popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
9946 2023-07-28 10:30 ChromeSetup.exe  

6f9433489c234b56f12a5e807ad4bfcb


UPX Malicious Library PE File PE32 DLL VirusTotal Malware Check memory Creates executable files unpack itself AppData folder 		2.4 M 27 ZeroCERT

9947 2023-07-28 10:29 ChromeSetup.exe  

00de3f6450d30cbd9f268eb62eee33ab


AgentTesla Generic Malware Antivirus PWS SMTP KeyLogger AntiDebug AntiVM .NET EXE PE File PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware powershell AutoRuns PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName Cryptographic key Software crashed 		2 2 15.6 M 28 ZeroCERT

9948 2023-07-28 10:29 secbobbyzx.doc  

50a7ad2ace11903c9d16a6c8660631de


MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware RWX flags setting exploit crash Exploit crashed 		3.0 M 29 ZeroCERT

9949 2023-07-28 10:26 secbobbyzx.exe  

b05e3ab4699177f4dcad8e34ceda8efb


Confuser .NET .NET EXE PE File PE32 VirusTotal Malware PDB Check memory Checks debugger unpack itself Check virtual network interfaces Tofsee ComputerName DNS 		1 3 5 3.4 M 27 ZeroCERT

9950 2023-07-28 10:26 dhvedok.exe  

f0f5e6f32198fa1837b3090b7fd71fbb


HermeticWiper UPX Malicious Library MZP Format PE File PE32 VirusTotal Malware unpack itself 		2.2 M 47 ZeroCERT

9951 2023-07-28 10:24 156.exe  

7a27d073c224d7f811999469d13c18ab


UPX Malicious Library OS Processor Check PE File PE32 VirusTotal Malware unpack itself Remote Code Execution 		2.0 M 35 ZeroCERT

9952 2023-07-28 10:24 156.exe  

7a27d073c224d7f811999469d13c18ab


UPX Malicious Library OS Processor Check PE File PE32 VirusTotal Malware unpack itself Remote Code Execution 		2.0 M 35 ZeroCERT

9953 2023-07-27 11:51 Zqbpytwp.exe  

f369250db766a9469a786daf30c43d97


UPX Socket Http API Escalate priviledges HTTP Internet API AntiDebug AntiVM OS Processor Check .NET EXE PE File PE32 Browser Info Stealer Malware download VirusTotal Malware Buffer PE AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic unpack itself Windows utilities Check virtual network interfaces suspicious process malicious URLs AntiVM_Disk sandbox evasion WriteConsoleW Ransom Message Turn off Windows Error Recovery notification window IP Check VM Disk Size Check installed browsers check Tofsee Ransomware Windows Browser Tor ComputerName Trojan Banking DNS Cryptographic key 		3 5 5 1 24.0 M 27 ZeroCERT

9954 2023-07-27 10:45 buildqwer.exe  

e668ac854e5cdedfc7c2d194f9845614


Browser Login Data Stealer UPX Malicious Library ASPack OS Processor Check PE File PE32 DLL Browser Info Stealer VirusTotal Malware Malicious Traffic Check memory Creates executable files unpack itself AppData folder Browser DNS 		1 1 1 4.2 M 18 ZeroCERT

9955 2023-07-27 10:40 an.exe  

691a54b032d616e5f9303557ffd49add


Gen1 Emotet UPX Malicious Library CAB PE64 PE File .NET EXE PE32 VirusTotal Malware AutoRuns PDB Check memory Checks debugger Creates executable files unpack itself Check virtual network interfaces AppData folder Tofsee Windows Remote Code Execution Cryptographic key 		2 2 5.4 M 11 ZeroCERT

9956 2023-07-27 10:38 calc2.exe  

aa936f35ba4f0386a975a3a65d992048


Malicious Library PE File PE32 VirusTotal Malware PDB 		2.0 30 ZeroCERT

9957 2023-07-27 10:36 foto5566.exe  

310049edb1a276ebf198060d9cd3bc5d


Gen1 Emotet Amadey UPX Malicious Library Admin Tool (Sysinternals etc ...) Malicious Packer CAB PE File PE32 OS Processor Check DLL Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer Malware Microsoft AutoRuns PDB suspicious privilege MachineGuid Malicious Traffic Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities Disables Windows Security Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Stealer Windows Update Browser ComputerName Remote Code Execution DNS Cryptographic key Software crashed 		1 2 11 1 15.6 M ZeroCERT

9958 2023-07-27 10:34 foto5566.exe  

1608f0e5d9b277a7ba7fb25f736b8c74


Gen1 Emotet Amadey UPX Malicious Library Admin Tool (Sysinternals etc ...) Malicious Packer CAB PE File PE32 OS Processor Check DLL Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer Malware Microsoft AutoRuns PDB suspicious privilege MachineGuid Malicious Traffic Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities Disables Windows Security Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Stealer Windows Update Browser ComputerName Remote Code Execution DNS Cryptographic key Software crashed 		1 2 11 1 15.6 M ZeroCERT

9959 2023-07-27 10:32 fotod250.exe  

afed523b82c39015e5e8eb6f55906537


Gen1 Emotet Amadey UPX Malicious Library Admin Tool (Sysinternals etc ...) Malicious Packer CAB PE File PE32 OS Processor Check DLL Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer Malware Microsoft AutoRuns PDB suspicious privilege MachineGuid Malicious Traffic Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities Disables Windows Security Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Stealer Windows Update Browser ComputerName Remote Code Execution DNS Cryptographic key Software crashed 		1 2 12 1 15.6 M ZeroCERT

9960 2023-07-27 10:30 photo340.exe  

f0c28816a58f907591e5e014e049024a


Gen1 Emotet Amadey UPX Malicious Library Admin Tool (Sysinternals etc ...) Malicious Packer CAB PE File PE32 OS Processor Check DLL .NET EXE PE64 Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer Malware Microsoft AutoRuns PDB suspicious privilege Malicious Traffic Check memory Checks debugger WMI Creates executable files RWX flags setting unpack itself Windows utilities Disables Windows Security Collect installed applications Check virtual network interfaces suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Kelihos Tofsee Stealer Windows Update Browser ComputerName Remote Code Execution DNS Cryptographic key Software crashed Downloader 		5 7 19 1 17.6 M ZeroCERT

keyword