popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
11086 2023-08-01 09:09 4XR.exe  

6c006bd6ae5d2a1f98bf1d3028db0749


Emotet Generic Malware Downloader UPX WinRAR Malicious Library Antivirus Create Service Socket P2P DGA Steal credential Http API Escalate priviledges PWS Sniff Audio HTTP DNS ScreenShot Code injection Internet API FTP KeyLogger AntiDebug AntiVM OS Process VirusTotal Cryptocurrency Miner Malware Cryptocurrency powershell AutoRuns PDB suspicious privilege Code Injection Check memory Checks debugger WMI Creates shortcut Creates executable files unpack itself Windows utilities suspicious process AppData folder WriteConsoleW Firewall state off Windows ComputerName Remote Code Execution DNS Cryptographic key crashed CoinMiner 		4 2 11.2 37 ZeroCERT

11087 2023-08-01 08:43 File_pass1234.7z  

becbf77d1e0b6a61d8203096792e76a4


Vidar Escalate priviledges PWS KeyLogger AntiDebug AntiVM RedLine Malware download Amadey Cryptocurrency Miner Malware Cryptocurrency Microsoft Telegram suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files ICMP traffic unpack itself IP Check PrivateLoader Tofsee Fabookie Stealer Windows RisePro DNS 		27 72 30 15 7.0 M ZeroCERT

11088 2023-08-01 08:11 Wallet.exe  

f8e6425f51d262f94758c86fe2b936bf


Generic Malware UPX .NET EXE PE File PE32 VirusTotal Malware PDB Check memory Checks debugger unpack itself 		2.4 M 30 ZeroCERT

11089 2023-08-01 08:09 photo443.exe  

e248dada31a4ae88394b5c8363218701


Gen1 Emotet Amadey UPX Malicious Library Admin Tool (Sysinternals etc ...) Malicious Packer CAB PE File PE32 OS Processor Check DLL Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer Malware Microsoft AutoRuns PDB suspicious privilege Malicious Traffic Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities Disables Windows Security Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Stealer Windows Update Browser ComputerName Remote Code Execution DNS Cryptographic key Software crashed 		3 2 12 3 16.0 M ZeroCERT

11090 2023-08-01 08:09 p9iLwGB7kusHed.exe  

bf1d64bea29e43b8a75708b26ea268d1


Malicious Library PE64 PE File VirusTotal Malware MachineGuid Check memory Checks debugger unpack itself 		2.4 M 31 ZeroCERT

11091 2023-08-01 08:08 C3VB.exe  

a32e1510eaf70c772b81fc4e9f4c46f3


LokiBot RedLine stealer Emotet Generic Malware Downloader UPX WinRAR Malicious Library .NET framework(MSIL) Admin Tool (Sysinternals etc ...) Antivirus Create Service Socket P2P DGA Steal credential Http API Escalate priviledges PWS Sniff Audio HTTP DNS S Browser Info Stealer RedLine FTP Client Info Stealer VirusTotal Malware powershell AutoRuns PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files unpack itself Windows utilities Collect installed applications Check virtual network interfaces suspicious process AppData folder WriteConsoleW Firewall state off installed browsers check Tofsee Stealer Windows Browser ComputerName Remote Code Execution DNS Cryptographic key Software crashed 		3 8 5 22.6 41 ZeroCERT

11092 2023-08-01 08:06 x.exe  

56d79c2e80c07da469b2e00bcf381659


UPX Malicious Library OS Processor Check PE64 PE File VirusTotal Malware anti-virtualization 		2.4 45 ZeroCERT

11093 2023-08-01 08:05 xx.exe  

6b6573622aaa1b886bd60699c99d6fbb


UPX .NET framework(MSIL) Malicious Library Malicious Packer Antivirus OS Processor Check .NET EXE PE File PE32 VirusTotal Malware Check memory Checks debugger unpack itself 		2.0 63 ZeroCERT

11094 2023-08-01 08:04 ratt.exe  

dc0ec514d428d56d042c087457f843c0


Emotet Generic Malware Downloader UPX WinRAR Malicious Library Antivirus Create Service Socket P2P DGA Steal credential Http API Escalate priviledges PWS Sniff Audio HTTP DNS ScreenShot Code injection Internet API FTP KeyLogger AntiDebug AntiVM OS Process powershell AutoRuns PDB suspicious privilege Code Injection Check memory Checks debugger WMI Creates shortcut Creates executable files unpack itself Windows utilities powershell.exe wrote suspicious process AppData folder malicious URLs WriteConsoleW Firewall state off Windows ComputerName Remote Code Execution DNS Cryptographic key crashed 		3 1 11.2 ZeroCERT

11095 2023-08-01 08:03 dasf.exe  

89ef9f770753ea98cde8dd221b71f510


UPX Malicious Library OS Processor Check PE File PE32 DNS 		1 1.6 ZeroCERT

11096 2023-07-31 18:02 sf64r.dll  

374d8e8089ecf5f1a161514d1b346432


Malicious Library DLL PE64 PE File Checks debugger unpack itself Remote Code Execution DNS 		1 3.0 ZeroCERT

11097 2023-07-31 18:02 BRA.exe  

d5bddbbbf64a97dc0e98d4db2b675fb3


Themida Packer UPX .NET EXE PE File PE32 Check memory Checks debugger unpack itself Checks Bios Detects VMWare VMware anti-virtualization Windows ComputerName Remote Code Execution Firmware DNS Cryptographic key crashed 		1 6.8 ZeroCERT

11098 2023-07-31 17:58 000000000000000%23%23%23%23%23...  

92bb79c8468691d39e3750967f235588


MS_RTF_Obfuscation_Objects RTF File doc VirusTotal Malware buffers extracted exploit crash Exploit DNS crashed 		1 4.2 29 ZeroCERT

11099 2023-07-31 17:52 blinkzx.doc  

3bda3743edc516b3b4687e86606fb844


MS_RTF_Obfuscation_Objects RTF File doc Malware download VirusTotal Malware Malicious Traffic RWX flags setting exploit crash IP Check Tofsee Windows Exploit DNS crashed 		1 5 8 5.6 36 ZeroCERT

11100 2023-07-31 17:49 zdkecjb7.exe  

2eb21acbab653f9007db89469ca991c9


Generic Malware UPX Malicious Library Antivirus Anti_VM AntiDebug AntiVM OS Processor Check PE File PE32 PowerShell VirusTotal Malware Microsoft Buffer PE suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut unpack itself suspicious process WriteConsoleW IP Check Tofsee Windows ComputerName DNS Cryptographic key crashed 		7 10 3 2 14.4 55 ZeroCERT

keyword