popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
10201 2021-07-19 10:51 0694b1714768f441a6827c5776da3c...  

7a7c47733423a46f83eab77d230a0e12


Gen2 Gen1 Generic Malware UPX PE File OS Processor Check PE32 DLL VirusTotal Malware MachineGuid Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself AppData folder sandbox evasion IP Check ComputerName 		3 8 1 2 7.6 M 53 ZeroCERT

10202 2021-07-19 10:55 build.exe  

e6bf9a1d8f14d2e1f07976f93dfc554e


PWS Loki[b] Loki[m] AgentTesla Gen1 RedLine Stealer browser info stealer UPX Malicious Packer DGA DNS Socket Http API Internet API ScreenShot AntiDebug AntiVM PE File OS Processor Check PE32 DLL JPEG Format Browser Info Stealer Malware download FTP Client Info Stealer Vidar Arkei Dridex VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency Microsoft AutoRuns PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Collect installed applications suspicious process AppData folder malicious URLs suspicious TLD sandbox evasion WriteConsoleW anti-virtualization installed browsers check Tofsee ArkeiStealer OskiStealer Stealer Windows Browser Email ComputerName DNS Software Password 		10 9 13 4 20.2 M 25 ZeroCERT

10203 2021-07-19 11:00 id27315002.php  

291192d5184d78dc4f49972a092598d8


BitCoin Process Kill Generic Malware UPX FindFirstVolume CryptGenKey AntiDebug AntiVM PE File Device_File_Check OS Processor Check PE32 PNG Format .NET EXE MSOffice File JPEG Format Browser Info Stealer FTP Client Info Stealer VirusTotal Malware Buffer PE suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files RWX flags setting exploit crash unpack itself Windows utilities Collect installed applications Check virtual network interfaces suspicious process AppData folder WriteConsoleW installed browsers check Tofsee Windows Exploit Browser ComputerName DNS Cryptographic key Software crashed 		12 13 7 3 16.6 M 22 ZeroCERT

10204 2021-07-19 11:07 zxcv.EXE  

e0ee46172e94ab9aaed4f27dc2aab72a


PWS Loki[b] Loki[m] .NET framework Gen1 Gen2 Generic Malware UPX Malicious Packer Antivirus DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Code injection Http API Internet API Steal credential ScreenSho Browser Info Stealer Malware download FTP Client Info Stealer Vidar Azorult VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency powershell Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files ICMP traffic RWX flags setting unpack itself Windows utilities Disables Windows Security Collect installed applications powershell.exe wrote Check virtual network interfaces suspicious process AppData folder malicious URLs AntiVM_Disk sandbox evasion WriteConsoleW anti-virtualization VM Disk Size Check installed browsers check Tofsee Ransomware Zeus OskiStealer Stealer Windows Browser Email ComputerName DNS Cryptographic key Software crashed keylogger Downloader Password 		21 12 11 10 32.2 M 45 ZeroCERT

10205 2021-07-19 11:29 ComparePlus.dll  

b3a8c88297daecdb9b0ac54a3c107797


UPX PE File OS Processor Check PE32 DLL VirusTotal Malware Checks debugger unpack itself crashed 		1.8 30 ZeroCERT

10206 2021-07-19 13:27 ComparePlus.dll  

b3a8c88297daecdb9b0ac54a3c107797


UPX PE File OS Processor Check PE32 DLL VirusTotal Malware Checks debugger unpack itself 		1.6 30 ZeroCERT

10207 2021-07-19 14:50 V-aim.dll  

68d7d6f7f4c22abe217d12cc42be689f


IcedID VMProtect PE File PE64 DLL VirusTotal Malware 		1.6 11 Kim.GS

10208 2021-07-19 15:23 리스펙.exe  

db9f97abc6cd7564e1c8bc4d1da6edf9


PWS .NET framework RAT Generic Malware Admin Tool (Sysinternals etc ...) UPX Malicious Packer PE File OS Processor Check PE32 DLL .NET EXE VirusTotal Malware suspicious privilege MachineGuid Check memory Checks debugger buffers extracted Creates executable files unpack itself sandbox evasion 		5.4 20 Kim.GS

10209 2021-07-19 16:30 http://redirector.gvt1.com/edg...  

1c8529a4577541f11238a25ce76c343e


DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Hijack Network Code injection Http API Internet API Steal credential ScreenShot Downloader P2P persistence AntiDebug AntiVM MSOffice File Code Injection exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		2 2 2 3.8 guest

10210 2021-07-19 16:52 OW AUTO 1.bat  

8002cedb6df333b9b8c7e89fde1873f1


DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Code injection Http API Internet API Steal credential ScreenShot Downloader P2P AntiDebug AntiVM WriteConsoleW 		0.6 Kim.GS

10211 2021-07-19 16:58 OW AUTO 1 (2).bat  

8002cedb6df333b9b8c7e89fde1873f1


DGA DNS Socket Create Service Sniff Audio HTTP Escalate priviledges KeyLogger FTP Code injection Http API Internet API Steal credential ScreenShot Downloader P2P AntiDebug AntiVM WriteConsoleW 		0.6 Kim.GS

10212 2021-07-19 17:25 G402.dll  

d37da4af6a94771d51d995d8683afed4


UPX PE File PE64 DLL Checks debugger unpack itself Auto service DNS 		1 2.8 Kim.GS

10213 2021-07-19 17:29 DefenderControl.ini  

62516ed108e319cf929b64a8cf4cfa93


ScreenShot AntiDebug AntiVM Check memory unpack itself 		1.0 Kim.GS

10214 2021-07-19 17:54 rere.exe  

734b3fcc06d0a0eda6b83de9165636ac


PWS Loki[b] Loki[m] UPX PE File PE64 OS Processor Check VirusTotal Malware Check memory Checks debugger unpack itself Remote Code Execution 		2.0 3 Kim.GS

10215 2021-07-20 08:04 vbc.exe  

97ee10e7b9b299b04c83d12eaf6dc5f5


RedLine Stealer UPX PE File PE32 VirusTotal Malware PDB unpack itself Remote Code Execution 		2.8 M 53 ZeroCERT

keyword