popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
13441 2021-10-12 11:03 REVISED PURCHASE ORDER pdf.exe  

3a73f43f58edbac5b2a007e7fcf807af


RAT PWS .NET framework Generic Malware Antivirus DNS AntiDebug AntiVM PE File PE32 .NET EXE Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut ICMP traffic unpack itself Windows utilities suspicious process malicious URLs WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS 		3 1 14.8 ZeroCERT

13442 2021-10-12 11:05 Scanned documents copy doc_jpe...  

cd8989a4c98c56de9ed561206b3ec52c


NPKI Generic Malware Antivirus DNS Code injection AntiDebug AntiVM PE File PE32 OS Processor Check .NET EXE powershell Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS 		3 1 14.8 ZeroCERT

13443 2021-10-12 11:09 doc-1114816112.xls  

aa6fecbcd7c0b2728acb3cbd8be81417


VBA_macro Generic Malware Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		3 6 2 3.6 guest

13444 2021-10-12 11:11 doc-1112793309.xls  

e270dccc95b502bb0f3e8efe9ea80f26


VBA_macro Generic Malware Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		3 6 2 3.6 guest

13445 2021-10-12 11:14 doc-1114667776.xls  

7553ddb9cacc62a99f6d9d59fc4ae003


VBA_macro Generic Malware Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		3 6 2 3.6 guest

13446 2021-10-12 14:29 http://185.222.57.85/00011/vbc...  

cda5dff7abc114308bd9491cacb36e0d


RAT PWS .NET framework Generic Malware DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Hijack Network Internet API FTP ScreenShot Http API Steal credential Downloader P2P persistence AntiDebug AntiVM PE File PE Malware download VirusTotal Malware Code Injection Malicious Traffic Creates executable files exploit crash unpack itself Windows utilities AppData folder malicious URLs Tofsee Windows Exploit DNS crashed Downloader 		1 6 6.2 M 33 guest

13447 2021-10-12 15:52 http://172.245.163.145/new/new...  

25c79316d2ccebb98a7ae05864d447b3


RAT PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) AntiDebug AntiVM MSOffice File PE File PE32 .NET EXE Malware download VirusTotal Malware Code Injection Malicious Traffic Creates executable files exploit crash unpack itself Windows utilities AppData folder Tofsee Windows Exploit DNS crashed Downloader 		1 6 5.2 M 23 Kim.GS

13448 2021-10-12 18:22 vbc.exe  

5d3ab00975539e36a4175835d3fc15e6


UPX Malicious Library PE File PE32 VirusTotal Malware 		1.0 13 ZeroCERT

13449 2021-10-12 18:24 tt.exe  

82e8c0c279d95dc0f9ab425cdfeffdec


Antivirus PE File PE32 VirusTotal Malware AutoRuns Creates executable files unpack itself AppData folder sandbox evasion Windows 		2 7.6 M 50 ZeroCERT

13450 2021-10-12 18:25 doitgood.exe  

b8772380cffacc7cc944c92e4bcfd506


RAT Generic Malware SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows ComputerName crashed 		8.8 M 24 ZeroCERT

13451 2021-10-12 18:26 vbc.exe  

5197fb0ac1eee3ae19fcf6117ea49e9a


NSIS Malicious Library PE File PE32 DLL FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Creates executable files ICMP traffic unpack itself AppData folder 		24 23 2 6 8.0 M 23 ZeroCERT

13452 2021-10-12 18:27 dllhost.exe  

1fe73fe4d37cae6a02262b5164f3def0


RAT PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		1 3 2 9.0 20 ZeroCERT

13453 2021-10-12 18:27 xnewlooksetup_02ucpdqhtploavf8...  

cc0b5f382a9b229b6b5fc5b441e09dc9


Generic Malware UPX Malicious Library Malicious Packer PE File PE32 OS Processor Check DLL PE64 VirusTotal Malware Checks debugger Creates executable files unpack itself AppData folder DNS 		1 3.4 M 24 ZeroCERT

13454 2021-10-12 18:29 sefile.exe  

723f6ae7f4c00cfee0fbb5eb3a92cc62


Malicious Library PE File PE32 OS Processor Check PDB unpack itself Remote Code Execution 		1.4 M ZeroCERT

13455 2021-10-12 18:39 DOC-10-11-2021.exe  

a334a1e5158e652d89bedf83421569ab


RAT Generic Malware DNS AntiDebug AntiVM PE File PE32 .NET EXE Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces human activity check Tofsee Windows DNS Cryptographic key crashed 		1 3 1 13.4 ZeroCERT

keyword