popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
586 2024-08-27 13:49 66cc394a4818a_vlawg.exe#space  

be02035f9559cf4aba601b45a1677d92


Stealc Client SW User Data Stealer LokiBot ftp Client info stealer Antivirus Malicious Library Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 FTP Client Info Stealer VirusTotal Malware Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process malicious URLs WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Software 		2 5 3 1 15.8 M 51 ZeroCERT

587 2024-08-27 13:49 V1.1.exe  

7b1d21282a65bac0410541f7466c7038


Generic Malware Malicious Library Downloader Malicious Packer ASPack UPX PE File PE32 OS Processor Check PNG Format MZP Format JPEG Format Malware download VirusTotal Malware AutoRuns Check memory Creates executable files ICMP traffic RWX flags setting unpack itself AppData folder suspicious TLD sandbox evasion Tofsee Interception Windows Remote Code Execution DNS crashed 		2 11 7 11.0 M 59 ZeroCERT

588 2024-08-27 13:48 66ccd175ef453_crypted.exe#1  

cd1dd0289c092923eb8985e8d86d215f


RedLine stealer Antivirus ScreenShot PWS AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer RedLine Malware download FTP Client Info Stealer VirusTotal Malware Microsoft PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted WMI unpack itself Collect installed applications installed browsers check Stealer Windows Browser ComputerName DNS Cryptographic key Software crashed 		1 6 12.8 M 23 ZeroCERT

589 2024-08-27 13:48 iniupdateion.hta  

6c8ac4c656d98ff4280887b23258ecd6


Generic Malware Antivirus AntiDebug AntiVM PE File DLL PE32 .NET DLL MSOffice File VirusTotal Malware powershell suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger Creates shortcut Creates executable files exploit crash unpack itself Windows utilities powershell.exe wrote suspicious process AppData folder Tofsee Windows Exploit ComputerName DNS Cryptographic key crashed 		1 1 2 11.2 20 ZeroCERT

590 2024-08-27 13:46 k.vsdx  

2a6b595d602bc312ec253b1fc5574ee6


AntiDebug AntiVM Word 2007 file format(docx) ZIP Format Email Client Info Stealer suspicious privilege Checks debugger Creates shortcut unpack itself installed browsers check Browser Email ComputerName DNS 		2 4.0 ZeroCERT

591 2024-08-27 13:43 nikmok1.exe  

27058f6c310e29963251df57e752456a


AsyncRAT task schedule Downloader Malicious Packer .NET framework(MSIL) UPX Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM PE File VirusTotal Malware AutoRuns Code Injection Windows utilities suspicious process AppData folder WriteConsoleW Windows ComputerName 		5.2 M 63 ZeroCERT

592 2024-08-27 13:43 %E6%8B%8D%E7%89%8C%E4%B8%93%E4...  

ddce1d8422132feb58ce06d08e4dd570


Generic Malware Malicious Library UPX ASPack PE File PE32 OS Processor Check DLL DllRegisterServer dll PNG Format JPEG Format VirusTotal Malware PDB suspicious privilege Malicious Traffic Check memory buffers extracted WMI Creates executable files Windows utilities AppData folder WriteConsoleW Windows Browser ComputerName Remote Code Execution Alibaba DNS 		24 4 2 8.8 M 62 ZeroCERT

593 2024-08-27 13:43 ERAB.exe  

dfa3bc45245a6f8f6c7085e625afbb99


Emotet Downloader Generic Malware [C] All Process Malicious Library Malicious Packer UPX PE File MSOffice File PE32 OS Processor Check PNG Format icon JPEG Format DLL Creates executable files unpack itself AppData folder Tofsee Windows keylogger 		42 4 3 3.4 M ZeroCERT

594 2024-08-27 13:42 66ccafcac5016_vgrne.exe#space  

bdd1a2649b702efd40ea75b287c7823f


Stealc Client SW User Data Stealer LokiBot ftp Client info stealer Antivirus Malicious Library Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 FTP Client Info Stealer VirusTotal Malware Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Software 		1 5 3 1 17.0 M 35 ZeroCERT

595 2024-08-27 13:42 sostener.vbs  

d69aba37148168650f4980f77a45239e

ComputerName 		0.2 ZeroCERT

596 2024-08-27 13:41 zx.exe  

f2b9c2a610af9cfb62abcdd5b850b320


Gen1 Generic Malware Malicious Library ASPack UPX Anti_VM PE File PE64 OS Processor Check DLL ZIP Format Check memory Checks debugger Creates executable files unpack itself 		1.6 M ZeroCERT

597 2024-08-27 13:40 66ccafcd67f82_smfd.exe#space  

291f4077c8a105916adfca7fd93db28f


Stealc Client SW User Data Stealer LokiBot Gen1 ftp Client info stealer Generic Malware Downloader Antivirus Malicious Library UPX Malicious Packer ScreenShot Http API PWS Create Service Socket DGA Escalate priviledges Steal credential Sniff Browser Info Stealer Malware download FTP Client Info Stealer Vidar VirusTotal Email Client Info Stealer Malware c&c Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Stealc Stealer Windows Browser Email ComputerName DNS Software plugin 		12 7 21 3 17.6 M 35 ZeroCERT

598 2024-08-27 13:35 66cc385ebf359_vwern.exe#d12  

87e99ab17b577782dee5cfb83f678b21


Stealc Client SW User Data Stealer LokiBot ftp Client info stealer Antivirus Malicious Library Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 FTP Client Info Stealer VirusTotal Malware Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Software 		1 5 3 1 15.0 M 50 ZeroCERT

599 2024-08-27 13:34 SaphireSkins.exe  

e31988b2c4f91978565a3f40e2f8268d


UPX PE File ftp PE32 OS Processor Check VirusTotal Malware 		1.4 M 35 ZeroCERT

600 2024-08-27 13:32 66cccdba20cab_vkweo15.exe#d15  

47234273933c5f95321da395270d3843


Stealc Client SW User Data Stealer LokiBot ftp Client info stealer Antivirus Malicious Library Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 FTP Client Info Stealer VirusTotal Malware Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Software 		1 5 3 1 15.2 M 21 ZeroCERT

keyword