popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
8866 2023-09-06 16:55 gusan.exe  

2bd43c0d8154511c0e587f32867b64e2


Malicious Library UPX AntiDebug AntiVM OS Processor Check PE File PE32 DLL VirusTotal Malware PDB Code Injection RWX flags setting unpack itself suspicious process AppData folder Remote Code Execution 		4.4 54 ZeroCERT

8867 2023-09-06 16:05 2cfa8e8aaadb6372a5cad4814785bb...  

a51fb67b5c13bb54aeb6126c2cadc61b


Generic Malware Malicious Library UPX Malicious Packer PE File PE32 VirusTotal Malware AutoRuns Creates executable files Windows Remote Code Execution DNS 		2 4.4 65 guest

8868 2023-09-06 14:14 WWW14_n.exe  

e8e7a7c1a9b0aba35338c2de4d4bd0af


PrivateLoader Amadey RedLine Infostealer RedLine stealer Generic Malware Malicious Library UPX VMProtect .NET framework(MSIL) Confuser .NET Malicious Packer PWS SMTP AntiDebug AntiVM PE File PE64 OS Processor Check PE32 .NET EXE DLL wget Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer VirusTotal Malware Microsoft Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files RWX flags setting unpack itself Windows utilities Disables Windows Security Checks Bios Collect installed applications Check virtual network interfaces suspicious process AppData folder sandbox evasion WriteConsoleW anti-virtualization IP Check installed browsers check PrivateLoader Tofsee Stealer Windows Browser ComputerName Remote Code Execution DNS Cryptographic key Software crashed 		24 42 27 13 24.4 M 44 ZeroCERT

8869 2023-09-06 14:03 setup_pass.7z  

1860765426cb420e321b2511a3c2652d


PrivateLoader Escalate priviledges PWS KeyLogger AntiDebug AntiVM RedLine Malware download Malware Microsoft suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself suspicious TLD IP Check PrivateLoader Tofsee Stealer Windows Discord RisePro Trojan DNS Downloader 		35 68 34 16 5.0 M ZeroCERT

8870 2023-09-06 09:54 http://bag.itunes.apple.com  


Downloader Create Service Socket P2P DGA Steal credential Http API Escalate priviledges PWS Hijack Network Sniff Audio HTTP DNS ScreenShot Code injection Internet API persistence FTP KeyLogger AntiDebug AntiVM PNG Format MSOffice File JPEG Format Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		1 2 3 4.8 guest

8871 2023-09-06 09:52 .ACTIVATED.txt.ps1  

a11d9710bf81fe62ed4ff6c69636c5ad


Generic Malware Antivirus VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut Creates executable files unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		2 2 1 9.4 M 16 ZeroCERT

8872 2023-09-06 09:51 drumbod.vbs  

74a00f5a6e6e6bcc963663701807acdc


Generic Malware Antivirus Hide_URL PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		3 3 1 9.0 M 3 ZeroCERT

8873 2023-09-06 09:50 .ACTIVATED.txt.ps1  

52c1304716cc38ab39a67edd91fe67b5


Generic Malware Antivirus VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut Creates executable files unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		2 2 1 10.0 M 11 ZeroCERT

8874 2023-09-06 09:49 odumodu.vbs  

5094e3280f7ed666d18eb0147d7eb956


Generic Malware Antivirus Hide_URL PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		3 3 1 9.0 M 8 ZeroCERT

8875 2023-09-06 09:48 four.vbs  

6a5cd526ba942ae59c401d41fec11d86


Generic Malware Antivirus Hide_URL PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		3 3 1 8.4 3 ZeroCERT

8876 2023-09-06 09:47 ofertaprezi.pdf  

736f8c7459170ca6818e5ca06c440711


PDF 		ZeroCERT

8877 2023-09-06 09:47 sicilyzx.exe  

a2937fddd1379478133891a580f8fb53


.NET framework(MSIL) PWS KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Telegram PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Tofsee Browser Email ComputerName DNS Software crashed 		2 4 9.6 13 ZeroCERT

8878 2023-09-06 09:45 .ACTIVATED.txt.ps1  

63e6f6e9b68f39153e5651094fabb3b0


Generic Malware Antivirus VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut Creates executable files unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		2 2 1 10.0 15 ZeroCERT

8879 2023-09-06 07:51 calc2.exe  

3b17576498da3c209ab711888ef5c66a


Malicious Library PE File PE32 VirusTotal Malware PDB DNS 		1 2.4 M 41 ZeroCERT

8880 2023-09-06 07:49 calc2.exe  

b83c9bd78a155d87c4322ce35cbc24ba


Malicious Library PE File PE32 VirusTotal Malware PDB DNS 		2 3.2 M 32 ZeroCERT

keyword