popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
11731 2023-07-06 07:24 CGSS1FFDSDFFFDDF.doc  

3483e943d6094354b09c224b748a3f4b


MS_RTF_Obfuscation_Objects RTF File doc Malware Malicious Traffic RWX flags setting exploit crash Exploit DNS crashed 		1 1 1 3.2 ZeroCERT

11732 2023-07-06 07:05 PNe5J9o1XCKpHYk.exe  

40be18ff344e38f80cec056f5bd97f21


UPX .NET framework(MSIL) Admin Tool (Sysinternals etc ...) DNS AntiDebug AntiVM PE File .NET EXE PE32 Buffer PE suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key 		1 14.0 guest

11733 2023-07-05 18:30 149.exe  

2cca5c1b1f00170bd750694d9511015b


Cutwail UPX Malicious Library Escalate priviledges Code injection HTTP DNS Scre Malware download VirusTotal Malware Buffer PE MachineGuid Code Injection Malicious Traffic Check memory buffers extracted ICMP traffic unpack itself Check virtual network interfaces suspicious process suspicious TLD sandbox evasion Tofsee Windows Backdoor ComputerName DNS Cryptographic key 		213 531 7 16.2 M 30 ZeroCERT

11734 2023-07-05 17:42 tonyspecialzx.doc  

524a7c0b9bd2e45a5d6c0c400067eaf3


MS_RTF_Obfuscation_Objects RTF File doc Malware download VirusTotal Malware Malicious Traffic exploit crash unpack itself Windows Exploit DNS crashed 		1 2 6 4.4 29 ZeroCERT

11735 2023-07-05 17:42 Qjhihl.exe  

f5a0c42c6c223c05be08f3552ecf723e


Hide_EXE UPX .NET framework(MSIL) Anti_VM AntiDebug AntiVM OS Processor Check PE File .NET EXE PE32 VirusTotal Malware AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted ICMP traffic unpack itself Windows DNS Cryptographic key 		53 11.0 43 ZeroCERT

11736 2023-07-05 17:40 mazx.doc  

eda69f7aa485bc2603035654f6483a50


MS_RTF_Obfuscation_Objects RTF File doc FormBook Malware download VirusTotal Malware Malicious Traffic exploit crash unpack itself Windows Exploit DNS crashed 		2 5 6 4.4 26 ZeroCERT

11737 2023-07-05 17:36 RFQ098654578.exe  

246ba2f9ceb20a58fe5c16540ba7ad2b


NSIS UPX Malicious Library PE File PE32 OS Processor Check DLL Malware download Remcos VirusTotal Malware AutoRuns Malicious Traffic Check memory Creates executable files unpack itself AppData folder Windows DNS keylogger 		1 3 3 6.4 49 ZeroCERT

11738 2023-07-05 17:34 trapline-drivers.exe  

2fe56b5f4728f2fd8839ac9d937c097d


Generic Malware Antivirus PE File PE64 PowerShell VirusTotal Malware powershell suspicious privilege MachineGuid Check memory Checks debugger Creates shortcut unpack itself Windows utilities suspicious process Windows ComputerName Cryptographic key 		1 2 6.2 47 ZeroCERT

11739 2023-07-05 17:34 setop.exe  

7104f635a41839bac7835703f06f744e


Downloader Malicious Library Create Service Socket DGA Steal credential Escalate priviledges Code injection HTTP PWS Sniff Audio DNS ScreenShot Http API Internet API persistence FTP KeyLogger P2P AntiDebug AntiVM PE File PE32 Browser Info Stealer Malware download VirusTotal Malware Lobshot AutoRuns MachineGuid Code Injection Windows utilities suspicious process AppData folder sandbox evasion WriteConsoleW Windows Browser ComputerName DNS 		1 1 7.2 33 ZeroCERT

11740 2023-07-05 17:34 OYH.exe  

5e20a6acf6cfec604e8f1fa9421385bc


PWS SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AgentTesla AutoRuns PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces suspicious TLD IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key Software crashed 		4 5 13.6 27 ZeroCERT

11741 2023-07-05 17:34 owenzx.exe  

2fea32b618ef47c56804ca6cff00f01d


Formbook PWS AntiDebug AntiVM PE File .NET EXE PE32 FormBook Malware download VirusTotal Malware PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		2 5 1 8.4 32 ZeroCERT

11742 2023-07-05 17:31 dukaszx.exe  

07a900b9ecc4bd5bd4137137961769a2


LokiBot Generic Malware .NET framework(MSIL) Antivirus Socket PWS DNS AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware powershell PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself powershell.exe wrote suspicious process malicious URLs WriteConsoleW installed browsers check Windows Browser Email ComputerName DNS Cryptographic key Software 		1 16.4 45 ZeroCERT

11743 2023-07-05 17:30 tonyspecialzx.exe  

b4df3d7f0826501829e1a03991e1fe81


Generic Malware Antivirus PWS SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself suspicious process WriteConsoleW Windows Browser Email ComputerName Cryptographic key Software crashed keylogger 		13.2 29 ZeroCERT

11744 2023-07-05 17:28 mazx.exe  

1a37304d7ec2fd94deae95562ce9cc77


Formbook PWS AntiDebug AntiVM PE File .NET EXE PE32 FormBook Malware download VirusTotal Malware PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		3 5 1 1 8.4 31 ZeroCERT

11745 2023-07-05 17:27 haitianzx.exe  

b7933e126bd2fadfae8d36319c9e9e26


UltraVNC UPX Malicious Library SMTP KeyLogger AntiDebug AntiVM OS Processor Check PE File PE32 Browser Info Stealer FTP Client Info Stealer Email Client Info Stealer PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Tofsee Windows Browser Email ComputerName Cryptographic key Software crashed keylogger 		1 3 2 12.0 ZeroCERT

keyword