popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
13231 2021-10-07 14:56 Swift Copy pdf.exe  

604ff60ab55652c44862fad411f633b1


Generic Malware Antivirus DNS AntiDebug AntiVM PE File PE32 .NET EXE Malware download Nanocore VirusTotal Malware c&c powershell Buffer PE AutoRuns PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS crashed 		3 2 14.6 36 조광섭

13232 2021-10-07 15:00 Swift Copy pdf.exe  

604ff60ab55652c44862fad411f633b1


Generic Malware Antivirus DNS AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware powershell Buffer PE AutoRuns PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		13.0 36 조광섭

13233 2021-10-07 15:05 Swift Copy pdf.exe  

604ff60ab55652c44862fad411f633b1


Generic Malware Antivirus DNS AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware powershell Buffer PE AutoRuns PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS crashed 		3 1 14.6 36 조광섭

13234 2021-10-07 15:14 Swift Copy pdf.exe  

604ff60ab55652c44862fad411f633b1


Generic Malware Antivirus DNS AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware powershell Buffer PE AutoRuns PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS 		3 1 14.4 36 조광섭

13235 2021-10-07 15:22 Swift Copy pdf.exe  

604ff60ab55652c44862fad411f633b1


Generic Malware Antivirus DNS AntiDebug AntiVM PE File PE32 .NET EXE Malware download Nanocore VirusTotal Malware c&c powershell Buffer PE AutoRuns PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS 		3 2 14.4 36 조광섭

13236 2021-10-07 15:41 256789876542TRT.exe  

cbc8ee3ae199445efb1591120d428e6b


PWS .NET framework NPKI Generic Malware Antivirus SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware powershell suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files unpack itself Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed 		2 4 4 16.2 22 guest

13237 2021-10-07 15:51 wmzr_2021-09-28_12-08.exe  

54de310a8f0a06c0141f2c00ee587736


Malicious Library DGA DNS Socket Create Service SMTP Sniff Audio Escalate priviledges KeyLogger Code injection Internet API ScreenShot Downloader AntiDebug AntiVM PE File PE32 OS Processor Check VirusTotal Malware AutoRuns PDB suspicious privilege Code Injection Checks debugger buffers extracted unpack itself AppData folder malicious URLs Windows Remote Code Execution DNS keylogger 		1 13.8 M 40 ZeroCERT

13238 2021-10-07 15:51 wmzr.exe  

cbf81c03578922e3b7137fbfd87c76c4


Malicious Library DGA DNS Socket Create Service SMTP Sniff Audio Escalate priviledges KeyLogger Code injection Internet API ScreenShot Downloader AntiDebug AntiVM PE File PE32 Malware download NetWireRC VirusTotal Malware AutoRuns PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself AppData folder malicious URLs BitRAT Windows ComputerName Remote Code Execution DNS keylogger 		1 2 13.0 M 42 ZeroCERT

13239 2021-10-07 15:52 eInvoice-20210805_200426_60083...  

ba6701b6fd76a5e17047d3f1e4aee69b


UPX Malicious Library PE File PE32 OS Processor Check VirusTotal Malware PDB unpack itself DNS 		1 3.2 M 50 ZeroCERT

13240 2021-10-07 16:07 Setup.exe  

329acf4d6a5e735c1fd3b3fc6c77d3f3


Gen2 RAT PWS .NET framework Trojan_PWS_Stealer Lazarus Family Emotet Generic Malware Themida Packer Credential User Data Malicious Packer Malicious Library ASPack Antivirus UPX Anti_VM SQLite Cookie DGA DNS Socket Create Service Sniff Audio Escalate pr Browser Info Stealer FTP Client Info Stealer VirusTotal Malware AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files ICMP traffic exploit crash unpack itself Windows utilities Disables Windows Security Checks Bios Collect installed applications Detects VMWare Check virtual network interfaces suspicious process AppData folder malicious URLs suspicious TLD sandbox evasion WriteConsoleW VMware anti-virtualization IP Check installed browsers check Tofsee Windows Exploit Browser ComputerName Remote Code Execution Firmware DNS Cryptographic key Software crashed 		35 58 12 3 29.6 M 44 guest

13241 2021-10-07 16:33 sfx_123_209.exe  

7b2ea8fcffd2ce8548c4be3e42dcb60f


Malicious Library UPX DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Internet API FTP ScreenShot Http API Steal credential Downloader P2P persistence Hijack Network AntiDebug AntiVM PE File PE32 OS Processor C PDB suspicious privilege Code Injection Check memory Checks debugger WMI Creates executable files unpack itself Windows utilities suspicious process AppData folder malicious URLs AntiVM_Disk WriteConsoleW VM Disk Size Check Windows ComputerName 		6.4 ZeroCERT

13242 2021-10-07 16:44 Clipper.exe  

a76095f2d5727733b3ca4bd8a51349a2


RAT PWS .NET framework Generic Malware Antivirus AntiDebug AntiVM PE File PE32 .NET EXE powershell suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName DNS Cryptographic key 		1 11.0 ZeroCERT

13243 2021-10-07 16:44 Setup12.exe  

f80a018bd3f70c14370944063f413f73


RAT Gen2 Emotet Generic Malware UPX Malicious Library ASPack PE File PE32 .NET EXE PE64 OS Processor Check Browser Info Stealer VirusTotal Malware suspicious privilege MachineGuid Malicious Traffic Check memory Checks debugger Creates shortcut Creates executable files unpack itself Check virtual network interfaces AntiVM_Disk IP Check VM Disk Size Check installed browsers check Browser ComputerName DNS 		3 11 1 2 9.8 M 46 ZeroCERT

13244 2021-10-07 16:44 askinstall59.exe  

335dce5db5fc26c48202cdfa6aa27e52


AgentTesla Gen2 Trojan_PWS_Stealer BitCoin browser info stealer Credential User Data Generic Malware Google Chrome Malicious Packer Malicious Library SQLite Cookie DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code Browser Info Stealer VirusTotal Malware PDB suspicious privilege Code Injection Malicious Traffic Checks debugger WMI Creates executable files ICMP traffic exploit crash unpack itself Windows utilities suspicious process malicious URLs WriteConsoleW installed browsers check Tofsee Windows Exploit Browser ComputerName Remote Code Execution DNS crashed 		4 8 3 3 11.6 M 38 ZeroCERT

13245 2021-10-07 17:00 mega.bmp  

477b1b2a2779f1a1d6e7ff42a5eb9772


AgentTesla Emotet Gen2 Trojan_PWS_Stealer RAT Gen1 BitCoin browser info stealer Credential User Data Generic Malware Google Chrome Malicious Library Malicious Packer SQLite Cookie UPX DGA DNS Socket Create Service Sniff Audio Escalate pr Browser Info Stealer Malware download VirusTotal Malware AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files exploit crash unpack itself Windows utilities Disables Windows Security Check virtual network interfaces suspicious process AppData folder malicious URLs AntiVM_Disk sandbox evasion WriteConsoleW IP Check VM Disk Size Check installed browsers check Tofsee Interception Windows Exploit Browser ComputerName DNS crashed Downloader 		28 45 16 24.2 M 45 ZeroCERT

keyword