popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
8956 2021-06-17 10:18 f7juhkryu4.exe  

270c3859591599642bd15167765246e3


Ficker Stealer PE File PE32 VirusTotal Malware 		1.6 M 55 guest

8957 2021-06-17 10:50 Document 2519711.xls  

c64202fc6e89fc1c49cde536894ed99d


VBA_macro MSOffice File VirusTotal Malware 		0.8 M 21 ZeroCERT

8958 2021-06-17 10:52 Document 2519711.xls  

c64202fc6e89fc1c49cde536894ed99d


VBA_macro MSOffice File VirusTotal Malware 		0.8 M 21 ZeroCERT

8959 2021-06-17 10:55 Document 2519711.xls  

c64202fc6e89fc1c49cde536894ed99d


VBA_macro MSOffice File VirusTotal Malware 		0.8 M 21 ZeroCERT

8960 2021-06-17 11:16 Document 2519711.xls  

c64202fc6e89fc1c49cde536894ed99d


VBA_macro MSOffice File VirusTotal Malware 		0.8 M 21 ZeroCERT

8961 2021-06-17 11:43 lv.exe  

dba9d5c211d728da4b92e0064a445ecd


PE File PE32 VirusTotal Malware 		1.4 M 56 ZeroCERT

8962 2021-06-17 12:05 Document 2519711.xls  

c64202fc6e89fc1c49cde536894ed99d


VBA_macro MSOffice File VirusTotal Malware Malicious Traffic Checks debugger RWX flags setting unpack itself Tofsee ComputerName DNS 		2 11 2 7.2 M 21 guest

8963 2021-06-17 12:15 https://www.naver.com/  

1838b2eea5a23e5c20d4cf6a7fc3b9b3


AgentTesla DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Hijack Network Code injection Http API Internet API Steal credential ScreenShot Downloader P2P persistence AntiDebug AntiVM PNG Format JPEG Format MSOffice File Code Injection Creates executable files RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		167 18 2 4.6 guest

8964 2021-06-17 13:20 jgfz.jpg  

51c10802ed8cbcb4850a602c43b691ec


PE File PE32 VirusTotal Malware DNS 		2.6 M 18 ZeroCERT

8965 2021-06-17 13:22 file.exe  

09634fc320a841c03969036e6b348a2f


Raccoon Stealer PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself Windows DNS crashed 		3.2 M 28 ZeroCERT

8966 2021-06-17 13:24 hope.exe  

d43338c66b34e2d4e15b090aeb58401c


Emotet Antivirus PE File PE32 VirusTotal Malware Check memory RWX flags setting unpack itself suspicious process WriteConsoleW Interception ComputerName Remote Code Execution DNS crashed 		5.0 M 51 ZeroCERT

8967 2021-06-17 13:28 lv.exe  

643ac999a87cb24d6e1362e1112a9ae7


Emotet Gen1 Raccoon Stealer Gen2 Malicious Library DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Hijack Network Code injection Http API Internet API Steal credential ScreenShot Downloader P2P persistence AntiDebug AntiV VirusTotal Malware Code Injection Check memory Checks debugger Creates executable files unpack itself Windows utilities suspicious process AppData folder malicious URLs AntiVM_Disk WriteConsoleW VM Disk Size Check Windows DNS crashed 		1 8.0 M 34 ZeroCERT

8968 2021-06-17 13:34 https://www.naver.com/  

a1083e2e3bdef28aab0e42c012744d01


Http API Internet API ScreenShot DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Hijack Network Code injection Steal credential Downloader P2P persistence AntiDebug AntiVM JPEG Format PNG Format MSOffice File Code Injection Creates executable files RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		173 18 2 4.6 r0d

8969 2021-06-17 13:35 Document%2076896654.xls  

608d89a9afafdce353965d9ee16bd433


VBA_macro MSOffice File VirusTotal Malware Check memory unpack itself Tofsee DNS crashed 		10 19 4 5.8 M 19 ZeroCERT

8970 2021-06-17 13:35 win32.exe  

983ddc2bc9503302e5ca3ff855d21763


PWS Loki[b] Loki[m] .NET framework Admin Tool (Sysinternals etc ...) Malicious Library DNS Socket AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Buffer PE PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Windows Browser Email ComputerName DNS Cryptographic key Software 		2 1 14.2 M 33 ZeroCERT

keyword