popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
10561 2023-08-18 10:02 wpp.vbs  

d87d4c42c10f332a96aa10ffb455f49d


VirusTotal Malware VBScript AutoRuns WMI wscript.exe payload download ICMP traffic AntiVM_Disk VM Disk Size Check Windows ComputerName DNS DDNS Dropper 		1 2 1 10.0 M 30 ZeroCERT

10562 2023-08-18 09:55 ap.vbs  

57ce47f3c71f44a6e1270ba954ab3a9a


WSHRAT Hide_EXE Anti_VM PE File VirusTotal Malware VBScript AutoRuns WMI wscript.exe payload download Creates executable files unpack itself AntiVM_Disk IP Check VM Disk Size Check Windows ComputerName DNS DDNS crashed Dropper 		2 4 1 10.0 M 25 ZeroCERT

10563 2023-08-18 09:51 HVS.vbs  

b5ada8744016020003b96b679475b933


Generic Malware Antivirus Hide_URL PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities Check virtual network interfaces suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		3 3 8.8 M 5 ZeroCERT

10564 2023-08-18 07:54 Amday.exe  

7be1e9a1eade9773de6643fb1e4e0ffc


Amadey .NET framework(MSIL) UPX Admin Tool (Sysinternals etc ...) Http API HTTP Code injection Internet API AntiDebug AntiVM PE File .NET EXE PE32 Lnk Format GIF Format VirusTotal Malware AutoRuns PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files unpack itself Windows utilities Windows ComputerName DNS 		1 1 1 12.2 M 34 ZeroCERT

10565 2023-08-18 07:52 fotod300.exe  

e802b1dbc1f2d392ab7b809d0f177763


Gen1 Emotet Malicious Library UPX PE File CAB PE32 VirusTotal Malware AutoRuns PDB suspicious privilege MachineGuid Check memory Checks debugger Creates executable files unpack itself Windows utilities Disables Windows Security suspicious process AntiVM_Disk WriteConsoleW VM Disk Size Check Windows Update Remote Code Execution 		8.4 M 44 ZeroCERT

10566 2023-08-18 07:43 dasHost.exe  

7cfc2520e8fd8a455538e88efa9f9357


Malicious Library UPX OS Processor Check PE File PE32 VirusTotal Malware PDB 		2.2 M 41 ZeroCERT

10567 2023-08-18 07:41 foto4055.exe  

3e829ce0029df6886e3e865dc44860b0


Gen1 Emotet Malicious Library UPX PE File CAB PE32 AutoRuns PDB Check memory Creates executable files unpack itself Windows utilities suspicious process AntiVM_Disk WriteConsoleW VM Disk Size Check Windows Remote Code Execution 		4.2 M ZeroCERT

10568 2023-08-18 07:40 Setup2potok.exe  

e6b8cfb15c6fce9abcea7a716345d537


Admin Tool (Sysinternals etc ...) Http API HTTP ScreenShot Internet API AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself crashed 		2 2 2 9.0 M 30 ZeroCERT

10569 2023-08-18 07:39 settings.exe  

cfff2b043a6c98616a197315a813ca6d


Formbook NSIS Malicious Library UPX ASPack PE File PE32 OS Processor Check DLL VirusTotal Malware suspicious privilege Malicious Traffic Check memory Creates executable files ICMP traffic unpack itself AppData folder 		5 10 1 5.2 M 38 ZeroCERT

10570 2023-08-18 07:38 ChromeSetup.exe  

3d65e5bf187bdb64286f9982c330ca14


Generic Malware Antivirus PWS SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities suspicious process WriteConsoleW Windows Browser Email ComputerName Cryptographic key Software crashed 		11.6 M 37 ZeroCERT

10571 2023-08-18 07:36 Al.exe  

95d977a14fbc0eb268d4aae47bdb4dee


Generic Malware WinRAR Malicious Library UPX Antivirus AntiDebug AntiVM OS Processor Check PE File PE32 .NET EXE VirusTotal Malware powershell AutoRuns PDB suspicious privilege Code Injection Check memory Checks debugger WMI Creates shortcut Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder WriteConsoleW Firewall state off Windows ComputerName Remote Code Execution Cryptographic key crashed 		2 13.2 28 ZeroCERT

10572 2023-08-18 07:36 dasHost.exe  

6ac95d0ff18baaa2fa5bbfa1cbe4ff6e


Malicious Library UPX OS Processor Check PE File PE32 VirusTotal Malware unpack itself Remote Code Execution 		2.4 51 ZeroCERT

10573 2023-08-18 01:11 iboostup.dmg  

b9e4503135b0961e20e3b636c4d6e140


AntiDebug AntiVM Email Client Info Stealer suspicious privilege Checks debugger Creates shortcut unpack itself installed browsers check Browser Email ComputerName 		3.4 guest

10574 2023-08-17 18:25 vxODSBwqrEMac.exe  

e53f4ce45bbc5ea4dd247b4aab7d6be2


NSIS Malicious Library UPX ASPack PE File PE32 OS Processor Check DLL Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Check memory Checks debugger Creates executable files unpack itself Check virtual network interfaces AppData folder IP Check Windows Browser Email ComputerName Software crashed keylogger 		2 7.8 M 30 ZeroCERT

10575 2023-08-17 18:25 %E4%B8%80%E9%94%AE%E9%87%8D%E8...  

f9d4a14f2de2540ca26fc868055c65b3


Emotet Gen1 Generic Malware PhysicalDrive Malicious Library UPX Malicious Packer MPRESS ASPack Anti_VM OS Processor Check PE File ftp PE32 DLL MZP Format ZIP Format PE64 Lnk Format GIF Format VirusTotal Malware PDB suspicious privilege Check memory buffers extracted WMI Creates shortcut Creates executable files RWX flags setting unpack itself AppData folder AntiVM_Disk VM Disk Size Check ComputerName Remote Code Execution Firmware 		6 13 9.4 M 20 ZeroCERT

keyword