Submissions

Date range button:

First seen:

Last seen:

No	Date	Request	Urls	Hosts	IDS	Rule	Score	Zero	VT	Player
11581	2023-07-12 17:31	dwmop.exe 9749f1713629f82f7c889752d3c616e5 UPX Malicious Library OS Processor Check PE File PE32 VirusTotal Malware unpack itself Remote Code Execution					1.8	M	27	ZeroCERT

11582	2023-07-12 17:30	HVB.exe c624cef40138f7e0e3749b519b93b47a PWS SMTP KeyLogger AntiDebug AntiVM .NET EXE PE File PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AutoRuns PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed		4	4		13.2	M	46	ZeroCERT

11583	2023-07-12 17:30	HHH1.exe 6f665047f3ccce8c93bdd5eead1318de Generic Malware UPX Antivirus AntiDebug AntiVM PE64 PE File OS Processor Check VirusTotal Malware Buffer PE suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows utilities Auto service Check virtual network interfaces malicious URLs Tofsee Windows Cryptographic key	1 Keyword trend analysis	2	1		9.6	M	24	ZeroCERT

11584	2023-07-12 17:25	cred64.dll 60cf7bdab887c8e4d3425d94ececd8d0 Browser Login Data Stealer UPX Malicious Library OS Processor Check DLL PE64 PE File VirusTotal Malware PDB Checks debugger unpack itself installed browsers check Browser ComputerName crashed					2.8	M	40	ZeroCERT

11585	2023-07-12 17:25	Setup122.exe bcfac13ce46c95646e1d922d4a8493cf UPX PE64 PE File VirusTotal Malware Check memory Checks debugger unpack itself Windows Cryptographic key					1.8	M	29	ZeroCERT

11586	2023-07-12 15:18	xmrig.exe 4813fa6d610e180b097eae0ce636d2aa Generic Malware UPX Malicious Library Malicious Packer OS Processor Check PE64 PE File VirusTotal Malware unpack itself ComputerName					1.8	M	51	ZeroCERT

11587	2023-07-12 15:15	templezx.exe 9c66f681dd4f45e909bb6cec6fa8e20f AgentTesla PWS KeyLogger AntiDebug AntiVM .NET EXE PE File PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AutoRuns PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces IP Check Tofsee Windows Browser Email ComputerName Cryptographic key Software crashed keylogger		2	2		13.2	M	28	ZeroCERT

11588	2023-07-12 14:50	pablozx.doc 6bad9606e870b69823f32c9255c194c4 Loki MS_RTF_Obfuscation_Objects RTF File doc LokiBot Malware download VirusTotal Malware c&c Malicious Traffic exploit crash Windows Exploit DNS crashed	2 Keyword trend analysis	2	12 Info ET INFO Executable Download from dotted-quad Host ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 ET MALWARE LokiBot User-Agent (Charon/Inferno) ET MALWARE LokiBot Checkin ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 ET POLICY PE EXE or DLL Windows file download HTTP ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response ET MALWARE LokiBot Request for C2 Commands Detected M1 ET MALWARE LokiBot Request for C2 Commands Detected M2 ET MALWARE LokiBot Fake 404 Response	1	4.6	M	35	ZeroCERT

11589	2023-07-12 14:01	templezx.doc 96908698ef1a19e7b6c4cc2f52637d3b MS_RTF_Obfuscation_Objects RTF File doc Malware download VirusTotal Malware Telegram Malicious Traffic exploit crash IP Check Tofsee Windows Exploit DNS crashed	1 Keyword trend analysis	5	9 Info ET INFO TLS Handshake Failure ET INFO Executable Download from dotted-quad Host SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 ET HUNTING Telegram API Domain in DNS Lookup ET POLICY PE EXE or DLL Windows file download HTTP ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)		4.6	M	33	ZeroCERT

11590	2023-07-12 10:10	Financial_Budget2023.js 9b5b8fd2b485387fb5e16a6a714ff3c6 Malware download Wshrat NetWireRC VirusTotal Malware VBScript AutoRuns WMI wscript.exe payload download Creates executable files unpack itself AntiVM_Disk VM Disk Size Check Windows Houdini ComputerName DNS Dropper	1 Keyword trend analysis	3	2		10.0		9	ZeroCERT

11591	2023-07-12 09:37	new64.dll 9872f989cd453187ec12ffd4744be0db Malicious Library DLL PE64 PE File VirusTotal Malware Checks debugger buffers extracted unpack itself Remote Code Execution DNS	3 Keyword trend analysis	7			3.4	M	18	ZeroCERT

11592	2023-07-12 09:30	schtasks.exe a0bcd3b7d2ab3ff1beb3ee7d87e736d0 AsyncRAT UPX .NET framework(MSIL) Malicious Packer OS Processor Check .NET EXE PE File PE32		2						ZeroCERT

11593	2023-07-12 08:15	schtasks.exe 25eb3575a5fdaefcf6f3b5c1d91c262d AsyncRAT UPX .NET framework(MSIL) Malicious Packer OS Processor Check .NET EXE PE File PE32		2						ZeroCERT

11594	2023-07-12 08:14	schtasks.exe 24cd86ecb2c7e499e830f681f6308f41 AsyncRAT UPX .NET framework(MSIL) Malicious Packer OS Processor Check .NET EXE PE File PE32		2						ZeroCERT

11595	2023-07-12 08:08	wqzwqzwqzwqzwqzwqzwqzwqzwqz%23... de36330f5ecc55cc90226af3db4a8992 MS_RTF_Obfuscation_Objects RTF File doc Vulnerability VirusTotal Malware Malicious Traffic buffers extracted exploit crash unpack itself Exploit DNS crashed	1 Keyword trend analysis	1	3		4.6		33	ZeroCERT