popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
9916 2021-07-12 13:32 Jople.exe  

0ed8664e0ae8bb176b6d0fc0251b608e


PWS .NET framework RAT Generic Malware Antivirus Anti_VM PE File PE32 .NET EXE OS Processor Check Browser Info Stealer VirusTotal Malware suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted RWX flags setting unpack itself Checks Bios Collect installed applications Detects VirtualBox Detects VMWare Check virtual network interfaces VMware anti-virtualization installed browsers check Windows Browser ComputerName Firmware DNS Cryptographic key crashed 		2 3 11.2 44 ZeroCERT

9917 2021-07-12 14:19 Nwaba Loader.exe  

83414529ad68ade52a9ce9ffae635c03


PWS .NET framework RAT Generic Malware PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege MachineGuid Malicious Traffic Check memory Checks debugger unpack itself Windows utilities Check virtual network interfaces AntiVM_Disk IP Check VM Disk Size Check Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed 		2 6 9.2 47 Kim.GS

9918 2021-07-12 15:25 app.exe  

7b7bcf7dc5d1f4d0ea8f9c5d6a1b5868


PWS .NET framework Generic Malware PE64 PE File .NET EXE PE32 VirusTotal Malware suspicious privilege MachineGuid Check memory Checks debugger Creates executable files unpack itself Windows utilities suspicious process AppData folder sandbox evasion Windows Cryptographic key 		6.0 37 r0d

9919 2021-07-12 15:26 크랙에픽.exe  

c491ceca4e45cfdc1750165291184542


PWS .NET framework RAT Generic Malware PE64 PE File VirusTotal Malware PDB Check memory Checks debugger unpack itself 		1.8 2 guest

9920 2021-07-12 17:51 AllGHCw6cF3MYVSkUrB.jpg.ps1  

c8f2d014ff0529059a6c2d926aebd221


Antivirus VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut Creates executable files unpack itself Check virtual network interfaces suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		1 2 9.2 9 ZeroCERT

9921 2021-07-12 17:53 pktU9LoKSDqhtovq.jpg.ps1  

ddf9445e77f1986432ef45aa96668fee


Antivirus AntiDebug AntiVM VirusTotal Malware Code Injection Check memory buffers extracted unpack itself WriteConsoleW DNS DDNS 		2 8.6 3 ZeroCERT

9922 2021-07-12 17:56 Y4maQsKxdyy0hVxk.jpg.ps1  

526985f2ac9ccb243a78a8512a7c19e6


Antivirus powershell Check memory Creates shortcut unpack itself Check virtual network interfaces WriteConsoleW Windows ComputerName Cryptographic key 		3 2 5.2 ZeroCERT

9923 2021-07-12 18:00 LzWZ0w70pWJ95p9s.jpg.ps1  

b519cbc7b8fc2b686b5e469d48472540


Antivirus powershell Check memory Creates shortcut unpack itself Check virtual network interfaces WriteConsoleW Windows ComputerName Cryptographic key 		3 2 5.2 ZeroCERT

9924 2021-07-12 18:02 VNPhone.exe  

fca673821522a3329ad3ab6308cf9692


Generic Malware UPX PE File PE32 PNG Format DLL VirusTotal Malware Malicious Traffic Check memory WMI Creates executable files ICMP traffic unpack itself AppData folder AntiVM_Disk VM Disk Size Check ComputerName 		4 2 6.2 26 ZeroCERT

9925 2021-07-12 18:02 wininit.exe  

a954aade1438f60c08c42beb485199a9


PWS Loki[b] Loki[m] .NET framework Generic Malware Admin Tool (Sysinternals etc ...) DNS Socket AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Windows Browser Email ComputerName DNS Cryptographic key Software crashed 		1 1 1 14.6 M 22 ZeroCERT

9926 2021-07-12 18:03 vbc.exe  

41077f68c330f11f487c4c3d405fdc31


Generic Malware Admin Tool (Sysinternals etc ...) PE File PE32 .NET EXE VirusTotal Malware Check memory Checks debugger unpack itself 		2.2 33 ZeroCERT

9927 2021-07-12 18:04 bobs.exe  

1cf7ff77cf4ee7c4f4f6fb3d9bf088f7


PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW Windows ComputerName Cryptographic key crashed 		11.0 23 ZeroCERT

9928 2021-07-12 18:07 Ops Afg post 9-11.doc  

9100c65e4ed1ccf2fd148a70ff21c97f

VirusTotal Malware unpack itself 		3 2 2.4 4 ZeroCERT

9929 2021-07-12 18:07 .wininit.exe  

b650c785537ad966290b270adfe56611


PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows Cryptographic key 		22 16 6 9.4 18 ZeroCERT

9930 2021-07-13 07:32 http://192.227.158.111/fud.js  

c140a58ffaf225f718f458f7f3d5fb0c


DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Code injection Http API Internet API Steal credential ScreenShot Downloader P2P persistence AntiDebug AntiVM VirusTotal Malware unpack itself malicious URLs crashed 		2.4 6 ZeroCERT

keyword