popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
13276 2021-10-07 18:18 installer_2021-09-21_16-31.bmp  

6204c8a17955659856af5a12899414f5


Malicious Library AntiDebug AntiVM PE File PE32 OS Processor Check PDB Code Injection Checks debugger buffers extracted unpack itself WriteConsoleW Remote Code Execution DNS 		2 6.8 M ZeroCERT

13277 2021-10-07 18:18 LivelyScreenRecLy2109.bmp  

2b3291f262d10bf7111cceadd232103c


RAT Generic Malware PE File PE32 .NET EXE VirusTotal Malware MachineGuid Check memory Checks debugger unpack itself 		2.2 M 47 ZeroCERT

13278 2021-10-07 18:23 Sharefolder.exe  

168f3e8c4657a0fe90a2338f3971f6ed


RAT Gen1 Generic Malware Malicious Library UPX AntiDebug AntiVM PE File PE32 OS Processor Check MSOffice File PNG Format JPEG Format .NET EXE DLL PE64 VirusTotal Malware AutoRuns MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files ICMP traffic RWX flags setting unpack itself Windows utilities Check virtual network interfaces AppData folder AntiVM_Disk suspicious TLD VM Disk Size Check Tofsee Windows ComputerName DNS crashed 		14 20 4 5 12.8 M 24 ZeroCERT

13279 2021-10-07 18:23 sfx_123_207.exe  

52703313f94d0869dc584a1d9f681e74


Malicious Library UPX DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Internet API FTP ScreenShot Http API Steal credential Downloader P2P persistence AntiDebug AntiVM PE File PE32 OS Processor Check DLL VirusTotal Malware PDB suspicious privilege Code Injection Check memory Checks debugger WMI unpack itself Windows utilities suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check Windows ComputerName Remote Code Execution DNS 		1 7.8 M 42 ZeroCERT

13280 2021-10-08 08:16 Employee%20Update%20-%20Covid....  

bb6169cac9a125cd63eedeb3893b920b


VBA_macro Generic Malware MSOffice File VirusTotal Malware Malicious Traffic unpack itself DNS 		1 2 3.2 4 ZeroCERT

13281 2021-10-08 08:24 trehjugdr4et6u.msi  

065e70c3b1e6841074a25aafa95e20bd


MSOffice File Malware download VirusTotal Malware suspicious privilege Malicious Traffic Check memory Checks debugger unpack itself AntiVM_Disk VM Disk Size Check ComputerName 		3 2 3 3.0 4 ZeroCERT

13282 2021-10-08 09:44 4.txt.ps1  

63226c632623e5e764ca4aa9bbbdfcd0


Generic Malware Antivirus VirusTotal Malware Check memory unpack itself WriteConsoleW Windows Cryptographic key 		1.6 10 ZeroCERT

13283 2021-10-08 09:46 vbc.exe  

48fdc5b6bdb43e972dff31304cf10ced


UPX PE File PE32 VirusTotal Malware Check memory RWX flags setting unpack itself Remote Code Execution 		2.2 36 guest

13284 2021-10-08 10:00 vbc.exe  

48fdc5b6bdb43e972dff31304cf10ced


Generic Malware Malicious Packer UPX PE File PE32 VirusTotal Malware Check memory RWX flags setting unpack itself Remote Code Execution 		2.2 36 r0d

13285 2021-10-08 11:20 rundll32.exe  

e8a4177eb1ca6ffcb252e7cd2e8b1814


NPKI Gen1 Generic Malware Malicious Library Malicious Packer AntiDebug AntiVM PE File PE32 .NET EXE OS Processor Check DLL JPEG Format Browser Info Stealer Malware download Vidar VirusTotal Email Client Info Stealer Malware Phishing Cryptocurrency wallets Cryptocurrency suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW anti-virtualization VM Disk Size Check installed browsers check OskiStealer Stealer Windows Chrome Browser Email ComputerName Password 		9 2 7 17.0 17 ZeroCERT

13286 2021-10-08 11:20 nwamazx.exe  

ab4ad2e9e771c6b25a452fb94b1cb033


NPKI Gen1 Generic Malware Malicious Library Malicious Packer AntiDebug AntiVM PE File PE32 .NET EXE OS Processor Check DLL JPEG Format Browser Info Stealer Malware download Vidar Email Client Info Stealer Malware Phishing Cryptocurrency wallets Cryptocurrency suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Collect installed applications suspicious process AppData folder WriteConsoleW anti-virtualization installed browsers check OskiStealer Stealer Windows Chrome Browser Email ComputerName Password 		9 2 6 14.4 M ZeroCERT

13287 2021-10-08 11:21 loader1.exe  

b20cb526e8691731581ef0aa0d912a01


NSIS Malicious Library PE File PE32 OS Processor Check DLL Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder installed browsers check Browser Email ComputerName DNS Software crashed 		1 1 6 1 11.2 M 45 ZeroCERT

13288 2021-10-08 11:21 IMG_741000106237874.exe  

55e2cd3776de61fd52462013c5eea531


RAT PWS .NET framework Generic Malware PE File PE32 .NET EXE VirusTotal Malware Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Tofsee ComputerName 		1 4 1 3.2 M 36 ZeroCERT

13289 2021-10-08 11:23 .svchost.exe  

d53b5fa49804ec991df980cb9797676f


Generic Malware UPX PE File PE32 VirusTotal Malware Check memory RWX flags setting unpack itself Remote Code Execution 		2.0 M 27 ZeroCERT

13290 2021-10-08 11:23 GY.exe  

23c8eb156f6124878f21cf5c98c18071


UPX Malicious Library PE File PE32 VirusTotal Malware AutoRuns Creates executable files RWX flags setting unpack itself AppData folder Windows Remote Code Execution crashed 		4.2 M 25 ZeroCERT

keyword