popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
47056 2024-08-12 09:47 66b331646d2cd_123p.exe  

27b14ad026da76c1111174c6b4ba6aba


PE File PE64 VirusTotal Cryptocurrency Miner Malware DNS CoinMiner 		2 1 1.8 M 52 ZeroCERT

47057 2024-08-12 09:47 66b4af430a0a1_files.exe  

f3d8c82810e55bc012bdeb2557ff13b9


Malicious Library UPX AntiDebug AntiVM PE File .NET EXE PE32 OS Processor Check VirusTotal Malware Buffer PE PDB Code Injection Check memory Checks debugger buffers extracted unpack itself Remote Code Execution DNS 		1 9.6 M 55 ZeroCERT

47058 2024-08-12 09:48 Blogger-http2.vbs  

b71d3da9f944c2bce3e6c16867607841

VirusTotal Malware unpack itself crashed 		1.4 29 ZeroCERT

47059 2024-08-12 09:49 sesc16.bat  

4b7ebe87da068d04f5d0b0837905e81d


Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM PowerShell VirusTotal Malware powershell suspicious privilege Code Injection Check memory Checks debugger Creates shortcut RWX flags setting unpack itself suspicious process WriteConsoleW Windows ComputerName DNS Cryptographic key 		2 8.2 M 31 ZeroCERT

47060 2024-08-12 09:50 66b5b75106ac6_stealc.exe  

67d39f0cbbab44b99fffaf3a408b2088


Client SW User Data Stealer ftp Client info stealer Generic Malware Malicious Library .NET framework(MSIL) UPX Http API PWS AntiDebug AntiVM PE File .NET EXE PE32 OS Processor Check VirusTotal Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself DNS 		1 10.2 48 ZeroCERT

47061 2024-08-12 09:51 tt11.exe  

ecc0dee70c6fcd43a006581e69ffe6f2


Malicious Library Antivirus UPX Anti_VM PE File PE64 OS Processor Check VirusTotal Malware 		1.0 M 36 ZeroCERT

47062 2024-08-12 09:52 Director.bat  

641d4aab4f8fe4e9328dfc54dc158a99


Hide_EXE Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM VirusTotal Malware WriteConsoleW 		2.2 M 37 ZeroCERT

47063 2024-08-12 09:53 Cleanup.vbs  

afc30ab109d6fa03f5aa7165e732e14f


Hide_EXE PE File PE32 VirusTotal Malware Creates executable files AppData folder DNS 		1 6.2 M 38 ZeroCERT

47064 2024-08-12 09:56 Driver.bat  

b576e187cd838f6be64df278f3b35fac


Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM PowerShell VirusTotal Malware powershell suspicious privilege Code Injection Check memory Checks debugger Creates shortcut RWX flags setting unpack itself suspicious process WriteConsoleW Windows ComputerName DNS Cryptographic key 		1 8.2 M 31 ZeroCERT

47065 2024-08-12 09:57 ramos.exe  

83847cf6a192b9983d7a07be74cdab7b


Amadey Stealc Client SW User Data Stealer ftp Client info stealer Socket Http API ScreenShot Escalate priviledges HTTP Code injection Internet API KeyLogger PWS AntiDebug AntiVM PE File PE32 Browser Info Stealer Malware download Amadey Vidar VirusTotal Malware c&c AutoRuns Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files RWX flags setting exploit crash unpack itself Checks Bios Collect installed applications Detects VMWare malicious URLs sandbox evasion VMware anti-virtualization installed browsers check Ransomware Stealc Stealer Windows Exploit Browser ComputerName DNS crashed plugin 		13 3 19 6 20.6 M 38 ZeroCERT

47066 2024-08-12 09:57 Z2.dll  

35d97fe4def32490e580b328c39beaa7


Generic Malware Malicious Library UPX PE File DLL PE32 OS Processor Check VirusTotal Malware Checks debugger unpack itself Firmware 		2.0 M 17 ZeroCERT

47067 2024-08-12 09:58 Meetings.exe  

209ae4a712ada48aa2d5fba027ed58b6


Generic Malware Malicious Library WinRAR UPX Malicious Packer PE File PE32 OS Processor Check PNG Format icon VirusTotal Malware PDB Creates executable files unpack itself Windows utilities AppData folder Windows Remote Code Execution DNS 		1 5.4 M 58 ZeroCERT

47068 2024-08-12 10:00 Run1.exe  

76eb776b3942bec9baccd967eb8a39fe


Generic Malware Admin Tool (Sysinternals etc ...) UPX PE File PE32 Browser Info Stealer Malware download VirusTotal Malware Malicious Traffic Check memory buffers extracted Collect installed applications suspicious TLD anti-virtualization installed browsers check CryptBot Browser ComputerName DNS 		1 2 4 6.0 M 34 ZeroCERT

47069 2024-08-12 10:04 file2.exe  

ab3fa476538f4a3561a1bbb6258b7d94


Generic Malware Malicious Library .NET framework(MSIL) Antivirus Malicious Packer UPX AntiDebug AntiVM PE File .NET EXE PE32 PowerShell OS Processor Check VirusTotal Malware powershell AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files RWX flags setting unpack itself Windows utilities Disables Windows Security Checks Bios Check virtual network interfaces suspicious process AppData folder malicious URLs WriteConsoleW anti-virtualization Tofsee Windows Discord ComputerName DNS Cryptographic key 		7 15 7 3 21.0 M 28 ZeroCERT

47070 2024-08-12 10:04 r6.exe  

9506cd00f985244da45f70bbcf1f2518


Malicious Library Antivirus UPX PE File PE64 OS Processor Check VirusTotal Malware PDB DNS 		2 1.8 M 36 ZeroCERT

keyword