popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
11521 2021-08-19 10:34 vol.exe  

57a6406937efbc6179b63b77404f9bc1


RAT PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) AntiDebug AntiVM PE File .NET EXE PE32 FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows Cryptographic key 		9 19 2 8 8.2 M 28 ZeroCERT

11522 2021-08-19 10:36 CrtCommonwinbroker.exe  

080dea74b4e8c480a3dc1be07c13eeeb


RAT Generic Malware UPX Malicious Packer DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Internet API FTP ScreenShot Http API Steal credential Downloader P2P AntiDebug AntiVM PE File OS Processor Check .NET EXE VirusTotal Malware AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AntiVM_Disk suspicious TLD WriteConsoleW VM Disk Size Check Windows ComputerName DNS crashed 		2 3 9.6 M 44 ZeroCERT

11523 2021-08-19 11:49 0818_1021705814.doc  

f27f5cc5b05fda2a64ae1feb6319a3a8


VBA_macro MSOffice File GIF Format Malware Malicious Traffic Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic RWX flags setting unpack itself Check virtual network interfaces IP Check ComputerName 		1 4 1 8.2 M guest

11524 2021-08-19 11:49 0818_7617422488.doc  

fe8a21f222386b42ffad96a8673e7829


VBA_macro MSOffice File unpack itself 		1.6 guest

11525 2021-08-19 14:49 Setup.exe  

2f32cfb886b28c28958054d20060e56c


Emotet Gen1 Generic Malware UPX Malicious Library PE File PE32 OS Processor Check PE64 DLL Check memory Checks debugger Creates executable files unpack itself AppData folder 		2.2 Kim.GS

11526 2021-08-19 16:30 0818_7617422488.doc  

fe8a21f222386b42ffad96a8673e7829


VBA_macro MSOffice File GIF Format Malware Malicious Traffic Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic RWX flags setting unpack itself Check virtual network interfaces IP Check ComputerName 		1 4 1 8.2 M ZeroCERT

11527 2021-08-19 19:06 vbc.exe  

3044a22ab226af46ec2210a6b599580d


UPX Malicious Library PE File PE32 VirusTotal Malware PDB unpack itself Remote Code Execution 		2.0 M 24 ZeroCERT

11528 2021-08-19 19:06 ASD.exe  

c15054e5947f36efff29a07bd9cd6744


RAT PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) Antivirus SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware powershell suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut unpack itself powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed keylogger 		2 6 4 16.4 M 22 ZeroCERT

11529 2021-08-19 19:08 toolspab2.exe  

fa371744e181b2857a6038e1bca60fff


UPX Malicious Library AntiDebug AntiVM PE File PE32 Malware PDB Code Injection Checks debugger buffers extracted unpack itself Remote Code Execution 		6.2 ZeroCERT

11530 2021-08-19 19:08 TER.exe  

d7328ec415afead8ac14fdb4b9645c1b


Generic Malware Admin Tool (Sysinternals etc ...) Antivirus SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware powershell suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		10.6 M 20 ZeroCERT

11531 2021-08-19 19:11 dllhost.exe  

016a2ec587bcda6c0df1e5188bfeca7b


RAT PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) AntiDebug AntiVM PE File .NET EXE PE32 FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows Cryptographic key 		1 3 1 8.2 M 28 ZeroCERT

11532 2021-08-19 19:11 vbc.exe  

843aed3eb5b9f0cd4696da19242924c1


RAT PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Tofsee Windows ComputerName Cryptographic key crashed 		1 2 1 1 10.4 M 22 ZeroCERT

11533 2021-08-19 19:13 .svchost.exe  

83cc8405d694c0e1b3d7211202265f00


RAT PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself suspicious process Windows DNS Cryptographic key 		3 8.8 M 23 ZeroCERT

11534 2021-08-19 19:15 pub1.exe  

9a055238742093cce2d43b885779cdb2


UPX Malicious Library PE File PE32 VirusTotal Malware PDB unpack itself Remote Code Execution DNS 		5 2.6 M 22 ZeroCERT

11535 2021-08-19 19:15 vbc.exe  

2698e6b35f99ca40641a595ae9ffe1d0


RAT Generic Malware Admin Tool (Sysinternals etc ...) Antivirus AntiDebug AntiVM PE File .NET EXE PE32 FormBook Malware download VirusTotal Malware powershell Buffer PE PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut ICMP traffic unpack itself powershell.exe wrote suspicious process Windows ComputerName DNS Cryptographic key 		2 6 2 13.2 M 26 ZeroCERT

keyword