popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
8086 2021-05-18 09:08 proof of payment.exe  

7238cb41274f63e1d5463d9259facb19


AsyncRAT backdoor PWS .NET framework SMTP KeyLogger AntiDebug AntiVM .NET EXE PE File PE32 VirusTotal Malware AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows ComputerName DNS crashed 		10.8 34 ZeroCERT

8087 2021-05-18 09:09 file2.exe  

dba20ac697952657e4daee957e10a805


Raccoon Stealer Glupteba PE File OS Processor Check PE32 PDB unpack itself Windows Remote Code Execution crashed 		2.0 M ZeroCERT

8088 2021-05-18 09:11 file1.exe  

7aadd46ba3b6e23aca20677ac281c03b


Glupteba PE File OS Processor Check PE32 PDB unpack itself Windows Remote Code Execution crashed 		2.2 M ZeroCERT

8089 2021-05-18 09:13 setup.exe  

b749832e5d6ebfc73a61cde48a1b890b


Process Kill PE File OS Processor Check PE32 Device_File_Check Browser Info Stealer VirusTotal Malware Malicious Traffic Check memory buffers extracted ICMP traffic Windows utilities suspicious process AppData folder anti-virtualization Windows Browser 		2 2 7.2 59 ZeroCERT

8090 2021-05-18 09:14 lhtr7x1pv.zip  

283398a30cd7505b780c113d1838fc40


DLL PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself DNS crashed 		1.8 8 ZeroCERT

8091 2021-05-18 09:18 a7xsbjsf.zip  

afd9013de89b0b5ae549599c9afba03d


DLL PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself crashed 		1.4 10 ZeroCERT

8092 2021-05-18 09:18 jooyu.exe  

aed57d50123897b0012c35ef5dec4184


Gen2 Emotet PE File OS Processor Check PE32 Browser Info Stealer VirusTotal Malware PDB Malicious Traffic Check memory Creates executable files Check virtual network interfaces AppData folder IP Check Tofsee Browser Remote Code Execution 		5 8 2 6.4 56 ZeroCERT

8093 2021-05-18 09:19 file4.exe  

3795c43b2e06e15edb01a8a237243b08


AgentTesla PWS Loki[b] Loki[m] AsyncRAT backdoor .NET framework BitCoin browser info stealer Google Chrome User Data DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Code injection Http API Internet API Steal cr VirusTotal Malware AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder WriteConsoleW IP Check Tofsee Windows ComputerName DNS crashed 		16 9 3 3 12.6 M 24 ZeroCERT

8094 2021-05-18 09:23 toolspab2.exe  

eb3585c3f3e6b3b7ac66c9a41724534b


Glupteba PE File OS Processor Check PE32 PDB unpack itself Windows Remote Code Execution DNS crashed 		1 2.4 ZeroCERT

8095 2021-05-18 09:24 app.exe  

49dd88ce21471d18eb1048358a37ab98


Glupteba PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself Windows Remote Code Execution crashed 		3.0 24 ZeroCERT

8096 2021-05-18 09:27 customer2.exe  

6d7603e4fd4d633cae7eaee0f1029a17


Gen2 Emotet PE File OS Processor Check PE32 Browser Info Stealer VirusTotal Malware PDB Malicious Traffic Check memory Creates executable files Check virtual network interfaces AppData folder IP Check Tofsee Browser Remote Code Execution 		4 6 2 6.4 M 59 ZeroCERT

8097 2021-05-18 09:28 Setup2.exe  

46fcb8a8f7db4f6e098f1213b1955498


Gen2 Emotet Glupteba VMProtect PE File PE32 DLL GIF Format OS Processor Check Browser Info Stealer VirusTotal Malware suspicious privilege MachineGuid Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files unpack itself Check virtual network interfaces AppData folder AntiVM_Disk sandbox evasion IP Check VM Disk Size Check installed browsers check Tofsee Windows Browser ComputerName DNS crashed 		7 13 3 12.6 47 ZeroCERT

8098 2021-05-18 09:38 Optimize.facebook.ads.exe  

a5292f2ae50ae5ca63dd1ae659548c28


PE File OS Processor Check PE32 VirusTotal Malware Check memory unpack itself crashed 		2.4 35 ZeroCERT

8099 2021-05-18 09:38 Trinity-Miner_1.exe  

3db9825a26cbb1f4bffd62194c5c52cc


AsyncRAT backdoor .NET EXE PE File OS Processor Check PE32 PE64 VirusTotal Cryptocurrency Miner Malware Cryptocurrency AutoRuns PDB Check memory Checks debugger Creates executable files unpack itself Auto service Check virtual network interfaces Windows ComputerName Firmware DNS 		2 6.6 M 49 ZeroCERT

8100 2021-05-18 09:55 diagram-553418662.xls  

62c064e08d3aef1d97e64068583345d1


MSOffice File Check memory unpack itself Tofsee crashed 		2 2 2 2.0 guest

keyword