popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
8701 2021-06-08 20:13 http://regalosfreaks.blogspot....  

d808b4bbb918207dd54b242b2339afec


AgentTesla CoinHive Cryptocurrency Http API Internet API ScreenShot DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Hijack Network Code injection Steal credential Downloader P2P persistence AntiDebug AntiVM PNG Format JPE VirusTotal Malware Code Injection heapspray Creates executable files RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		86 53 3 5.6 guest

8702 2021-06-08 20:15 m.dot  

0f666fec8607488ee6f78afd2a0ff4d4


RTF File doc AntiDebug AntiVM Malware download VirusTotal Malware MachineGuid Malicious Traffic exploit crash unpack itself Windows Exploit DNS crashed Downloader 		1 1 6 4.6 27 ZeroCERT

8703 2021-06-08 20:43 vbc.exe  

27f582f69b0ec4fd2366cbf298f38dee


Admin Tool (Sysinternals Devolutions inc) Malicious Library AntiDebug AntiVM PE File .NET EXE PE32 PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows Cryptographic key 		6.8 ZeroCERT

8704 2021-06-09 09:54 al.exe  

20f307c716a689f4afa3a76b7143db22


NPKI Antivirus PE File PE64 DLL .NET DLL PE32 VirusTotal Malware powershell suspicious privilege MachineGuid Check memory Checks debugger buffers extracted Creates shortcut Creates executable files unpack itself Windows utilities powershell.exe wrote suspicious process AppData folder Windows ComputerName DNS Cryptographic key crashed 		10.4 M 26 ZeroCERT

8705 2021-06-09 09:54 new.exe  

eb43b3c033bd76b51b90a51a6726a81c


DNS AntiDebug AntiVM PE File .NET EXE PE32 Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted WMI unpack itself human activity check Windows ComputerName DNS DDNS crashed 		2 10.8 ZeroCERT

8706 2021-06-09 09:56 binok-098.exe  

56e0119501bf355295603914d3b13519


PWS .NET framework Admin Tool (Sysinternals Devolutions inc) Malicious Library AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows DNS Cryptographic key 		8.2 M 29 ZeroCERT

8707 2021-06-09 09:56 binalpha.exe  

935847d6703bbb36edd123c1f5f60681


Admin Tool (Sysinternals Devolutions inc) Malicious Library AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows DNS Cryptographic key 		1 8.2 M 24 ZeroCERT

8708 2021-06-09 09:58 ewaa.exe  

a805af22c4ea9de2c2c542f21933ab84


PWS .NET framework Malicious Packer SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows Browser Email ComputerName Cryptographic key Software crashed 		11.4 M ZeroCERT

8709 2021-06-09 09:59 lv.exe  

dba9d5c211d728da4b92e0064a445ecd


AgentTesla Gen1 Gen2 Generic Malware Malicious Packer Malicious Library DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Hijack Network Code injection Http API Internet API Steal credential ScreenShot Downloader P2P persis VirusTotal Malware Code Injection Check memory Checks debugger Creates executable files unpack itself Windows utilities suspicious process AppData folder malicious URLs AntiVM_Disk WriteConsoleW VM Disk Size Check Windows DNS crashed 		1 9.0 M 46 ZeroCERT

8710 2021-06-09 10:00 INV202054pdf.jar  

fc43547ad34a9e4c3790e60a49fbc215

VirusTotal Malware Check memory heapspray unpack itself Java 		2.0 M 6 ZeroCERT

8711 2021-06-09 10:02 binalpha-0986.exe  

cdc024aeb6a126fed48f71becc7c8b55


PWS .NET framework Admin Tool (Sysinternals Devolutions inc) Malicious Library PE File .NET EXE PE32 VirusTotal Malware PDB Check memory Checks debugger unpack itself ComputerName 		2.4 M 42 ZeroCERT

8712 2021-06-09 10:04 agreement.pdf  

1c113114ff3e57d99a43e0b2cdd1d952

VirusTotal Malware 		0.4 1 ZeroCERT

8713 2021-06-09 10:05 YsiNqNecL9cNFZv144OWCjioAQukPt...  

c9f22a0091ad275119321e7b036e5633


RTF File doc buffers extracted exploit crash unpack itself Exploit DNS crashed 		3 2 3.2 ZeroCERT

8714 2021-06-09 16:23 Proforma Invoice·pdf.exe  

24dd4963d365c33435f58adaebb1ef26


PE File PE32 DLL Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Malicious Traffic Check memory Creates executable files unpack itself AppData folder AntiVM_Disk sandbox evasion VM Disk Size Check installed browsers check Tofsee Windows Browser Email ComputerName DNS Software crashed 		4 3 10 10.0 17 guest

8715 2021-06-09 16:23 v.dot  

af735bdb2ca442a45fca870ba2c1b082


RTF File doc AntiDebug AntiVM Malware download Malware MachineGuid Malicious Traffic Check memory exploit crash unpack itself Windows Exploit DNS crashed Downloader 		1 2 6 5.0 ZeroCERT

keyword