popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
11791 2023-07-04 16:22 PO894Y23.PDF.exe  

9e82efab8cc5b74afca76c45f900ca7a


Ave Maria WARZONE RAT Gen1 Generic Malware UPX Malicious Library Downloader Malicious Packer Antivirus AntiDebug AntiVM OS Processor Check PE File PE32 PNG Format DLL PE64 MSOffice File Browser Info Stealer Malware download AveMaria NetWireRC VirusTotal Email Client Info Stealer Malware AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files RWX flags setting exploit crash unpack itself Windows utilities suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check human activity check installed browsers check Tofsee Windows Exploit Browser RAT Email ComputerName Remote Code Execution DNS Cryptographic key crashed 		15 13 4 15.8 67 ZeroCERT

11792 2023-07-04 16:15 INQUIRY_009270_9092023.exe  

fe7ab7bf623f74792ce3be09ad7f8654


Gen1 email stealer Generic Malware Downloader UPX Malicious Packer Malicious Library Antivirus Socket Escalate priviledges Code injection PWS DNS persistence KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 OS Processor Check DLL PE64 Browser Info Stealer VirusTotal Email Client Info Stealer Malware powershell AutoRuns PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files unpack itself powershell.exe wrote suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check human activity check installed browsers check Windows Browser Email ComputerName DNS Cryptographic key crashed 		1 16.4 36 ZeroCERT

11793 2023-07-04 16:15 c35f4ebfa52e9f721f843eac4e01e9...  

c35f4ebfa52e9f721f843eac4e01e981


AgentTesla email stealer Downloader .NET framework(MSIL) Socket Escalate priviledges Code injection PWS Sniff Audio DNS ScreenShot persistence KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer Malware download AveMaria NetWireRC VirusTotal Email Client Info Stealer Malware powershell suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files unpack itself Windows utilities powershell.exe wrote suspicious process malicious URLs AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Windows Browser RAT Email ComputerName DNS Cryptographic key 		3 2 15.2 51 ZeroCERT

11794 2023-07-04 14:37 Marketing_plan_Heyhappines_23....  

c529390bb78ea6af60043ec06b6a2a89


PDF Suspicious Link PDF 		M ZeroCERT

11795 2023-07-04 11:22 RFx - NRSB-SPCI_QHK_NRSB_SPCI_...  

abf89b932e8ef30a751c9b989549ec89


NSIS UPX Malicious Library PE File PE32 OS Processor Check DLL FormBook Malware download VirusTotal Malware suspicious privilege Malicious Traffic Check memory Creates executable files unpack itself AppData folder suspicious TLD DNS 		2 6 4 5.0 47 ZeroCERT

11796 2023-07-04 11:16 Veekmvhuxdctye.exe  

50da9726e918f94a39afacf32db3e5fe


UPX Malicious Library MZP Format PE File PE32 VirusTotal Malware RWX flags setting unpack itself Remote Code Execution DNS 		7 1 3.2 34 ZeroCERT

11797 2023-07-04 11:14 9009282736273.exe  

7b9d1ae776aabfa0caa2a92ac560e5ff


UPX Malicious Library MZP Format PE File PE32 VirusTotal Malware RWX flags setting unpack itself 		2.6 32 ZeroCERT

11798 2023-07-04 11:14 JD%20Business%20Plan%202023.ln...  

229b39c9a2ed47dd87d2eae54f11f41f


Gen1 Formbook Generic Malware UPX .NET framework(MSIL) Malicious Library Admin Tool (Sysinternals etc ...) Malicious Packer OS Processor Check PE File PE32 NetWireRC VirusTotal Malware PDB Check memory Creates shortcut Creates executable files RAT ComputerName 		2.8 M 4 ZeroCERT

11799 2023-07-04 11:12 File_pass1234.7z  

4483d5690270b7692a1aef79acf05ef7


Escalate priviledges PWS KeyLogger AntiDebug AntiVM RedLine Malware download Amadey Cryptocurrency Miner Malware Cryptocurrency suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files ICMP traffic unpack itself IP Check PrivateLoader Tofsee Stealer Windows Remote Code Execution Trojan DNS Downloader 		22 59 26 12 7.0 M ZeroCERT

11800 2023-07-04 11:06 xcrypted.exe  

44211d88e9c690e108c78e0e5041b7e0


Downloader UPX .NET framework(MSIL) Create Service Socket DGA Steal credential Escalate priviledges Code injection HTTP PWS Sniff Audio DNS ScreenShot Http API Internet API FTP KeyLogger P2P AntiDebug AntiVM PE File .NET EXE PE32 OS Processor Check VirusTotal Malware Telegram suspicious privilege Code Injection Check memory Checks debugger unpack itself Check virtual network interfaces suspicious process AppData folder Tofsee ComputerName DNS crashed 		2 4 5.6 M 38 ZeroCERT

11801 2023-07-04 07:34 rama.exe  

03b453f78a11fc192d88447d789524f5


UPX Malicious Library OS Processor Check PE File PE32 DLL PDB unpack itself AppData folder Remote Code Execution 		1.8 M ZeroCERT

11802 2023-07-04 07:32 pstol1.exe  

064773034947221b8da5f3ffcaadd75d


Generic Malware UPX .NET framework(MSIL) Antivirus PWS AntiDebug AntiVM PE File .NET EXE PE32 PowerShell Malware download Malware powershell suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut unpack itself powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW Windows ComputerName DNS Cryptographic key 		1 1 3 11.4 ZeroCERT

11803 2023-07-04 07:32 Update_new.exe  

b7284f4a9502d0d74e77d465f60f78f0


Themida Packer UPX Anti_VM PE File .NET EXE PE32 Browser Info Stealer Malware download Malware Check memory Checks debugger unpack itself Checks Bios Collect installed applications Detects VMWare VMware anti-virtualization installed browsers check SectopRAT Windows Browser Backdoor ComputerName Remote Code Execution Firmware DNS Cryptographic key crashed 		1 1 8.4 ZeroCERT

11804 2023-07-04 07:29 mmfqdf2p9r107.exe  

47d27bb5f4a208f3081471d00e87d1e4


Generic Malware task schedule UPX Malicious Library Antivirus AntiDebug AntiVM OS Processor Check PE File PE32 Malware powershell Buffer PE AutoRuns PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates shortcut unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces suspicious process malicious URLs WriteConsoleW Tofsee Windows ComputerName Cryptographic key crashed 		4 4 1 2 14.8 M ZeroCERT

11805 2023-07-04 07:27 monitordhcp_cr.exe  

c184ad0157a2da3638fa56a6554dc6c7


.NET framework(MSIL) Admin Tool (Sysinternals etc ...) PE File .NET EXE PE32 PDB Check memory Checks debugger unpack itself 		1.4 ZeroCERT

keyword