popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
13366 2021-10-11 10:08 Chrome.exe  

8ab931942d6b5665a1917bc14bfd2071


Generic Malware PE64 PE File VirusTotal Malware Buffer PE suspicious privilege MachineGuid Code Injection Checks debugger buffers extracted exploit crash unpack itself Windows Exploit Cryptographic key crashed 		8.4 M 35 ZeroCERT

13367 2021-10-11 10:08 AnyDesk.exe  

2086fed5fce8f4c172a31a02ddad5391


RAT PWS .NET framework Generic Malware PE File PE32 .NET EXE VirusTotal Malware Buffer PE AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows Cryptographic key crashed 		7.4 M 42 ZeroCERT

13368 2021-10-11 10:09 vbc.exe  

fbc1ed64be96f47d5cc3fbcb21cce10f


RAT PWS .NET framework Gen2 Gen1 Emotet Generic Malware NSIS Malicious Library ASPack Malicious Packer UPX Admin Tool (Sysinternals etc ...) Anti_VM KeyLogger ScreenShot AntiDebug AntiVM PE File PE32 .NET EXE OS Processor Check VirusTotal Malware AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself AppData folder installed browsers check Windows Browser DNS 		1 11.8 M 24 ZeroCERT

13369 2021-10-11 10:11 95.exe  

60007c052e7372566d09c3402db31915


Generic Malware Antivirus PE File PE32 .NET EXE VirusTotal Malware powershell PDB suspicious privilege Malicious Traffic Check memory Checks debugger Creates shortcut Creates executable files RWX flags setting unpack itself Disables Windows Security powershell.exe wrote Check virtual network interfaces suspicious process Tofsee Windows ComputerName Cryptographic key crashed 		1 2 1 8.8 M 21 ZeroCERT

13370 2021-10-11 10:11 e.exe  

5df69875f996257406096d8d8b9fcdbe


Lazarus Family Themida Packer PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Checks Bios Collect installed applications Detects VMWare Check virtual network interfaces VMware anti-virtualization installed browsers check Tofsee Windows Browser ComputerName Firmware DNS Cryptographic key Software crashed 		2 5 2 11.4 M 50 ZeroCERT

13371 2021-10-11 10:13 AnyDesk.exe  

9636132ab7d9952ec2f9134615e9320c


AgentTesla RAT PWS .NET framework browser info stealer Generic Malware Google Chrome User Data Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection Downloader AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware Buffer PE AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows DNS Cryptographic key DDNS crashed keylogger 		2 1 12.6 M 41 ZeroCERT

13372 2021-10-11 10:14 pctool.exe  

4a67cb6ed0cf60ddcf3e45917898dec4


RAT PWS Loki[b] Loki.m Gen2 Gen1 Emotet Formbook .NET framework Generic Malware Themida Packer Malicious Library Malicious Packer UPX Admin Tool (Sysinternals etc ...) ASPack Antivirus DGA DNS Socket Create Service Sniff Audio Escalate priviledges Browser Info Stealer Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware powershell Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files RWX flags setting unpack itself Windows utilities Disables Windows Security Checks Bios Collect installed applications Detects VMWare powershell.exe wrote Check virtual network interfaces suspicious process AppData folder malicious URLs AntiVM_Disk suspicious TLD sandbox evasion WriteConsoleW VMware anti-virtualization IP Check VM Disk Size Check installed browsers check Tofsee Windows Browser Email ComputerName Firmware DNS Cryptographic key Software crashed 		26 41 8 3 31.2 M 36 ZeroCERT

13373 2021-10-11 10:15 ld.exe  

4327ed1671deb9f1b0169cf10680840a


Malicious Library PE File PE32 VirusTotal Malware PDB unpack itself Remote Code Execution 		2.4 M 45 ZeroCERT

13374 2021-10-11 10:17 fj.exe  

baf212e9711b33e14adcaef461189e40


NSIS Malicious Library PE File PE32 DLL FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder 		2 7 1 5.8 M 26 ZeroCERT

13375 2021-10-11 10:19 rollerkind.exe  

525b0a0e9ba85ab570d7c8ebef356711


Malicious Library PE File PE32 OS Processor Check VirusTotal Malware PDB unpack itself 		1.8 M 23 ZeroCERT

13376 2021-10-11 10:20 lv.exe  

4db7eb28029846ea78925a192dd837ae


Gen1 Gen2 Generic Malware Themida Packer Malicious Library Admin Tool (Sysinternals etc ...) Anti_VM Malicious Packer PE File PE32 DLL PE64 VirusTotal Malware Check memory Creates executable files unpack itself Checks Bios Detects VMWare AppData folder VMware anti-virtualization Windows Firmware crashed 		6.8 M 35 ZeroCERT

13377 2021-10-11 10:23 lv.exe  

9ce4e1f3f1e2a963f5fc8a644f8a98f8


Gen1 Gen2 Themida Packer Generic Malware Malicious Library Malicious Packer PE File PE32 DLL PE64 Check memory Creates executable files unpack itself Checks Bios Detects VMWare AppData folder VMware anti-virtualization Windows Firmware crashed 		5.8 M ZeroCERT

13378 2021-10-11 10:24 mix.exe  

26d5e1ae26ccb09891aa9d610a0331eb


Malicious Library PE File PE32 OS Processor Check VirusTotal Malware PDB unpack itself 		1.8 M 23 ZeroCERT

13379 2021-10-11 10:26 5t6yujh.exe  

211ca7c8d5fd20f7dcaebdbe354662be


NPKI Generic Malware Malicious Packer UPX Malicious Library Antivirus PE64 PE File PE32 .NET DLL DLL VirusTotal Malware powershell suspicious privilege MachineGuid Check memory Checks debugger Creates shortcut Creates executable files unpack itself Windows utilities powershell.exe wrote suspicious process AppData folder Windows ComputerName Cryptographic key 		8.6 M 40 ZeroCERT

13380 2021-10-11 10:27 vbc.exe  

7d22685ef9d80598a24d2f096e527da9


PWS .NET framework Gen2 Emotet Gen1 Generic Malware NSIS Malicious Library ASPack Malicious Packer UPX Admin Tool (Sysinternals etc ...) Anti_VM KeyLogger ScreenShot AntiDebug AntiVM PE File PE32 OS Processor Check .NET EXE VirusTotal Malware AutoRuns Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself suspicious process AppData folder installed browsers check Windows Browser 		10.0 M 60 ZeroCERT

keyword