposing/ http://office-updatecentral.com/armorer/opposing/stratifies/beachheads/ http://office-updatecentral.com/armorer/opposing/stratifies/beachheads/exacerbating http://office-updatecentral.com/armorer/opposing/stratifies/beachheads http://office-updatecentral.com/armorer/opposing/stratifies/beachheads/knolls http://office-updatecentral.com/armorer/opposing/stratifies	2	5		3.8		7	ZeroCERT

46268	2024-07-24 15:38	Purchase _Order_0000089.exe 9ce741958a80db120217ebad36bd9652 Malicious Library PE File PE64 VirusTotal Malware suspicious privilege MachineGuid Check memory Checks debugger unpack itself Windows Cryptographic key crashed					2.8		38	ZeroCERT

46269	2024-07-24 15:39	hersomethingnewhaveforwintoget... a819430cdd5da2c289f594ceac0f0035 MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware Malicious Traffic RWX flags setting exploit crash Exploit DNS crashed	1 Keyword trend analysis	1			4.6	M	36	ZeroCERT

46270	2024-07-24 15:41	wethkingwearereallyamazingtoge... 54092cf8f48bd4f9f31bdb16b2f6ee65 MS_RTF_Obfuscation_Objects RTF File doc Malware download VirusTotal Malware Malicious Traffic exploit crash unpack itself Windows Exploit DNS crashed	1 Keyword trend analysis	1	5 Info ET INFO Executable Download from dotted-quad Host ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 ET POLICY PE EXE or DLL Windows file download HTTP ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response		4.8	M	40	ZeroCERT

46271	2024-07-24 15:43	megreatwithyourlovertothinkabo... 29b3fc11ab9d647ec19d3e02364355b2 MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware Malicious Traffic exploit crash unpack itself Exploit DNS crashed	1 Keyword trend analysis	1	1		4.8	M	40	ZeroCERT

46272	2024-07-24 21:45	test.exe 0784da3d1a6ab997b2842fbf73b29688 Generic Malware Malicious Library UPX PE File PE64 OS Processor Check VirusTotal Malware Check memory					1.2		2	guest

46273	2024-07-25 08:51	winiti.exe a7d6f198863dada7ed361290544efc77 Malicious Library UPX PE File PE32 MZP Format VirusTotal Malware Checks debugger unpack itself Tofsee Interception crashed		2	1		3.4		45	ZeroCERT

46274	2024-07-25 08:51	csrss.exe f6bf8ada032d17192526ffebb48aed79 Client SW User Data Stealer Backdoor RemcosRAT browser info stealer Google Chrome User Data Downloader Malicious Library Malicious Packer Antivirus UPX Create Service Socket ScreenShot Escalate priviledges PWS Sniff Audio DNS Internet API KeyLogger AntiDe Remcos VirusTotal Malware Code Injection Check memory buffers extracted Remote Code Execution		3	1		7.2		50	ZeroCERT

46275	2024-07-25 08:54	Authenticator.exe 24c76871e844d80ed4b9622853ba3492 Malicious Library UPX PE File PE64 MZP Format OS Processor Check VirusTotal Malware unpack itself					1.8	M	26	ZeroCERT