popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
12376 2021-09-14 10:06 pay.exe  

6622363be06db7fabf23393755e05b0b


Malicious Library PE File PE32 Malware download VirusTotal Malware GhostRAT AutoRuns sandbox evasion Windows Backdoor DNS 		1 2 5.0 M 52 ZeroCERT

12377 2021-09-14 10:06 qu2.exe  

a8ea59af5d4d2b6d07e62e9e26b9259d


Emotet Gen2 RAT PWS .NET framework Generic Malware Themida Packer Malicious Packer Anti_VM Malicious Library UPX PE File OS Processor Check .NET EXE PE32 Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Checks Bios Collect installed applications Detects VMWare Check virtual network interfaces AppData folder suspicious TLD VMware anti-virtualization installed browsers check Tofsee Windows Browser ComputerName Remote Code Execution Firmware DNS Cryptographic key Software crashed 		2 5 3 13.8 M 26 ZeroCERT

12378 2021-09-14 10:11 ขอใบเสนอราคา.exe  

e36a661f77f3fca72978bfa46cb22000


RAT PWS .NET framework Generic Malware PE File .NET EXE PE32 VirusTotal Malware suspicious privilege Check memory Checks debugger buffers extracted unpack itself ComputerName 		3.0 22 ZeroCERT

12379 2021-09-14 10:16 0913_1576787967287.doc  

8c85a65a764bc1e9e30bc0f7e7cf90bc


VBA_macro Generic Malware MSOffice File GIF Format VirusTotal Malware Malicious Traffic Checks debugger buffers extracted Creates shortcut Creates executable files RWX flags setting unpack itself Check virtual network interfaces suspicious TLD IP Check ComputerName 		1 4 1 8.4 M 10 ZeroCERT

12380 2021-09-14 10:19 43894826741893.JPG.scr  

e63e0da10c77c350dff54975e94b3170


Gen2 Gen1 Generic Malware Malicious Library Malicious Packer DNS AntiDebug AntiVM PE File OS Processor Check PE32 VirusTotal Malware Buffer PE AutoRuns PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName Remote Code Execution DNS DDNS crashed 		3 1 16.2 31 ZeroCERT

12381 2021-09-14 10:20 IMG.2310000001.JPG.scr  

f8b18f7f06521cd1007494ffa3d96307


Gen2 Gen1 Generic Malware Malicious Library Malicious Packer DNS AntiDebug AntiVM PE File OS Processor Check PE32 VirusTotal Malware Buffer PE AutoRuns PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName Remote Code Execution DNS DDNS crashed 		3 1 16.2 32 ZeroCERT

12382 2021-09-14 10:21 BTRU_0498763892I3HJ.exe  

6c095aa22ec999e590500d62c00cdcc2


Generic Malware Admin Tool (Sysinternals etc ...) DNS AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process AppData folder WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS 		2 1 15.6 27 ZeroCERT

12383 2021-09-14 10:31 Order_inquiry_012_013_21.js  

9beeb0cd672264c6db9a47fc34e0fd7a

VBScript AutoRuns wscript.exe payload download ICMP traffic Windows utilities suspicious process WriteConsoleW Windows ComputerName Dropper 		1 2 10.0 ZeroCERT

12384 2021-09-14 10:32 PDB_30983765367389387TM.exe  

b95a105bddbd178f6ef1fea492816177


Generic Malware Admin Tool (Sysinternals etc ...) DNS AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process AppData folder WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS 		2 1 15.6 22 ZeroCERT

12385 2021-09-14 10:36 Solicitud de presupuesto.exe  

886d720611c97f9b5453909385a37912


RAT PWS .NET framework Generic Malware SMTP KeyLogger AntiDebug AntiVM PE File .NET EXE PE32 suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows ComputerName crashed 		8.0 ZeroCERT

12386 2021-09-14 10:36 Запит на цитату.exe  

e36a661f77f3fca72978bfa46cb22000


RAT PWS .NET framework Generic Malware PE File .NET EXE PE32 VirusTotal Malware suspicious privilege Check memory Checks debugger buffers extracted unpack itself ComputerName 		3.0 22 ZeroCERT

12387 2021-09-14 10:47 qYnjfKljhYhAhBx.exe  

82d526a3173aca4b9c9c978cb3281e4e


RAT PWS .NET framework NPKI Generic Malware Malicious Packer UPX Malicious Library DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Internet API FTP ScreenShot Http API Steal credential Downloader P2P AntiDebug Code Injection AppData folder WriteConsoleW Tofsee ComputerName DNS 		3 2 4.8 ZeroCERT

12388 2021-09-14 14:19 admin.php  

dcbcd8c4fcdd17079caa96f80be4dd04


PE File OS Processor Check DLL PE32 VirusTotal Malware PDB 		0.8 15 ZeroCERT

12389 2021-09-14 15:38 admin.php  

dcbcd8c4fcdd17079caa96f80be4dd04


Generic Malware Antivirus PE File OS Processor Check DLL PE32 .NET DLL VirusTotal Malware powershell PDB suspicious privilege Check memory Checks debugger Creates shortcut Creates executable files unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces suspicious process AppData folder WriteConsoleW Windows ComputerName DNS Cryptographic key 		1 3 8.8 15 ZeroCERT

12390 2021-09-14 15:54 34.64.143.34.ps1  

bf2045debff7cbd7dc1210ca6535efd9


Generic Malware Antivirus PE File .NET DLL DLL PE32 Email Client Info Stealer powershell suspicious privilege Check memory Checks debugger Creates shortcut Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder WriteConsoleW Windows Email ComputerName DNS Cryptographic key 		2 9.2 ZeroCERT

keyword