popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
9136 2023-11-04 10:30 주요도시 시장가격 조사2023.xlsx.lnk...  

d1dc2db2956803de7eef7a76a6ac5cb2


Generic Malware Downloader Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Sniff Audio HTTP DNS Code injection Internet API FTP KeyLogger P2P AntiDebug AntiVM Lnk Format GIF Format PowerShell ZIP Format Vulnerability VirusTotal Malware powershell suspicious privilege MachineGuid Code Injection Check memory Checks debugger Creates shortcut Creates executable files unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		9.0 24 ZeroCERT

9137 2023-11-04 10:26 Kuteiisd.exe  

0bb98a8a1597245e3c0c37fbf2c0f94b


Hide_EXE PE File PE64 VirusTotal Malware Check memory Checks debugger unpack itself 		2.0 41 ZeroCERT

9138 2023-11-03 18:29 Amadey.exe  

5d0310efbb0ea7ead8624b0335b21b7b


Amadey RedLine stealer Browser Login Data Stealer RedlineStealer RedLine Infostealer Gen1 Emotet Generic Malware Hide_EXE Malicious Library UPX Malicious Packer .NET framework(MSIL) ScreenShot PWS Anti_VM Javascript_B Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency Microsoft AutoRuns PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files RWX flags setting unpack itself Windows utilities Disables Windows Security Collect installed applications Check virtual network interfaces suspicious process AppData folder AntiVM_Disk sandbox evasion WriteConsoleW IP Check VM Disk Size Check human activity check installed browsers check Kelihos Tofsee Stealc Stealer Windows Update Browser ComputerName Trojan DNS Cryptographic key Software crashed Downloader 		65 41 26 8 25.8 M ZeroCERT

9139 2023-11-03 18:20 timeSync.exe  

c5413f26ad9d6a74ed7e649f8001da14


Malicious Library UPX PE File PE32 OS Processor Check unpack itself 		0.8 ZeroCERT

9140 2023-11-03 18:18 macoptic2.1.exe  

d6c5df23371399eb60055b93d7b80ea7


NSIS Malicious Library UPX PE File PE32 OS Processor Check Check memory Creates executable files unpack itself AppData folder crashed 		3.2 ZeroCERT

9141 2023-11-03 18:18 jujoptics2.1.exe  

0c57a7aae080fd2eac42a31fa5b7f051


NSIS Malicious Library UPX PE File PE32 FormBook Malware download Malware suspicious privilege Malicious Traffic Check memory Creates executable files unpack itself DNS 		2 8 1 4.0 ZeroCERT

9142 2023-11-03 18:16 IGCC.exe  

3e00f6658bc36989fe775244acce3cd0


LokiBot PWS SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Browser Email ComputerName DNS Software crashed 		2 4 9.4 ZeroCERT

9143 2023-11-03 18:16 latestrock.exe  

0bddfbdc76418c7fc877a5a11013dfee


Generic Malware NSIS Malicious Library UPX Antivirus Malicious Packer Admin Tool (Sysinternals etc ...) Anti_VM AntiDebug AntiVM PE File PE32 .NET EXE PNG Format OS Processor Check ZIP Format JPEG Format BMP Format CHM Format DLL icon PE64 CAB MZP Format Malware Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Check virtual network interfaces AppData folder AntiVM_Disk VM Disk Size Check Tofsee Ransomware DNS 		2 4 11.0 ZeroCERT

9144 2023-11-03 18:13 nelfbinzx.exe  

64e25a4134d33448d33c5d0d250394d6


PE File PE32 .NET EXE PDB Check memory Checks debugger unpack itself 		1.4 ZeroCERT

9145 2023-11-03 18:12 sistem32.jpg  

06cbe7e4119ca545f6420e7b4100e3d2


Admin Tool (Sysinternals etc ...) Malicious Library UPX AntiDebug AntiVM PE File PE32 .NET EXE DLL OS Processor Check PDB Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself AppData folder Windows ComputerName DNS Cryptographic key DDNS crashed 		2 1 9.6 ZeroCERT

9146 2023-11-03 18:11 cuzineeeeVBS_FILE.vbs  

6e50413706aceea089f8a8c4f2d44ec6


Generic Malware Antivirus PowerShell powershell suspicious privilege Check memory Checks debugger buffers extracted wscript.exe payload download Creates shortcut unpack itself Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName Cryptographic key 		4 5 2 8.6 ZeroCERT

9147 2023-11-03 18:06 new_image.jpg.exe  

6dab97885e747392758ea655733f6c35


Generic Malware Antivirus .NET DLL PE File DLL PE32 PDB 		0.6 ZeroCERT

9148 2023-11-03 17:44 0j.ps1  

034c1dc569ea0a5b13330c759a10df8d


Generic Malware Antivirus unpack itself WriteConsoleW Windows Cryptographic key 		1 0.8 ZeroCERT

9149 2023-11-03 17:38 setup.rar  

d7b36686b22ecf8da8c34bf6d55ad331


Escalate priviledges PWS KeyLogger AntiDebug AntiVM Malware download Malware suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself PrivateLoader Tofsee DNS 		2 7 2 1 4.8 M ZeroCERT

9150 2023-11-03 15:54 1.exe  

1819332f150048eed72a2d891390dad1


Emotet Generic Malware Malicious Library UPX Malicious Packer PE File PE32 OS Processor Check DLL PE64 DllRegisterServer dll MSOffice File CAB Malware AutoRuns PDB suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files ICMP traffic unpack itself Windows utilities Check virtual network interfaces sandbox evasion Tofsee Ransomware Windows Google ComputerName Remote Code Execution DNS 		4 27 4 8.4 ZeroCERT

keyword