popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
5791 2024-02-09 04:07 merlin.js  

36f47633918675a107df6c1d1b0cc672


task schedule Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM unpack itself malicious URLs crashed 		1.4 guest

5792 2024-02-09 04:07 merlin.min.js  

2941b51484f9f83a0e3dfe592fd16957


Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM malicious URLs crashed 		1.0 guest

5793 2024-02-08 18:10 putty.bat  

f46a83e052ee544c9696654fb450d00a


Generic Malware Downloader Antivirus UPX Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM PE32 PE File suspicious privilege Code Injection Check memory Checks debugger Creates shortcut Creates executable files unpack itself Windows utilities suspicious process AppData folder WriteConsoleW Windows ComputerName Cryptographic key 		6.0 ZeroCERT

5794 2024-02-08 18:06 ballonservicefrommicrosfotisgr...  

28e198167f8b55c4e5ba832afa4a2b60


MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware VBScript Malicious Traffic buffers extracted exploit crash unpack itself Tofsee Exploit DNS crashed 		3 3 3 1 4.6 M 32 ZeroCERT

5795 2024-02-08 18:04 wedfreshairgetfrommicrosfotbal...  

3740b9bffc150fd3f4c211caaa4bb385


MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware VBScript Malicious Traffic buffers extracted exploit crash unpack itself Tofsee Exploit DNS crashed 		3 3 3 1 4.6 M 33 ZeroCERT

5796 2024-02-08 18:02 lumma123142124.exe  

cad41f50c144c92747eee506f5c69a05


PE32 PE File .NET EXE VirusTotal Malware PDB Check memory Checks debugger unpack itself 		2.6 M 50 ZeroCERT

5797 2024-02-08 18:00 Goldprime.exe  

7e9e39a623a04307eb499ff6617b9746


PE32 PE File .NET EXE VirusTotal Malware PDB Check memory Checks debugger unpack itself 		2.6 M 44 ZeroCERT

5798 2024-02-08 17:59 Update.exe  

db25dde66c6101eb5c357a1fecb34925


Generic Malware Malicious Library Malicious Packer UPX PE File PE64 OS Processor Check MachineGuid Check virtual network interfaces WriteConsoleW Tofsee 		2 3 1 1.8 M ZeroCERT

5799 2024-02-08 17:58 wednewsmangero.vbs  

3183b42ec0106c38fc5f9fb28cc5e789

VirusTotal Malware wscript.exe payload download Tofsee DNS 		2 3 2 2.6 M 7 ZeroCERT

5800 2024-02-08 17:56 LM.exe  

196921b3788eac48b29d5ce802ff8e27


Admin Tool (Sysinternals etc ...) PE32 PE File VirusTotal Malware unpack itself crashed 		2.0 M 30 ZeroCERT

5801 2024-02-08 17:56 loveandlover.vbs  

6507643094054c35167c2eb65b8b3051

VirusTotal Malware wscript.exe payload download Tofsee 		2 2 2 2.0 M 7 ZeroCERT

5802 2024-02-08 17:55 plaza.exe  

0aeac9446941d8e6a6cb29f6b55a6dc8


Themida Packer Malicious Packer UPX Malicious Library Anti_VM AntiDebug AntiVM PE32 PE File OS Processor Check MSOffice File Lnk Format GIF Format .NET EXE ZIP Format Browser Info Stealer Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files RWX flags setting exploit crash unpack itself Windows utilities Disables Windows Security Checks Bios Collect installed applications Detects VMWare suspicious process AppData folder AntiVM_Disk WriteConsoleW VMware anti-virtualization IP Check VM Disk Size Check installed browsers check Tofsee Ransomware Windows Update Exploit Browser RisePro Email ComputerName DNS Software crashed Downloader 		18 14 13 5 23.0 M 39 ZeroCERT

5803 2024-02-08 17:54 for.exe  

8c281571c5fdaf40aa847d90e5a81075


PE32 PE File .NET EXE VirusTotal Malware PDB Check memory Checks debugger unpack itself 		2.6 M 46 ZeroCERT

5804 2024-02-08 17:53 photosensi.cur  

f1d2fa9c23646b2e3718fb7e9f48e7a9


Suspicious_Script_Bin 		M ZeroCERT

5805 2024-02-08 14:01 키위파이낸셜_S.apk  

c8df2c033cd82239668f2477adde9b2e


ZIP Format VirusTotal Malware 		0.4 7 guest

keyword