popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
601 2024-08-27 13:32 XClient.exe  

bb742b8bbfa3691e17a2fcbc633e6298


Malicious Library .NET framework(MSIL) UPX PE File .NET EXE PE32 OS Processor Check Lnk Format GIF Format VirusTotal Malware AutoRuns PDB suspicious privilege MachineGuid Check memory Checks debugger Creates shortcut Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check Windows ComputerName DNS crashed 		1 6.6 M 55 ZeroCERT

602 2024-08-27 13:32 popup  

df72f2df722a840bb4b7bf1d000dd278


UPX PE File PE32 PDB Remote Code Execution 		0.4 M ZeroCERT

603 2024-08-27 13:31 66cccdb75f6aa_sfsjae.exe#space  

5c12433455f9b3542ea76166a0da2ac3


Stealc Client SW User Data Stealer ftp Client info stealer Antivirus Http API PWS AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer Malware download FTP Client Info Stealer Vidar VirusTotal Email Client Info Stealer Malware c&c PDB Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Collect installed applications sandbox evasion anti-virtualization installed browsers check Stealc Stealer Windows Browser Email ComputerName DNS Software crashed plugin 		10 2 18 2 13.4 M 20 ZeroCERT

604 2024-08-27 13:31 66cd1d45c5699_sjfiwe.exe#space  

aba62b7df98497b06b9a7262b50649ee


Stealc Client SW User Data Stealer LokiBot Gen1 ftp Client info stealer Generic Malware Downloader Antivirus Malicious Library UPX Malicious Packer ScreenShot Http API PWS Create Service Socket DGA Escalate priviledges Steal credential Sniff Browser Info Stealer Malware download FTP Client Info Stealer Vidar VirusTotal Email Client Info Stealer Malware c&c Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Stealc Stealer Windows Browser Email ComputerName DNS Software plugin 		12 7 21 3 18.0 M 24 ZeroCERT

605 2024-08-27 13:30 66cccdaf426d9_vnewe12.exe#d12  

659418612b1d12a71813f316fa0661e8


Stealc Client SW User Data Stealer LokiBot ftp Client info stealer Antivirus Malicious Library Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 FTP Client Info Stealer VirusTotal Malware Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Software 		1 5 3 1 15.4 M 32 ZeroCERT

606 2024-08-27 13:27 66ccae17b8329_ip360_dozen1_uns...  

e66d3c8d8751bbddf797b0f29cd82d07


Generic Malware Malicious Library Admin Tool (Sysinternals etc ...) Malicious Packer UPX PE File PE32 MZP Format OS Processor Check PE64 VirusTotal Malware Check memory Checks debugger unpack itself AppData folder installed browsers check Tofsee Browser crashed 		2 2 1 3.8 M 3 ZeroCERT

607 2024-08-27 13:26 random.exe  

cd777558787347c317809674583f3c89


Amadey Stealc Gen1 Generic Malware Themida Packer Malicious Library UPX Malicious Packer AntiDebug AntiVM PE File PE32 DLL OS Processor Check Browser Info Stealer Malware download Amadey FTP Client Info Stealer Vidar VirusTotal Email Client Info Stealer Malware c&c AutoRuns MachineGuid Code Injection Malicious Traffic Check memory Checks debugger Creates executable files unpack itself Checks Bios Collect installed applications Detects VMWare suspicious process AppData folder AntiVM_Disk sandbox evasion VMware anti-virtualization VM Disk Size Check installed browsers check Stealc Stealer Windows Browser Email ComputerName DNS Software crashed plugin 		10 3 20 3 17.8 M 42 ZeroCERT

608 2024-08-27 13:25 crss.exe  

3ab61ee8a81099edddf87af587420a10


Malicious Library Antivirus UPX PE File .NET EXE PE32 OS Processor Check VirusTotal Malware suspicious privilege MachineGuid Check memory Checks debugger unpack itself AntiVM_Disk VM Disk Size Check Windows ComputerName DNS Cryptographic key 		1 1 4.6 M 63 ZeroCERT

609 2024-08-27 13:25 66cd1d4315e2e_vokfw.exe#space  

2f6adedcacebcc4c1e68c75119e5d371


Stealc Client SW User Data Stealer LokiBot ftp Client info stealer Antivirus Malicious Library Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 FTP Client Info Stealer VirusTotal Malware Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process malicious URLs WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Software 		1 5 3 1 14.2 M 23 ZeroCERT

610 2024-08-27 13:23 66cccdb20c31e_vewf.exe#space  

eef25382ccfa4a108cad7e43bc4b43ea


Stealc Client SW User Data Stealer LokiBot ftp Client info stealer Antivirus Malicious Library Http API PWS HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 FTP Client Info Stealer VirusTotal Malware Telegram PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities Collect installed applications suspicious process malicious URLs sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee Windows Browser ComputerName DNS Software 		1 5 3 1 15.4 M 30 ZeroCERT

611 2024-08-27 13:14 5GInside终端生态认证合作申请表.lnk...  

511f1e0b4274bf0c1cf6d9e756b5002c


Generic Malware Socket DNS AntiDebug AntiVM Lnk Format GIF Format VirusTotal Malware Code Injection Check memory Creates shortcut WriteConsoleW 		2.2 1 ZeroCERT

612 2024-08-27 05:22 F-Secure-Safe-Network-Installe...  

9c15aac2f31dd9e1e8d64cf8f04ea5d6


Gen1 UPX PE File PE64 OS Processor Check VirusTotal Malware Tofsee Remote Code Execution 		4 1 1.2 11 guest

613 2024-08-27 02:30 CPPFPS.exe  

80eeef64813e08184cc1102e86e690a2


Generic Malware Malicious Library UPX PE File PE64 OS Processor Check PDB Check memory crashed 		1.2 guest

614 2024-08-26 16:43 svchost.exe  

733996860531962f4c9998a1fbaa5ce4


Malicious Library PE File PE32 unpack itself ComputerName 		1.4 guest

615 2024-08-26 10:58 equitosnewwwMPDW-constraints.v...  

4ae7385704b5628d2281adfcdf6e0aa6


Generic Malware Antivirus Hide_URL PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		1 2 1 7.6 M 2 ZeroCERT

keyword