popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
10966 2021-08-06 09:20 start.EXE  

aac2b6314988e0aea824fe0a53b917c1


Emotet Gen1 UPX Malicious Library Antivirus PE64 PE File VirusTotal Malware powershell AutoRuns PDB suspicious privilege MachineGuid Check memory Checks debugger Creates shortcut Creates executable files unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Remote Code Execution Cryptographic key 		6.0 7 ZeroCERT

10967 2021-08-06 09:22 Ghazals500us.exe  

b6980e5e55804f4c149c2d5096a7fd68


RAT BitCoin Generic Malware AntiDebug AntiVM .NET EXE PE File PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Collect installed applications Check virtual network interfaces installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software crashed 		2 3 1 1 11.8 M 56 ZeroCERT

10968 2021-08-06 09:22 hWUsDVx5V2Kte0B.exe  

44de2471096289379cf30cef69e2d35f


RAT PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) OS Processor Check .NET EXE PE File PE32 VirusTotal Malware Check memory Checks debugger unpack itself Windows ComputerName Cryptographic key 		2.8 M 41 ZeroCERT

10969 2021-08-06 09:24 pdf_document_sw211222.html  

a30a7664820bee515dd5b191440aba0e


Antivirus AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		2 3.8 ZeroCERT

10970 2021-08-06 09:24 barorsunn.exe  

74c0f41c711f0113e7a4e15916559950


Generic Malware UPX Malicious Library OS Processor Check PE File PE32 Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c PDB suspicious privilege MachineGuid Malicious Traffic Check memory unpack itself AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName Software 		1 2 7 8.6 M 36 ZeroCERT

10971 2021-08-06 09:26 DBti7kFcOLHaK2z.exe  

a4579e15af982f864c88df0a1c1dbf0a


PWS .NET framework Generic Malware UPX .NET EXE PE File PE32 VirusTotal Malware suspicious privilege Check memory Checks debugger unpack itself Windows Cryptographic key 		3.2 M 30 ZeroCERT

10972 2021-08-06 09:26 usermasabikzx.exe  

53b546cb0d9e9e8a27a1317e55086eb2


PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) SMTP KeyLogger AntiDebug AntiVM .NET EXE PE File PE32 VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows ComputerName Cryptographic key crashed 		10.2 M 31 ZeroCERT

10973 2021-08-06 09:28 Hlt9VTppbZE9UGs.exe  

3aa98571fcb0f1d734605cc6e2d8adf0


RAT Generic Malware UPX .NET EXE PE File PE32 VirusTotal Malware Check memory Checks debugger unpack itself crashed 		2.6 M 44 ZeroCERT

10974 2021-08-06 09:30 vbc.exe  

d07fd206bfadd24bc7e4939c7b24e098


Generic Malware UPX Malicious Library OS Processor Check PE File PE32 Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c PDB suspicious privilege MachineGuid Malicious Traffic Check memory unpack itself AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName DNS Software 		1 2 10 8.0 M 28 ZeroCERT

10975 2021-08-06 09:30 vbc.exe  

aa4b9c043e923952fee38447b9dd0b43


UPX Malicious Library DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Internet API FTP ScreenShot Http API Steal credential Downloader P2P AntiDebug AntiVM PE File PE32 FormBook Emotet Malware download VirusTotal Malware Buffer PE AutoRuns Code Injection Malicious Traffic buffers extracted Creates executable files RWX flags setting unpack itself Windows utilities suspicious process WriteConsoleW Tofsee Windows ComputerName Remote Code Execution 		16 18 2 2 11.6 M 24 ZeroCERT

10976 2021-08-06 09:31 dwn.exe  

a22ae90aeac4eecc7448b7d96a55b774


Generic Malware UPX Malicious Packer .NET EXE PE File PE32 VirusTotal Malware Buffer PE AutoRuns suspicious privilege MachineGuid Check memory Checks debugger buffers extracted ICMP traffic unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName 		2 10.8 M 57 ZeroCERT

10977 2021-08-06 09:33 .audiodg.exe  

4a21a7f7fa4c1ce05c8c1a7e10eb73dc


PWS Loki[b] Loki[m] .NET framework Generic Malware Admin Tool (Sysinternals etc ...) DNS Socket AntiDebug AntiVM .NET EXE PE File PE32 Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Windows Browser Email ComputerName DNS Cryptographic key Software crashed 		1 1 6 1 13.8 M 19 ZeroCERT

10978 2021-08-06 09:33 butolin.exe  

15fe7395ede733429881ca065f9e9cc3


Loki Generic Malware UPX Malicious Library OS Processor Check PE File PE32 Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c PDB suspicious privilege MachineGuid Malicious Traffic Check memory unpack itself installed browsers check Browser Email ComputerName Software 		1 2 7 1 7.6 M 26 ZeroCERT

10979 2021-08-06 09:35 benu.exe  

7576d0cf0b60965127fbe253a599c2ac


PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) .NET EXE PE File PE32 VirusTotal Malware Check memory Checks debugger unpack itself crashed 		2.6 M 49 ZeroCERT

10980 2021-08-06 09:35 EgVhr9cVP2SFBEU.exe  

bfdc6b9626ebc50042b3aaa98f9e4b28


Generic Malware UPX .NET EXE PE File PE32 VirusTotal Malware Check memory Checks debugger unpack itself 		2.4 M 44 ZeroCERT

keyword