popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
10141 2021-07-16 09:33 https://popcash.net/world/go/1...  

9177aeda6aa16261cf62756b9a50b95a


AntiDebug AntiVM PNG Format MSOffice File Code Injection Creates executable files ICMP traffic RWX flags setting exploit crash unpack itself Windows utilities Windows Exploit DNS crashed 		11 14 5.0 M guest

10142 2021-07-16 09:39 Receipt-75163487.xls  

9d35e17421e9a1c8458f32cd813bd27f


VBA_macro MSOffice File PE File PE32 VirusTotal Malware Check memory buffers extracted Creates executable files unpack itself suspicious process Windows DNS crashed 		1 2 5.6 M 21 ZeroCERT

10143 2021-07-16 09:42 updatetes.exe  

d541621eadca1e9da55cc595105cad28


UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself 		2.2 M 28 ZeroCERT

10144 2021-07-16 09:42 old.exe  

2162abcdcff5c40d0b0e63362e9707a8


RAT Generic Malware Admin Tool (Sysinternals etc ...) AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows Cryptographic key 		7.8 M 28 ZeroCERT

10145 2021-07-16 09:42 bDUIsdMCKmDB.exe  

a124473e6a614597adda867481e0aecc


PWS .NET framework RAT BitCoin Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Collect installed applications Check virtual network interfaces installed browsers check Windows Browser ComputerName Cryptographic key Software crashed 		2 4 11.8 M 47 ZeroCERT

10146 2021-07-16 09:44 Сотрудники с офисным режимом р...  

7fbbb25fbfc322167f51becfa7a130a2


VBA_macro UPX PE File OS Processor Check PE32 DLL VirusTotal Malware Check memory unpack itself AppData folder crashed 		3.4 29 ZeroCERT

10147 2021-07-16 09:45 old-0.exe  

e8f26456b49ff95faa5380c5ad029ddf


RAT Generic Malware Admin Tool (Sysinternals etc ...) AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows Cryptographic key 		4 6 4 9.2 M 28 ZeroCERT

10148 2021-07-16 09:47 Invoice%2088468724%20from%20Qu...  

cf7f5baa644f2ab2cc64e58b95b667ca


VBA_macro MSOffice File PE File PE32 VirusTotal Malware Check memory buffers extracted Creates executable files unpack itself suspicious process Windows crashed 		2 4.6 M 21 ZeroCERT

10149 2021-07-16 09:49 dllhost.exe  

63f22ce2d1aef6fd06cf8d8ccdd7b402


RAT Generic Malware Admin Tool (Sysinternals etc ...) PE File PE32 .NET EXE VirusTotal Malware Check memory Checks debugger unpack itself 		1.6 M 22 ZeroCERT

10150 2021-07-16 09:54 details.bin  

3c21cccff5c8aabf1977f2dbdaeaafe7


Malicious Packer PE File PE32 VirusTotal Malware PDB Windows crashed 		3.2 M 48 r0d

10151 2021-07-16 10:41 cojbhg.msi  

aae9d6c552101a930cf602166acaf863


RAT Generic Malware MSOffice File VirusTotal Malware suspicious privilege Check memory Checks debugger unpack itself AntiVM_Disk VM Disk Size Check ComputerName 		6 2 6 2.6 M 7 ZeroCERT

10152 2021-07-16 10:43 Сотрудники с офисным режимом р...  

7fbbb25fbfc322167f51becfa7a130a2


VBA_macro UPX PE File OS Processor Check PE32 DLL VirusTotal Malware RWX flags setting unpack itself AppData folder crashed 		3.6 29 ZeroCERT

10153 2021-07-16 13:31 7t4dfgnmkk7.exe  

270c3859591599642bd15167765246e3


Ficker Stealer UPX PE File PE32 Browser Info Stealer Malware download FTP Client Info Stealer VirusTotal Malware Cryptocurrency wallets Cryptocurrency MachineGuid Check memory ICMP traffic Collect installed applications sandbox evasion anti-virtualization IP Check installed browsers check Ransomware Stealer Browser ComputerName Software 		1 4 3 8.8 M 61 ZeroCERT

10154 2021-07-16 13:34 prescribe .07.21.doc  

843f6c0c24bfc31b6a19471935a092da


AntiDebug AntiVM Vulnerability VirusTotal Malware Code Injection Check memory RWX flags setting unpack itself suspicious process Interception 		1 2 6.4 8 ZeroCERT

10155 2021-07-16 13:35 boxDelInd.hta  

b78d223c21397820b567ed288e87a190

VirusTotal Malware Check memory RWX flags setting unpack itself suspicious process Interception 		1 2 2.8 5 ZeroCERT

keyword