popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
13066 2021-10-04 10:26 dow.exe  

7a29daa31a1ce60f705519b9e1b8648c


PWS .NET framework Generic Malware AntiDebug AntiVM PE File .NET EXE PE32 FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		16 18 2 8.4 23 ZeroCERT

13067 2021-10-04 10:26 pm.exe  

7bbc2539d7196864b7745b8065a35e7e


RAT NPKI Generic Malware Antivirus PE64 PE File VirusTotal Malware powershell AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process Windows ComputerName Cryptographic key crashed 		9.0 M 27 ZeroCERT

13068 2021-10-04 10:27 det-066.exe  

cf38251ea9830826534aead3ce07a6d0


RAT Generic Malware AntiDebug AntiVM PE File .NET EXE PE32 FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself DNS 		8 18 1 9.0 40 ZeroCERT

13069 2021-10-04 10:28 qingdi1  

6c3a8a55969e4251cd8c8bd3802efb9a


Malicious Library AntiDebug AntiVM ELF VirusTotal Email Client Info Stealer Malware Code Injection Check memory Checks debugger unpack itself Browser Email 		4.0 M 36 ZeroCERT

13070 2021-10-04 10:31 dow-08.exe  

649ef81c0ce0f13b1197ccdb30685547


PWS .NET framework Generic Malware AntiDebug AntiVM PE File .NET EXE PE32 FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted ICMP traffic unpack itself Windows Cryptographic key 		11 21 2 9.2 M 37 ZeroCERT

13071 2021-10-04 10:33 dow-01.exe  

26c2ebe63533d05a859e5f990091e487


PWS .NET framework Generic Malware AntiDebug AntiVM PE File .NET EXE PE32 FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted ICMP traffic unpack itself 		9 17 4 9.0 M 36 ZeroCERT

13072 2021-10-04 10:35 dow-0.exe  

fa8622d626b79da91b5cbb891ccf8c40


PWS .NET framework Generic Malware AntiDebug AntiVM PE File .NET EXE PE32 FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		9 16 1 8.2 M 37 ZeroCERT

13073 2021-10-04 11:59 invoice.wbk  

a77137852cc21108b4b4d23b82fa52a5


RTF File doc AntiDebug AntiVM LokiBot Malware download VirusTotal Malware c&c MachineGuid Malicious Traffic Check memory Checks debugger exploit crash unpack itself Windows Exploit DNS crashed Downloader 		2 3 11 5.4 28 ZeroCERT

13074 2021-10-04 16:21 hofile.exe  

d111824423a23721dc128900f359067a


Malicious Library PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself Remote Code Execution 		2.0 20 guest

13075 2021-10-04 17:54 docfile221021.exe  

4e6047ebadcbb3b2c9e75fbd130f5041


RAT PWS .NET framework Generic Malware Antivirus DNS AntiDebug AntiVM PE File .NET EXE PE32 Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key 		1 12.8 ZeroCERT

13076 2021-10-04 17:55 Bank Statement.exe  

516ff4e98725f65ba5447f4dfb2875b2


RAT PWS .NET framework Generic Malware DNS AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself human activity check Windows DNS DDNS 		4 1 12.6 16 ZeroCERT

13077 2021-10-04 17:57 NEW ORDER.exe  

e09c3b0402059d9ee50591a2832a06b1


PWS .NET framework Generic Malware Antivirus DNS AntiDebug AntiVM PE File .NET EXE PE32 Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS 		4 1 15.2 ZeroCERT

13078 2021-10-04 17:57 HTG~0000098765434567-098765432...  

a3fb8baaebd4544f3eca7dd0d4da2ad0


RAT PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) DNS AntiDebug AntiVM PE File .NET EXE PE32 Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process AppData folder WriteConsoleW human activity check Windows ComputerName DNS DDNS 		2 1 14.6 ZeroCERT

13079 2021-10-04 17:58 NEW ORDER EXPO_51052 IMG002398...  

2f0f161e125227509d9c0dbd5cef40b3


Generic Malware Antivirus DNS AntiDebug AntiVM PE File .NET EXE PE32 powershell Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS 		4 1 15.4 ZeroCERT

13080 2021-10-04 18:00 QUOTATION-10-01-2021.doc.exe  

64a94e95263d5d44c99f69d16188d4b6


Generic Malware DNS AntiDebug AntiVM PE File .NET EXE PE32 Malware download Nanocore VirusTotal Malware c&c Buffer PE suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName DNS 		1 1 14.0 43 ZeroCERT

keyword