popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
6811 2024-08-12 10:00 Run1.exe  

76eb776b3942bec9baccd967eb8a39fe


Generic Malware Admin Tool (Sysinternals etc ...) UPX PE File PE32 Browser Info Stealer Malware download VirusTotal Malware Malicious Traffic Check memory buffers extracted Collect installed applications suspicious TLD anti-virtualization installed browsers check CryptBot Browser ComputerName DNS 		1 2 4 6.0 M 34 ZeroCERT

6812 2024-08-12 09:58 Meetings.exe  

209ae4a712ada48aa2d5fba027ed58b6


Generic Malware Malicious Library WinRAR UPX Malicious Packer PE File PE32 OS Processor Check PNG Format icon VirusTotal Malware PDB Creates executable files unpack itself Windows utilities AppData folder Windows RCE DNS 		1 5.4 M 58 ZeroCERT

6813 2024-08-12 09:57 Z2.dll  

35d97fe4def32490e580b328c39beaa7


Generic Malware Malicious Library UPX PE File DLL PE32 OS Processor Check VirusTotal Malware Checks debugger unpack itself Firmware 		2.0 M 17 ZeroCERT

6814 2024-08-12 09:57 ramos.exe  

83847cf6a192b9983d7a07be74cdab7b


Amadey Stealc Client SW User Data Stealer ftp Client info stealer Socket Http API ScreenShot Escalate priviledges HTTP Code injection Internet API KeyLogger PWS AntiDebug AntiVM PE File PE32 Browser Info Stealer Malware download Amadey Vidar VirusTotal Malware c&c AutoRuns Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files RWX flags setting exploit crash unpack itself Checks Bios Collect installed applications Detects VMWare malicious URLs sandbox evasion VMware anti-virtualization installed browsers check Ransomware Stealc Stealer Windows Exploit Browser ComputerName DNS crashed plugin 		13 3 19 6 20.6 M 38 ZeroCERT

6815 2024-08-12 09:56 Driver.bat  

b576e187cd838f6be64df278f3b35fac


Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM PowerShell VirusTotal Malware powershell suspicious privilege Code Injection Check memory Checks debugger Creates shortcut RWX flags setting unpack itself suspicious process WriteConsoleW Windows ComputerName DNS Cryptographic key 		1 8.2 M 31 ZeroCERT

6816 2024-08-12 09:53 Cleanup.vbs  

afc30ab109d6fa03f5aa7165e732e14f


Hide_EXE PE File PE32 VirusTotal Malware Creates executable files AppData folder DNS 		1 6.2 M 38 ZeroCERT

6817 2024-08-12 09:52 Director.bat  

641d4aab4f8fe4e9328dfc54dc158a99


Hide_EXE Downloader Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM VirusTotal Malware WriteConsoleW 		2.2 M 37 ZeroCERT

6818 2024-08-12 09:51 tt11.exe  

ecc0dee70c6fcd43a006581e69ffe6f2


Malicious Library Antivirus UPX Anti_VM PE File PE64 OS Processor Check VirusTotal Malware 		1.0 M 36 ZeroCERT

6819 2024-08-12 09:50 66b5b75106ac6_stealc.exe  

67d39f0cbbab44b99fffaf3a408b2088


Client SW User Data Stealer ftp Client info stealer Generic Malware Malicious Library .NET framework(MSIL) UPX Http API PWS AntiDebug AntiVM PE File .NET EXE PE32 OS Processor Check VirusTotal Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself DNS 		1 10.2 48 ZeroCERT

6820 2024-08-12 09:49 sesc16.bat  

4b7ebe87da068d04f5d0b0837905e81d


Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM PowerShell VirusTotal Malware powershell suspicious privilege Code Injection Check memory Checks debugger Creates shortcut RWX flags setting unpack itself suspicious process WriteConsoleW Windows ComputerName DNS Cryptographic key 		2 8.2 M 31 ZeroCERT

6821 2024-08-12 09:48 Blogger-http2.vbs  

b71d3da9f944c2bce3e6c16867607841

VirusTotal Malware unpack itself crashed 		1.4 29 ZeroCERT

6822 2024-08-12 09:47 66b4af430a0a1_files.exe  

f3d8c82810e55bc012bdeb2557ff13b9


Malicious Library UPX AntiDebug AntiVM PE File .NET EXE PE32 OS Processor Check VirusTotal Malware Buffer PE PDB Code Injection Check memory Checks debugger buffers extracted unpack itself RCE DNS 		1 9.6 M 55 ZeroCERT

6823 2024-08-12 09:47 66b331646d2cd_123p.exe  

27b14ad026da76c1111174c6b4ba6aba


PE File PE64 VirusTotal Cryptocurrency Miner Malware DNS CoinMiner 		2 1 1.8 M 52 ZeroCERT

6824 2024-08-12 09:46 Blogger-http.bat  

760e4992b9a2f60c53b67becaf62f157


Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P Hide_URL AntiDebug AntiVM PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW Windows ComputerName DNS Cryptographic key 		1 7.2 30 ZeroCERT

6825 2024-08-12 09:45 66b0ee142cf8f_PhotosExifEditor...  

677ad736788d93b76ca77717706a8176


Generic Malware Malicious Library Malicious Packer UPX DllRegisterServer dll PE File PE64 OS Processor Check VirusTotal Malware 		1.2 M 44 ZeroCERT

keyword