popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
12361 2021-09-14 07:36 recp_21000989.wbk  

d22ba5af380fe520c038a458e12483fa


RTF File doc AntiDebug AntiVM LokiBot Malware download VirusTotal Malware c&c MachineGuid Malicious Traffic Check memory exploit crash unpack itself Windows Exploit DNS crashed Downloader 		2 3 12 5.4 33 ZeroCERT

12362 2021-09-14 07:48 ipc.jsp  

acbc478e9703c3cadde882dd8e8258e3


AntiDebug AntiVM VirusTotal Email Client Info Stealer Malware suspicious privilege Checks debugger Creates shortcut unpack itself AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName 		4.6 20 ZeroCERT

12363 2021-09-14 07:59 ipc.jsp  

acbc478e9703c3cadde882dd8e8258e3


Generic Malware Antivirus DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Internet API FTP ScreenShot Http API Steal credential Downloader P2P AntiDebug AntiVM VirusTotal Cryptocurrency Miner Malware Cryptocurrency powershell AutoRuns Code Injection Malicious Traffic Check memory Checks debugger WMI unpack itself Windows utilities powershell.exe wrote suspicious process suspicious TLD WriteConsoleW Firewall state off IP Check Tofsee Windows ComputerName DNS Cryptographic key crashed 		15 14 3 11.4 M 20 guest

12364 2021-09-14 09:09 AP Payout Report.jar  

277697dfa8824470aa492cdb6a4e9d5a


NPKI Malicious Packer Malicious Library OS Processor Check PE File DLL PE32 Malware download NetWireRC VirusTotal Email Client Info Stealer Malware AutoRuns Check memory Checks debugger buffers extracted WMI Creates executable files RWX flags setting unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder WriteConsoleW IP Check Windows Java Email ComputerName DNS DDNS crashed 		1 10 4 8.6 4 ZeroCERT

12365 2021-09-14 09:30 RVSD PO 2021090120.docx  

5eb18f6228962f4303e189cd382446f4


Lokibot RTF File doc Word 2007 file format(docx) LokiBot Malware download VirusTotal Malware c&c Malicious Traffic RWX flags setting exploit crash unpack itself Windows Exploit DNS crashed Downloader 		3 5 13 2 4.6 M 15 ZeroCERT

12366 2021-09-14 09:55 mimi.dat  

a66953b8a3eeee7d5057ddf80b8be962


NPKI Generic Malware AntiDebug AntiVM OS Processor Check VirusTotal Email Client Info Stealer Malware suspicious privilege Checks debugger Creates shortcut unpack itself AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName 		4.8 M 37 ZeroCERT

12367 2021-09-14 09:56 Re_904656001200037xls.exe  

bc2b9bca947ae4fa75b70d0ee7ebf69e


RAT PWS .NET framework Generic Malware Antivirus AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware powershell Buffer PE suspicious privilege Code Injection Check memory Checks debugger buffers extracted WMI Creates shortcut ICMP traffic RWX flags setting unpack itself powershell.exe wrote suspicious process malicious URLs WriteConsoleW Windows ComputerName Cryptographic key crashed 		4 12.0 M 16 ZeroCERT

12368 2021-09-14 09:57 vbc.exe  

5aa59f1c07762000eb9c7fe832a65765


Malicious Library PE File OS Processor Check PE32 Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Malicious Traffic Check memory unpack itself AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName Remote Code Execution Software 		3 2 7 8.4 M 25 ZeroCERT

12369 2021-09-14 09:57 vbc.exe  

a227e41467a232fb75b017d4c123db84


Malicious Library PE File OS Processor Check PE32 Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Malicious Traffic Check memory unpack itself installed browsers check Browser Email ComputerName Remote Code Execution Software 		3 2 7 8.2 M 31 ZeroCERT

12370 2021-09-14 09:59 56afd74a-093d-4e33-be73-90d768...  

01facf799579f792de63f54ba8dd1627


RAT PWS .NET framework Generic Malware PE File OS Processor Check .NET EXE PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Collect installed applications Check virtual network interfaces installed browsers check Windows Browser ComputerName DNS Cryptographic key Software crashed 		1 1 1 7.6 M 35 ZeroCERT

12371 2021-09-14 10:00 re_85412000040631.exe  

2c0b0eefba55c2f87d69a6bf911393ee


RAT PWS .NET framework Generic Malware Antivirus AntiDebug AntiVM PE File .NET EXE PE32 FormBook Malware download VirusTotal Malware powershell suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates shortcut ICMP traffic unpack itself powershell.exe wrote suspicious process malicious URLs WriteConsoleW Windows ComputerName Cryptographic key crashed 		5 16 1 13.2 M 28 ZeroCERT

12372 2021-09-14 10:01 sefile3.exe  

3258c73b3aec32a97022a3af6f602ad8


Malicious Library PE File PE32 PDB unpack itself DNS 		1 1.6 M ZeroCERT

12373 2021-09-14 10:02 LithiumFloodmark_.exe  

47e27edcb9be738259f5c3d81423c613


Admin Tool (Sysinternals etc ...) Malicious Library PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself 		2.2 M 45 ZeroCERT

12374 2021-09-14 10:04 downloadmanager.exe  

5268264a61103d13b13afc16f6ddb4af


Malicious Library AntiDebug AntiVM PE File OS Processor Check PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Malware Buffer PE PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Collect installed applications Check virtual network interfaces WriteConsoleW installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software crashed 		1 3 2 16.6 M 14 ZeroCERT

12375 2021-09-14 10:04 New_592108806100xls.exe  

9721889aa569e1cfd50d9578572d514c


RAT PWS .NET framework Generic Malware Antivirus PE File .NET EXE PE32 VirusTotal Malware powershell suspicious privilege Code Injection Check memory Checks debugger WMI Creates shortcut ICMP traffic unpack itself powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key crashed 		4 8.6 M 15 ZeroCERT

keyword