popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
47596 2024-08-27 13:31 66cccdb75f6aa_sfsjae.exe#space  

5c12433455f9b3542ea76166a0da2ac3


Stealc Client SW User Data Stealer ftp Client info stealer Antivirus Http API PWS AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer Malware download FTP Client Info Stealer Vidar VirusTotal Email Client Info Stealer Malware c&c PDB Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Collect installed applications sandbox evasion anti-virtualization installed browsers check Stealc Stealer Windows Browser Email ComputerName DNS Software crashed plugin 		10 2 18 2 13.4 M 20 ZeroCERT

47597 2024-08-27 13:32 popup  

df72f2df722a840bb4b7bf1d000dd278


UPX PE File PE32 PDB Remote Code Execution 		0.4 M ZeroCERT

47598 2024-08-27 13:32 XClient.exe  

bb742b8bbfa3691e17a2fcbc633e6298


Malicious Library .NET framework(MSIL) UPX PE File .NET EXE PE32 OS Processor Check Lnk Format GIF Format VirusTotal Malware AutoRuns PDB suspicious privilege MachineGuid Check memory Checks debugger Creates shortcut Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check Windows ComputerName DNS crashed 		1 6.6 M 55 ZeroCERT

47599 2024-08-27 13:32 66cccdba20cab_vkweo15.exe#d15  

47234273933c5f95321da395270d3843


Stealc Client SW User Data Stealer LokiBot ftp Client info stealer Antivirus Malicious Library Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 FTP Client Info Stealer VirusTotal Malware Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Software 		1 5 3 1 15.2 M 21 ZeroCERT

47600 2024-08-27 13:34 SaphireSkins.exe  

e31988b2c4f91978565a3f40e2f8268d


UPX PE File ftp PE32 OS Processor Check VirusTotal Malware 		1.4 M 35 ZeroCERT

47601 2024-08-27 13:35 66cc385ebf359_vwern.exe#d12  

87e99ab17b577782dee5cfb83f678b21


Stealc Client SW User Data Stealer LokiBot ftp Client info stealer Antivirus Malicious Library Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 FTP Client Info Stealer VirusTotal Malware Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Software 		1 5 3 1 15.0 M 50 ZeroCERT

47602 2024-08-27 13:40 66ccafcd67f82_smfd.exe#space  

291f4077c8a105916adfca7fd93db28f


Stealc Client SW User Data Stealer LokiBot Gen1 ftp Client info stealer Generic Malware Downloader Antivirus Malicious Library UPX Malicious Packer ScreenShot Http API PWS Create Service Socket DGA Escalate priviledges Steal credential Sniff Browser Info Stealer Malware download FTP Client Info Stealer Vidar VirusTotal Email Client Info Stealer Malware c&c Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Stealc Stealer Windows Browser Email ComputerName DNS Software plugin 		12 7 21 3 17.6 M 35 ZeroCERT

47603 2024-08-27 13:41 zx.exe  

f2b9c2a610af9cfb62abcdd5b850b320


Gen1 Generic Malware Malicious Library ASPack UPX Anti_VM PE File PE64 OS Processor Check DLL ZIP Format Check memory Checks debugger Creates executable files unpack itself 		1.6 M ZeroCERT

47604 2024-08-27 13:42 sostener.vbs  

d69aba37148168650f4980f77a45239e

ComputerName 		0.2 ZeroCERT

47605 2024-08-27 13:42 66ccafcac5016_vgrne.exe#space  

bdd1a2649b702efd40ea75b287c7823f


Stealc Client SW User Data Stealer LokiBot ftp Client info stealer Antivirus Malicious Library Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 FTP Client Info Stealer VirusTotal Malware Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Software 		1 5 3 1 17.0 M 35 ZeroCERT

47606 2024-08-27 13:43 ERAB.exe  

dfa3bc45245a6f8f6c7085e625afbb99


Emotet Downloader Generic Malware [C] All Process Malicious Library Malicious Packer UPX PE File MSOffice File PE32 OS Processor Check PNG Format icon JPEG Format DLL Creates executable files unpack itself AppData folder Tofsee Windows keylogger 		42 4 3 3.4 M ZeroCERT

47607 2024-08-27 13:43 %E6%8B%8D%E7%89%8C%E4%B8%93%E4...  

ddce1d8422132feb58ce06d08e4dd570


Generic Malware Malicious Library UPX ASPack PE File PE32 OS Processor Check DLL DllRegisterServer dll PNG Format JPEG Format VirusTotal Malware PDB suspicious privilege Malicious Traffic Check memory buffers extracted WMI Creates executable files Windows utilities AppData folder WriteConsoleW Windows Browser ComputerName Remote Code Execution Alibaba DNS 		24 4 2 8.8 M 62 ZeroCERT

47608 2024-08-27 13:43 nikmok1.exe  

27058f6c310e29963251df57e752456a


AsyncRAT task schedule Downloader Malicious Packer .NET framework(MSIL) UPX Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM PE File VirusTotal Malware AutoRuns Code Injection Windows utilities suspicious process AppData folder WriteConsoleW Windows ComputerName 		5.2 M 63 ZeroCERT

47609 2024-08-27 13:46 k.vsdx  

2a6b595d602bc312ec253b1fc5574ee6


AntiDebug AntiVM Word 2007 file format(docx) ZIP Format Email Client Info Stealer suspicious privilege Checks debugger Creates shortcut unpack itself installed browsers check Browser Email ComputerName DNS 		2 4.0 ZeroCERT

47610 2024-08-27 13:48 iniupdateion.hta  

6c8ac4c656d98ff4280887b23258ecd6


Generic Malware Antivirus AntiDebug AntiVM PE File DLL PE32 .NET DLL MSOffice File VirusTotal Malware powershell suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger Creates shortcut Creates executable files exploit crash unpack itself Windows utilities powershell.exe wrote suspicious process AppData folder Tofsee Windows Exploit ComputerName DNS Cryptographic key crashed 		1 1 2 11.2 20 ZeroCERT

keyword