popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
13201 2021-10-07 11:06 palingo.exe  

5e58e1e3a97f41b316b0c6f741437957


RAT PWS .NET framework Generic Malware SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW Windows ComputerName DNS crashed 		1 11.2 M 26 ZeroCERT

13202 2021-10-07 11:07 new.exe  

09aca0174709b01f57cfa3a0a354dd92


PWS Loki[b] Loki.m Generic Malware DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Browser Email ComputerName DNS Software crashed 		1 1 6 1 12.8 M 16 ZeroCERT

13203 2021-10-07 11:09 vbc.exe  

6e095f0e6bbdce41509ccf3dcdc44daa


NSIS Malicious Library PE File PE32 OS Processor Check DLL Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder installed browsers check Browser Email ComputerName DNS Software crashed 		1 2 6 1 11.0 M 36 ZeroCERT

13204 2021-10-07 11:10 vbc.exe  

96bd7548ea9c202bf6add33886f45ddb


UPX Malicious Library PE File PE32 FormBook Emotet Malware download VirusTotal Malware Buffer PE AutoRuns Code Injection Malicious Traffic buffers extracted Creates executable files ICMP traffic RWX flags setting unpack itself Tofsee Windows Remote Code Execution crashed 		13 24 3 9.4 M 21 ZeroCERT

13205 2021-10-07 11:11 mpomzx.exe  

86d0a0cbb77b6157d2da7ab7b5d1c2be


RAT PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		2 4 1 1 9.2 M 38 ZeroCERT

13206 2021-10-07 11:14 rer.exe  

2d22112d700c43db2b3baa6b2e38d625


RAT PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		9 21 1 8 8.2 M ZeroCERT

13207 2021-10-07 11:23 1006_2966063104581.doc  

67b70c2d6a5191471273ee016ed9bb64


VBA_macro Generic Malware MSOffice File VirusTotal Malware RWX flags setting unpack itself 		2.8 21 ZeroCERT

13208 2021-10-07 11:24 3QN~34590987654345-09876544567...  

b48603e4ed26dfa441131ae8c057ee70


Generic Malware Admin Tool (Sysinternals etc ...) DNS AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process AppData folder WriteConsoleW human activity check Windows ComputerName DNS DDNS 		2 1 15.8 23 ZeroCERT

13209 2021-10-07 11:26 BASDL_093876533683-39876353678...  

5bbb68e81d7777d72512c1e848e67d4c


Generic Malware Admin Tool (Sysinternals etc ...) DNS AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process AppData folder WriteConsoleW human activity check Windows ComputerName DNS DDNS 		2 1 16.0 30 ZeroCERT

13210 2021-10-07 11:26 rer-01.exe  

413c530908571f9abfc506f6d5e988a3


RAT PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		3 6 1 8.0 M 22 ZeroCERT

13211 2021-10-07 11:42 doc-751250025.xls  

91652fe058d53d5089a87faaf85807b6


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		3 5 2 4.0 guest

13212 2021-10-07 11:44 doc-749589359.xls  

1ea1149661a2dae426377277fb4889f5


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		3 5 2 4.0 guest

13213 2021-10-07 11:45 DG673246572985.JPG.scr  

d0306e1fbf67885a13a8bcfdd9de2873


Gen2 Gen1 Generic Malware Malicious Library Malicious Packer DNS AntiDebug AntiVM PE File PE32 OS Processor Check Malware download Nanocore VirusTotal Malware c&c Buffer PE AutoRuns PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName Remote Code Execution DNS DDNS crashed 		2 2 16.2 30 ZeroCERT

13214 2021-10-07 11:47 doc-749666189.xls  

4b097e46c6a899b3c8f002cdeb700d12


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		3 5 2 4.0 guest

13215 2021-10-07 11:47 IMG-20210406-DOC0302738YJ5452....  

922eba1e37279113831e9f14b44ad5fa


UPX Malicious Library DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Internet API FTP ScreenShot Http API Steal credential Downloader P2P AntiDebug AntiVM PE File PE32 Emotet VirusTotal Malware Buffer PE AutoRuns Code Injection buffers extracted Creates executable files RWX flags setting unpack itself Windows utilities suspicious process WriteConsoleW Tofsee Windows ComputerName Remote Code Execution DNS crashed 		1 5 1 12.2 22 ZeroCERT

keyword