popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
8416 2023-12-14 11:07 미신고 자금출처명세서(부가가치세법 시행규칙).hwp.l...  

ceb4847592b0b9ddc2b9c239fa48c471


Generic Malware Malicious Library Antivirus AntiDebug AntiVM Lnk Format GIF Format PowerShell PE32 PE File CAB MSOffice File HWP Malware download VirusTotal Malware Campaign powershell AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger WMI heapspray Creates shortcut Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AntiVM_Disk WriteConsoleW VM Disk Size Check Konni Windows ComputerName Cryptographic key 		2 2 1 14.0 11 ZeroCERT

8417 2023-12-14 11:06 Statement of undeclared funds ...  

ceb4847592b0b9ddc2b9c239fa48c471


Generic Malware Malicious Library Antivirus AntiDebug AntiVM Lnk Format GIF Format PowerShell PE32 PE File MSOffice File HWP CAB Malware download VirusTotal Malware Campaign powershell AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger WMI heapspray Creates shortcut Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AntiVM_Disk WriteConsoleW VM Disk Size Check Konni Windows ComputerName Cryptographic key 		2 2 1 14.6 11 ZeroCERT

8418 2023-12-14 11:00 481-5412-09.pdf .cmd  

0ebda52c2e35dd7d3088b5364a4583fd


Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM PowerShell VirusTotal Malware powershell AutoRuns suspicious privilege Check memory Checks debugger Creates shortcut Creates executable files unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW Windows ComputerName DNS Cryptographic key 		2 1 1 1 10.0 21 ZeroCERT

8419 2023-12-14 10:53 0.26620849638416144.dat.dll  

61c58c2bebffb3b3590f24675721fa5b


Malicious Library UPX PE32 PE File DLL MZP Format VirusTotal Malware 		2.0 33 ZeroCERT

8420 2023-12-14 10:47 Pikabot.dll  

61c58c2bebffb3b3590f24675721fa5b


Malicious Library UPX PE32 PE File DLL MZP Format VirusTotal Malware 		1.8 28 ZeroCERT

8421 2023-12-14 10:29 ORDER-231211.Xls.js  

516442412f0c621f39abd64b645f587c

VirusTotal Malware VBScript wscript.exe payload download Tofsee Dropper 		1 2 2 10.0 22 ZeroCERT

8422 2023-12-14 10:28 ORDER-232111.pdf.js  

ad919f29a6186c40a5bcb76d18803bfb

VirusTotal Malware VBScript wscript.exe payload download Tofsee Dropper 		1 2 2 10.0 24 ZeroCERT

8423 2023-12-14 10:28 ORDER-232112.pdf.js  

ad919f29a6186c40a5bcb76d18803bfb

VirusTotal Malware VBScript wscript.exe payload download Tofsee Dropper 		1 2 2 10.0 24 ZeroCERT

8424 2023-12-14 10:17 wp.vbs  

4d09dbc70709eb2790c491dc476d508b

Malware download Wshrat NetWireRC VirusTotal Malware VBScript AutoRuns WMI wscript.exe payload download AntiVM_Disk VM Disk Size Check Windows Houdini ComputerName DNS DDNS Dropper 		2 2 6 2 10.0 M 29 ZeroCERT

8425 2023-12-14 10:16 ORDER-2320884.jar  

c2cfe1bc4cc6ec14cd510cd4ac40d6f5


Antivirus Malicious Library UPX MSOffice File ZIP Format PE32 PE File DLL OS Processor Check VirusTotal Malware AutoRuns Check memory buffers extracted Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder WriteConsoleW Windows Java ComputerName DNS DDNS crashed 		8 2 7.6 21 ZeroCERT

8426 2023-12-14 10:15 POA35BT56TT.bat  

5409f23480db5358d2cc2417f2c41494


Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM PowerShell ZIP Format VirusTotal Malware powershell AutoRuns suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files RWX flags setting unpack itself Windows utilities Check virtual network interfaces suspicious process WriteConsoleW Windows ComputerName DNS Cryptographic key crashed 		2 5 12.4 M 2 ZeroCERT

8427 2023-12-14 10:15 Payment_Slip.jar  

39396afaa066833586662903487761f2


Antivirus MSOffice File VirusTotal Malware Check memory heapspray unpack itself Java 		2.4 M 20 ZeroCERT

8428 2023-12-14 08:08 021983908713.exe  

5553b09479b6bb61784ac90f9089d889


PE File PE64 VirusTotal Malware DNS 		1 3.0 M 61 ZeroCERT

8429 2023-12-14 08:07 file.exe  

db9836afc44b9a8fd086abd3e882524e


Amadey Downloader Admin Tool (Sysinternals etc ...) .NET framework(MSIL) UPX MPRESS Malicious Library Http API ScreenShot Create Service Socket DGA Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API pe Browser Info Stealer Malware download Amadey FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency Buffer PE AutoRuns PDB MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files RWX flags setting unpack itself Windows utilities Checks Bios Collect installed applications Detects VirtualBox Detects VMWare suspicious process AppData folder suspicious TLD sandbox evasion WriteConsoleW VMware anti-virtualization installed browsers check Ransomware Lumma Stealer Windows Browser Email ComputerName Firmware DNS Cryptographic key Software crashed Downloader 		4 4 12 2 25.6 M 47 ZeroCERT

8430 2023-12-14 08:06 artifact.exe  

a9cd040f3de100f802ccbce93bebd7a3


Malicious Library PE32 PE File Malware download Cobalt Strike Cobalt VirusTotal Malware Malicious Traffic RWX flags setting unpack itself ComputerName DNS 		2 1 1 4.6 M 61 ZeroCERT

keyword