popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
11956 2023-06-26 17:26 Info.exe  

9873d7a24b69e63fee428d9fe75b9a32


PhysicalDrive PE64 PE File VirusTotal Malware unpack itself crashed 		1.2 4 ZeroCERT

11957 2023-06-26 15:09 microengine.dll  

fb83690fe7e7e0d3a8f40b110de316d0


UPX Malicious Library OS Processor Check DLL PE32 PE File VirusTotal Malware PDB Checks debugger unpack itself Browser Remote Code Execution 		3.0 M 30 ZeroCERT

11958 2023-06-26 14:29 cleanmgr.exe  

f503da8eee4e7cd822239110b488b08b


Backdoor RemcosRAT browser info stealer Downloader Google Chrome User Data Confuser .NET Create Service Socket DNS Escalate priviledges PWS Sniff Audio ScreenShot Internet API KeyLogger AntiDebug AntiVM .NET EXE PE32 PE File PE64 VirusTotal Malware PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder WriteConsoleW Windows DNS DDNS 		1 3 6 1 13.2 M 54 r0d

11959 2023-06-26 14:24 cleanmgr.exe  

f503da8eee4e7cd822239110b488b08b


Client SW User Data Stealer browser info stealer Google Chrome User Data Downloader Confuser .NET Create Service Socket DNS PWS Sniff Audio Internet API ScreenShot Escalate priviledges KeyLogger AntiDebug AntiVM .NET EXE PE File PE32 PE64 VirusTotal Malware PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder WriteConsoleW Windows DNS DDNS 		1 3 6 1 13.2 M 54 r0d

11960 2023-06-26 14:10 rPAGO_4536222.exe  

f01bdbc4e97c2a1886094c3fe2092448


SMTP KeyLogger AntiDebug AntiVM .NET EXE PE File PE32 Browser Info Stealer Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AgentTesla PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Windows Browser Email ComputerName Cryptographic key Software crashed 		2 2 10.8 30 ZeroCERT

11961 2023-06-26 10:20 setup294.exe  

271867a2e2c2998d614643878910065e


UPX Malicious Library AntiDebug AntiVM OS Processor Check PE File PE32 DLL PDB Code Injection Checks debugger Creates executable files unpack itself AppData folder Remote Code Execution 		3.4 ZeroCERT

11962 2023-06-26 10:20 4444.exe  

ee539424f2973dd2a45ab3b8f10128b6


RedLine stealer UPX Malicious Library AntiDebug AntiVM OS Processor Check PE File PE32 Browser Info Stealer RedLine Malware download FTP Client Info Stealer VirusTotal Malware Buffer PE PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted WMI unpack itself Collect installed applications installed browsers check Stealer Windows Browser ComputerName DNS Cryptographic key Software crashed 		1 1 11.8 26 ZeroCERT

11963 2023-06-26 10:18 setup1.exe  

ae935cda1e1db321d41cdd7e6431d1af


RedLine stealer UPX DNS PWS AntiDebug AntiVM .NET EXE PE File PE32 VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows Cryptographic key 		9.2 51 ZeroCERT

11964 2023-06-26 10:18 setup.exe  

54e5447517c883ded154b44a07b4eb95


Malicious Library PE File PE32 VirusTotal Malware WMI Creates executable files RWX flags setting Checks Bios anti-virtualization ComputerName 		4.2 M 55 ZeroCERT

11965 2023-06-26 10:14 setup.exe  

8f9b8f33a0ea96d78873f951b2b62f68


Malicious Library PE File PE32 WMI Creates executable files RWX flags setting Checks Bios anti-virtualization ComputerName 		3.0 M ZeroCERT

11966 2023-06-26 10:12 toolspub1.exe  

667b278b249d16f1504634b77b3da797


UPX Malicious Library AntiDebug AntiVM OS Processor Check PE File PE32 Malware Code Injection Checks debugger buffers extracted unpack itself 		6.0 M ZeroCERT

11967 2023-06-26 10:10 staticlittlesource.exe  

ae9991a02aa20ebbc2cc3c0f40924442


UPX Malicious Library Malicious Packer ScreenShot AntiDebug AntiVM OS Processor Check PE File PE32 Malware Buffer PE Code Injection buffers extracted WMI RWX flags setting unpack itself WriteConsoleW ComputerName crashed 		8.0 M ZeroCERT

11968 2023-06-26 09:57 fotod95.exe  

e8dc42f50270cc92cfafe4a52fe2c77d


Gen1 Emotet Malicious Library UPX Malicious Packer Admin Tool (Sysinternals etc ...) PE File PE32 OS Processor Check DLL CAB Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer Malware AutoRuns suspicious privilege Malicious Traffic Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities Disables Windows Security Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Stealer Windows Update Browser ComputerName DNS Cryptographic key Software crashed 		3 2 10 3 15.2 M ZeroCERT

11969 2023-06-26 09:55 foto172.exe  

94b7834a3b8954758c8004a572f0e024


Gen1 Emotet Malicious Library UPX Malicious Packer Admin Tool (Sysinternals etc ...) PE File PE32 .NET EXE OS Processor Check CAB DLL Browser Info Stealer RedLine Malware download Amadey FTP Client Info Stealer Malware AutoRuns suspicious privilege Malicious Traffic Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities Disables Windows Security Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Stealer Windows Update Browser ComputerName DNS Cryptographic key Software crashed 		3 2 10 3 15.6 M ZeroCERT

11970 2023-06-26 09:53 File_pass1234.7z  

835c29165e9dce36a4c7ec3afbe27e45


Redline PWS Escalate priviledges KeyLogger AntiDebug AntiVM RedLine Malware download Amadey VirusTotal Malware RecordBreaker suspicious privilege Malicious Traffic Check memory Checks debugger Creates executable files unpack itself IP Check PrivateLoader Tofsee Fabookie Stealer Windows Trojan DNS 		33 47 29 10 6.8 M 10 ZeroCERT

keyword