Submissions

Date range button:

First seen:

Last seen:

No	Date	Request	Urls	Hosts	IDS	Score	Zero	VT	Player
7246	2021-04-14 16:41	vbc.exe 6cf0200d66b943e0c41ce00807ffe6c8 Malicious Packer VirusTotal Malware suspicious privilege Code Injection Checks debugger buffers extracted unpack itself Remote Code Execution				7.2	M	47	r0d

7247	2021-04-14 18:09	Company profile.ppt e4e0b90a51833e6cf49113c06fa1a686 VirusTotal Malware VBScript powershell AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory buffers extracted WMI wscript.exe payload download Creates executable files ICMP traffic RWX flags setting unpack itself Windows utilities suspicious process WriteConsoleW Tofsee Interception Windows ComputerName Dropper	13 Keyword trend analysis Info http://j.mp/guwkqbhskagshjtyuiwqbh https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.png https://ajmeinthakahowahun.blogspot.com/p/divine2222.html https://resources.blogblog.com/img/icon18_edit_allbkg.gif https://www.blogger.com/dyn-css/authorization.css?targetBlogID=9202096335134795169&zx=40a67cbf-2c8f-4258-a13a-81794be5b191 https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.css https://ia801403.us.archive.org/0/items/divine2_20210411_1858/divine2.txt https://resources.blogblog.com/img/icon18_wrench_allbkg.png https://www.blogger.com/static/v1/widgets/1893845785-widgets.js https://www.blogger.com/static/v1/jsbin/1277698886-ieretrofit.js https://www.blogger.com/img/share_buttons_20_3.png https://www.blogger.com/static/v1/jsbin/3858658042-comment_from_post_iframe.js	15 Info j.mp(67.199.248.16) - mailcious resources.blogblog.com(142.250.196.105) ia801408.us.archive.org(207.241.228.148) - mailcious google.com(172.217.161.46) ia801403.us.archive.org(207.241.228.143) archive.org(207.241.224.2) - mailcious ajmeinthakahowahun.blogspot.com(172.217.25.97) www.blogger.com(142.250.196.105) 207.241.228.143 207.241.228.148 - mailcious 216.58.197.105 172.217.31.233 216.58.221.238 - suspicious 67.199.248.16 - mailcious 216.58.220.193	1	10.0	M	20	ZeroCERT

7248	2021-04-14 18:16	2HW7P.jpg 4486684e1b0197497e946a50a854ddf0 VirusTotal Malware				1.6		49	ZeroCERT

7249	2021-04-14 18:17	fix.exe 025e0b547c344ac713a7284e17feaca7 VirusTotal Malware suspicious privilege Code Injection WMI Creates shortcut Creates executable files Windows utilities Disables Windows Security suspicious process WriteConsoleW Windows ComputerName DNS				9.0		25	ZeroCERT

7250	2021-04-14 18:19	IMG_785_08_87.pdf b2ea5311684f2543466d7946f94c08ad Azorult .NET framework Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed	2 Keyword trend analysis	4	4	12.4		15	ZeroCERT

7251	2021-04-14 18:19	383MUXA2y9MxUAl.exe 29ff6018e35b8fa5381fef7a36bb7210 Azorult .NET framework AsyncRAT backdoor VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process AppData folder WriteConsoleW Windows ComputerName DNS crashed				12.4	M	31	ZeroCERT

7252	2021-04-14 18:21	kn.exe a05aae37dd12c48e08127cb0f4873908 Azorult .NET framework VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows Cryptographic key				7.4		21	ZeroCERT

7253	2021-04-14 18:21	nd.exe f0c14e678abcb5c2a5b2ad30cdca8b38 Azorult .NET framework VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows ComputerName DNS Cryptographic key crashed				10.8	M	39	ZeroCERT

7254	2021-04-14 18:23	r.dot 6c01c83aca376b7ece556a11f51c68ad Malware download VirusTotal Malware MachineGuid Malicious Traffic Check memory exploit crash unpack itself Windows Exploit DNS crashed Downloader	1 Keyword trend analysis	1	6 Info ET INFO Executable Download from dotted-quad Host ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 ET POLICY PE EXE or DLL Windows file download HTTP ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	4.8		27	ZeroCERT

7255	2021-04-14 18:23	1ASUmMVpXpavU5eFn7zzoQVoMgIIOL... 0bf11ac4cf33ce34e45622e6b2b1b7d6 VirusTotal Malware unpack itself DNS				1.8		4	ZeroCERT

7256	2021-04-14 18:26	Tt9G4kTuvbrWftD.exe e0fa817cc0040fb715ab5246f21ef476 Azorult .NET framework AsyncRAT backdoor VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process AppData folder WriteConsoleW Windows ComputerName DNS crashed		1		12.4	M	34	ZeroCERT

7257	2021-04-14 18:26	cnn.exe 68cdc1747c3d1a942143ad91f3e732f3 Azorult .NET framework AsyncRAT backdoor VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows ComputerName DNS Cryptographic key crashed				9.6	M	24	ZeroCERT

7258	2021-04-14 18:28	oriiig.exe b76c2c2ebb796d917e81c429e87e8927 Azorult .NET framework AsyncRAT backdoor VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process malicious URLs WriteConsoleW Windows ComputerName Cryptographic key crashed				10.6		10	ZeroCERT

7259	2021-04-14 18:28	kn.dot efe63e09c4ad82e21ee9f63ed8d2f604 Malware download VirusTotal Malware Malicious Traffic exploit crash unpack itself Windows Exploit DNS crashed Downloader	1 Keyword trend analysis	1	6 Info ET INFO Executable Download from dotted-quad Host ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 ET POLICY PE EXE or DLL Windows file download HTTP ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	4.0		21	ZeroCERT

7260	2021-04-14 18:30	nd.dot 71fffc7d15f4c34476a1d0db1d7a9ff3 Malware download VirusTotal Malware Malicious Traffic exploit crash unpack itself Windows Exploit DNS crashed Downloader	1 Keyword trend analysis	1	6 Info ET INFO Executable Download from dotted-quad Host ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 ET POLICY PE EXE or DLL Windows file download HTTP ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	4.0	M	24	ZeroCERT