popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
47851 2024-09-05 15:43 UpdaterLOC.dll  

16834e676f3c8e4de9435cefe2846b50


Swrort Malicious Library PE File DLL PE32 VirusTotal Malware 		1.2 55 ZeroCERT

47852 2024-09-05 15:43 Meeting.sfx.exe  

1a679e0ccedfb2c3b8ebaf8d9b22f96a


Generic Malware Malicious Library UPX Malicious Packer PE File PE32 OS Processor Check PNG Format VirusTotal Malware PDB Check memory Creates executable files RWX flags setting unpack itself AppData folder Remote Code Execution DNS 		1 4.6 51 ZeroCERT

47853 2024-09-05 15:44 nothirdparty.exe  

06b14e682a491946aac19067e8a30d32


Gen1 Generic Malware Malicious Packer UPX Malicious Library Anti_VM AntiDebug AntiVM PE File PE32 OS Processor Check BMP Format MSOffice File JPEG Format Malware download FTP Client Info Stealer VirusTotal Malware c&c Code Injection Malicious Traffic Check memory unpack itself Windows utilities Collect installed applications suspicious process AppData folder sandbox evasion WriteConsoleW anti-virtualization installed browsers check Ransomware Stealc Stealer Windows Browser ComputerName DNS Software crashed plugin 		3 1 6 11.0 13 ZeroCERT

47854 2024-09-05 15:45 Meeting.exe  

1ebcc328f7d1da17041835b0a960e1fa


Malicious Packer UPX PE File PE32 VirusTotal Malware unpack itself DNS 		1 2.6 M 63 ZeroCERT

47855 2024-09-06 08:46 XPPenWin_3.4.14.240603.exe  

5b241a00877562471e9f2958c6d4eab4


Gen1 Generic Malware Downloader task schedule Malicious Library UPX Malicious Packer Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P persistence Ant suspicious privilege Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities suspicious process AppData folder malicious URLs WriteConsoleW Windows ComputerName 		6.2 guest

47856 2024-09-06 08:46 XPPenWin_3.4.14.240603.exe  

5b241a00877562471e9f2958c6d4eab4


Gen1 Generic Malware task schedule Downloader Malicious Library UPX Malicious Packer Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P Ant suspicious privilege Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities suspicious process AppData folder malicious URLs WriteConsoleW Windows ComputerName 		6.2 guest

47857 2024-09-06 10:29 vnf12.exe#d12  

5329db082628c145684ae986afc62b1b


Stealc Client SW User Data Stealer LokiBot ftp Client info stealer Malicious Library Antivirus Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 FTP Client Info Stealer VirusTotal Malware Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Software 		1 5 3 1 16.0 M 28 ZeroCERT

47858 2024-09-06 10:29 vjgg.exe#space  

20c0e4911043acdf83cd6f5818060b6d


Stealc Client SW User Data Stealer LokiBot ftp Client info stealer Malicious Library Antivirus Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 FTP Client Info Stealer VirusTotal Malware Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Software 		1 5 3 1 15.6 M 28 ZeroCERT

47859 2024-09-06 10:31 cuzinefileMPDW-constraints.vbs  

dc124818ead2b412a6cf5f10745f64fd


Generic Malware Antivirus Hide_URL PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		1 2 1 7.6 6 ZeroCERT

47860 2024-09-06 10:33 abQOhgu.exe  

387d4b12ac9e87b9db76589fcca2b937


Process Kill Generic Malware Suspicious_Script_Bin Malicious Library FindFirstVolume CryptGenKey UPX PE File Device_File_Check PE32 OS Processor Check Browser Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Malicious Traffic Check memory Checks debugger unpack itself Check virtual network interfaces IP Check Browser Email ComputerName DNS crashed 		1 2 2 6.6 24 ZeroCERT

47861 2024-09-06 10:36 notebyx.exe  

7a8463b22eb60bf18f4df8444e006d96


Process Kill Generic Malware Suspicious_Script_Bin Malicious Library FindFirstVolume CryptGenKey UPX PE File Device_File_Check PE32 OS Processor Check Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Check memory Checks debugger unpack itself Browser Email ComputerName Software crashed 		5.2 33 ZeroCERT

47862 2024-09-06 10:37 sgnr.exe#space  

b81ac0bd6737adc5d296e9d86491d9f4


Stealc Client SW User Data Stealer ftp Client info stealer Malicious Library Antivirus Http API PWS AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer Malware download Vidar VirusTotal Malware c&c PDB Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Collect installed applications sandbox evasion anti-virtualization installed browsers check Stealc Stealer Windows Browser ComputerName DNS plugin 		9 1 15 2 12.0 M 28 ZeroCERT

47863 2024-09-06 10:38 66d9f6e9330e4_deep.exe  

6a94b94ba557d5d85a1da20213d48974


Generic Malware Malicious Packer UPX PE File PE64 VirusTotal Malware 		1.2 M 24 ZeroCERT

47864 2024-09-06 10:41 66d9ddfaa7a23_Porter.exe#main  

324d2a434b8a3e038661a75587e303b8


RedLine stealer Emotet Suspicious_Script_Bin Generic Malware Downloader Antivirus Malicious Library Malicious Packer UPX ScreenShot PWS Create Service Socket DGA Http API Escalate priviledges Steal credential Hijack Network Sniff Audio HTTP DNS Code inje Browser Info Stealer RedLine Malware download FTP Client Info Stealer VirusTotal Malware Microsoft PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Collect installed applications Check virtual network interfaces AppData folder malicious URLs AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Tofsee Stealer Windows Browser ComputerName DNS Cryptographic key Software crashed 		2 4 11 1 18.0 M 49 ZeroCERT

47865 2024-09-06 10:41 XPPenWin_3.4.14.240603.exe  

5b241a00877562471e9f2958c6d4eab4


Gen1 Generic Malware Downloader task schedule Malicious Library UPX Malicious Packer Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P persistence Ant suspicious privilege Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities suspicious process AppData folder malicious URLs WriteConsoleW Windows ComputerName 		6.2 geez

keyword