popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
6106 2024-01-26 09:12 agodzx.exe  

b29fbc48ad3305f4dcab0be3145682a6


AgentTesla Malicious Library .NET framework(MSIL) UPX PWS SMTP KeyLogger AntiDebug AntiVM PE32 PE File .NET EXE OS Processor Check Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Buffer PE AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Software crashed 		2 7 6 15.4 M 42 ZeroCERT

6107 2024-01-26 09:11 rost.exe  

2f9214f932a930a4cdff2b48a3a8eded


RedLine stealer Amadey RedLine Infostealer RedlineStealer UltraVNC Generic Malware NSIS Hide_EXE Malicious Packer Malicious Library UPX Antivirus Admin Tool (Sysinternals etc ...) .NET framework(MSIL) ScreenShot PWS Anti_VM AntiDebug AntiVM PE Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer VirusTotal Email Client Info Stealer Cryptocurrency Miner Malware Cryptocurrency wallets Cryptocurrency Microsoft AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files RWX flags setting unpack itself Windows utilities Disables Windows Security Checks Bios Collect installed applications suspicious process AppData folder AntiVM_Disk sandbox evasion WriteConsoleW anti-virtualization IP Check VM Disk Size Check installed browsers check Tofsee Ransomware Stealer Windows Update Browser RisePro Email ComputerName DNS Cryptographic key Software crashed Downloader CoinMiner 		28 22 25 12 32.2 M 38 ZeroCERT

6108 2024-01-26 09:10 Schellingianism.exe  

e778bb2a5cf80db389e541958d9c3bf2


Malicious Library UPX PE32 PE File DLL VirusTotal Malware Check memory Creates executable files unpack itself AppData folder Ransomware 		2.8 M 16 ZeroCERT

6109 2024-01-26 09:10 conhost.exe  

b90adcc386503d5864f6df6bfaa3409b


.NET framework(MSIL) PE32 PE File .NET EXE VirusTotal Malware PDB Check memory Checks debugger buffers extracted unpack itself Windows Cryptographic key 		3.0 34 ZeroCERT

6110 2024-01-26 09:09 user13.exe  

d252ce47e96b7cf75c6be209eff61072


Generic Malware Malicious Library Malicious Packer UPX PE File PE64 OS Processor Check VirusTotal Malware 		0.4 M 4 ZeroCERT

6111 2024-01-26 09:07 Atqumy.exe  

dade3d1f204511b49e65d585685a8b1f


Hide_EXE .NET framework(MSIL) UPX PE32 PE File .NET EXE OS Processor Check VirusTotal Malware suspicious privilege Check memory Checks debugger unpack itself Windows ComputerName Cryptographic key 		2.8 M 23 ZeroCERT

6112 2024-01-26 09:05 musicc.exe  

8c737832e41951697322de7005e2771b


Process Kill Malicious Library FindFirstVolume CryptGenKey UPX PE32 PE File Device_File_Check OS Processor Check Browser Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Malicious Traffic Check memory Checks debugger unpack itself Check virtual network interfaces IP Check Browser Email ComputerName DNS crashed 		1 8 3 7.2 27 ZeroCERT

6113 2024-01-26 09:05 fsdfsfsfs.exe  

b2f3f214e959043b7a6b623b82c95946


PE32 PE File .NET EXE VirusTotal Malware PDB Check memory Checks debugger unpack itself 		2.2 M 24 ZeroCERT

6114 2024-01-26 09:04 Setup.exe  

2522036524378a539e696724ed56a5a4


Malicious Library Malicious Packer UPX PE File PE64 OS Processor Check Browser Info Stealer Malware download VirusTotal Email Client Info Stealer Malware Check memory buffers extracted Creates shortcut unpack itself Collect installed applications IP Check installed browsers check Tofsee Browser Email ComputerName Trojan Banking DNS 		3 6 11.6 M 28 ZeroCERT

6115 2024-01-25 16:36 vLnNHh.exe  

3cf7e35d135707c3c8db1e571b28f191


AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		2 2 3.8 ZeroCERT

6116 2024-01-25 16:34 grace.exe  

bc2b81ee5871a2af529ba6d695e656c6


Process Kill Malicious Library FindFirstVolume CryptGenKey UPX PE32 PE File Device_File_Check OS Processor Check Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AutoRuns suspicious privilege Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Software crashed keylogger 		4 5 10.0 32 ZeroCERT

6117 2024-01-25 16:32 Rehman_GROUP_RFQ.vbs  

181f9015b54b57a4175e9c4584751d57


Generic Malware Antivirus PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted wscript.exe payload download Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		4 4 2 9.2 13 ZeroCERT

6118 2024-01-25 14:30 Order_Information.url  

7f4085aab74f2da761e65d5fb41fd40f


AntiDebug AntiVM URL Format MSOffice File Code Injection RWX flags setting unpack itself Windows utilities Tofsee Windows DNS 		1 1 2 4.4 ZeroCERT

6119 2024-01-25 14:01 statement_trans_24_01_2024.lnk  

6e9db0f67fedf5f6ee30d92e86581cce


Generic Malware task schedule AntiDebug AntiVM Lnk Format GIF Format VirusTotal Malware AutoRuns Code Injection Checks debugger Creates shortcut Creates executable files unpack itself Windows utilities suspicious process WriteConsoleW Windows ComputerName 		1 4.6 8 ZeroCERT

6120 2024-01-25 13:56 조선 시장 물가 분석(신의주).hwp...  

e26422ba7e1eed4481e9389806e798c3


HWP PS PostScript MSOffice File Lnk Format GIF Format VirusTotal Malware Checks debugger Creates shortcut Creates executable files 		1.6 15 ZeroCERT

keyword