popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
12016 2021-09-02 18:04 CHARLSE.exe  

29df961d87b689567324ce38192e1d66


RAT PWS .NET framework Generic Malware Antivirus SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware powershell Buffer PE suspicious privilege Code Injection Check memory Checks debugger buffers extracted WMI Creates shortcut ICMP traffic unpack itself powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key crashed 		3 13.0 M 35 ZeroCERT

12017 2021-09-02 18:05 168931870.exe  

a4afd9519bed282bc4c1248f7aaafde0


RAT PWS .NET framework Generic Malware PE File OS Processor Check .NET EXE PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Collect installed applications Check virtual network interfaces installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software crashed 		1 3 1 8.0 M 46 ZeroCERT

12018 2021-09-02 18:07 TOBI.exe  

5bf7c4b2b2980b4796c0c93b00dcf602


RAT PWS .NET framework email stealer Generic Malware Antivirus DNS Escalate priviledges KeyLogger Code injection Downloader persistence AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware powershell Buffer PE AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted WMI Creates shortcut ICMP traffic unpack itself Windows utilities powershell.exe wrote suspicious process AntiVM_Disk WriteConsoleW VM Disk Size Check Windows ComputerName Cryptographic key crashed 		3 15.4 M 32 ZeroCERT

12019 2021-09-02 18:09 368530214.exe  

e8b6c2c9dfbf5ccb632d59e2da690ac6


NPKI Malicious Library UPX DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Hijack Network Internet API FTP ScreenShot Http API Steal credential Downloader P2P persistence AntiDebug AntiVM PE File PE32 OS Proces Malware download VirusTotal Malware Buffer PE AutoRuns Code Injection Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities suspicious process AppData folder malicious URLs AntiVM_Disk WriteConsoleW VM Disk Size Check SectopRAT Windows ComputerName Remote Code Execution DNS 		2 1 14.2 M 25 ZeroCERT

12020 2021-09-02 18:14 assistant.php.ps1  

d41d8cd98f00b204e9800998ecf8427e


Generic Malware Antivirus unpack itself 		0.4 ZeroCERT

12021 2021-09-02 18:14 1305533303.exe  

36fb5ba2ff9166a3337d819504fe2526


RAT PWS .NET framework Generic Malware PE File .NET EXE PE32 VirusTotal Malware Check memory Checks debugger unpack itself Windows Cryptographic key crashed 		2.2 38 ZeroCERT

12022 2021-09-02 18:17 BHBW-P412536.xls  

1963a4808a9d94fbc0e380707c150730


AntiDebug AntiVM VirusTotal Malware Code Injection Check memory RWX flags setting unpack itself suspicious process Tofsee Interception 		1 2 1 7.0 26 ZeroCERT

12023 2021-09-02 18:17 A Letter before court 4.docx  

1d2094ce85d66878ee079185e2761beb

VirusTotal Malware MachineGuid Check memory RWX flags setting unpack itself GameoverP2P Zeus ComputerName Trojan Banking 		1 1 4.4 3 ZeroCERT

12024 2021-09-02 18:21 who_template.doc  

3657586d8555593012bfd7420d488be4


Generic Malware VBA_macro MSOffice File VirusTotal Malware RWX flags setting unpack itself DNS 		1 1 1 2.8 20 ZeroCERT

12025 2021-09-02 18:21 side.html  

4c80dc9fb7483214b1613957aae57e2a


AntiDebug AntiVM PNG Format MSOffice File JPEG Format Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		1 1 2 3.8 ZeroCERT

12026 2021-09-02 18:31 4.html  

9c9209875f3a48c2662578fbad7c916e


Antivirus AntiDebug AntiVM MSOffice File PNG Format Code Injection Creates executable files RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		27 16 1 4.2 ZeroCERT

12027 2021-09-03 00:57 2.exe  

294fab1523dc3b50cbcc120e67946a5b


UPX Malicious Library PE File OS Processor Check PE32 VirusTotal Malware DNS 		1 4.0 M 56 guest

12028 2021-09-03 08:53 vbc.exe  

dd5c7e917f28bbe04bb177571eadb4b6


Malicious Library DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Internet API FTP ScreenShot Http API Steal credential Downloader P2P AntiDebug AntiVM PE File PE32 FormBook Emotet Malware download VirusTotal Malware Buffer PE AutoRuns Code Injection Malicious Traffic buffers extracted Creates executable files RWX flags setting unpack itself Windows utilities suspicious process WriteConsoleW Tofsee Windows ComputerName DNS 		12 17 3 6 11.8 M 22 ZeroCERT

12029 2021-09-03 08:53 Install_Rental_LL12_2018_4.exe  

2a4bcd31051a5656d118ca1617da35d6


RAT PWS .NET framework Emotet Gen2 Gen1 Generic Malware PDF Suspicious Link Malicious Library Admin Tool (Sysinternals etc ...) UPX Malicious Packer Anti_VM ASPack PDF PE File PE32 .NET EXE OS Processor Check MSOffice File DLL PNG Format VirusTotal Malware suspicious privilege Check memory Creates shortcut Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check installed browsers check Ransomware Windows Browser ComputerName crashed 		7.0 M 15 ZeroCERT

12030 2021-09-03 08:53 obizx.exe  

d8eee8440dde12c5915cb7d7ea8c41e1


PWS .NET framework Generic Malware SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows ComputerName Cryptographic key crashed 		8.6 M 24 ZeroCERT

keyword