Submissions

Date range button:

First seen:

Last seen:

No	Date	Request	Urls	Hosts	IDS	Score	Zero	VT	Player
13546	2023-05-03 09:29	12.ocx c7c3f41117bfe6c2635686e7dc2bfc65 Generic Malware UPX VMProtect Malicious Library PE32 PE File VirusTotal Malware Check memory RWX flags setting unpack itself AntiVM_Disk sandbox evasion VM Disk Size Check Browser		2		5.2	M	42	ZeroCERT

13547	2023-05-03 09:27	vbc.exe aee5842856560c4c7cec9b66f806f8a4 Loki_b Loki_m Socket DNS PWS[m] AntiDebug AntiVM .NET EXE PE32 PE File Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware PDB suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Browser Email ComputerName DNS Software		2		14.2	M	42	ZeroCERT

13548	2023-05-03 09:27	%23%23%23%23%23%23%23%23%23%23... dfe1daa92531bdf7c7f6665de38bcbd6 MS_RTF_Obfuscation_Objects RTF File doc Malware download VirusTotal Malware Malicious Traffic RWX flags setting exploit crash Windows Exploit DNS crashed Downloader	1 Keyword trend analysis	2	7 Info ET INFO Executable Download from dotted-quad Host ET MALWARE MSIL/GenKryptik.FQRH Download Request ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 ET POLICY PE EXE or DLL Windows file download HTTP ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	4.6	M	32	ZeroCERT

13549	2023-05-03 09:25	newvice.hta dc6d1be99f44f1ef994a923c6003e817 PWS .NET framework Generic Malware Antivirus SMTP PWS[m] KeyLogger AntiDebug AntiVM PowerShell .NET EXE PE32 PE File Malware download VirusTotal Malware powershell Telegram suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted heapspray Creates shortcut Creates executable files unpack itself powershell.exe wrote Check virtual network interfaces suspicious process AppData folder malicious URLs WriteConsoleW IP Check Tofsee Windows ComputerName DNS Cryptographic key DDNS keylogger	2 Keyword trend analysis	6	9 Info ET INFO TLS Handshake Failure ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET INFO DYNAMIC_DNS Query to a .dyndns .org Domain ET MALWARE 404/Snake/Matiex Keylogger Style External IP Check ET POLICY External IP Lookup - checkip.dyndns.org ET INFO DYNAMIC_DNS HTTP Request to a .dyndns .org Domain ET INFO DYNAMIC_DNS Query to *.dyndns. Domain ET HUNTING Telegram API Domain in DNS Lookup	17.8	M	16	ZeroCERT

13550	2023-05-03 09:25	vice.exe 0d4950c69afb9b3c9b2d52b7b5ae9d41 PWS .NET framework SMTP PWS[m] KeyLogger AntiDebug AntiVM .NET EXE PE32 PE File Malware download VirusTotal Malware Telegram PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself malicious URLs IP Check Tofsee DNS DDNS keylogger	1 Keyword trend analysis	4	9 Info ET INFO DYNAMIC_DNS Query to a .dyndns .org Domain ET INFO DYNAMIC_DNS Query to .dyndns. Domain ET INFO TLS Handshake Failure ET HUNTING Telegram API Domain in DNS Lookup ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) ET MALWARE 404/Snake/Matiex Keylogger Style External IP Check ET POLICY External IP Lookup - checkip.dyndns.org ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns .org Domain	10.0		42	ZeroCERT

13551	2023-05-03 09:00	IMG_5435.exe 3121ecc67e64fdf65b2b3c9f5966ed11 PWS .NET framework RAT .NET EXE PE32 PE File VirusTotal Malware MachineGuid Check memory Checks debugger unpack itself Check virtual network interfaces Tofsee		2	1	2.6		44	guest

13552	2023-05-02 17:43	officeFluidOneDsSink.f9690cf3.... 03c5f86a62e83d48d204b2231d1a92c2 crashed				0.2			BRY

13553	2023-05-02 17:15	setup1.exe 5d1d87f12f1fb0dd0b00af611c09557e Malicious Library PE32 PE File VirusTotal Malware PDB unpack itself				2.2		58	ZeroCERT

13554	2023-05-02 16:43	zxz668%20%282%29.exe 5812c5ec8f81f425d2bc75343e13358d UPX Malicious Library OS Processor Check PE32 PE File VirusTotal Malware unpack itself				1.2		26	ZeroCERT

13555	2023-05-02 09:59	vbc.exe 7df31d97b98a8830fddfc9f2930683ea Formbook RAT Hide_EXE AntiDebug AntiVM .NET EXE PE32 PE File FormBook Malware download VirusTotal Malware PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself	2 Keyword trend analysis	4	1	8.6		45	ZeroCERT

13556	2023-05-02 09:54	Oilio.bat 5ca1e10316dbc25689e663dc437e79c9 Downloader Create Service DGA Socket DNS Code injection HTTP PWS[m] Sniff Audio Steal credential Http API P2P Internet API Escalate priviledges FTP KeyLogger ScreenShot AntiDebug AntiVM suspicious privilege Check memory Checks debugger Creates shortcut unpack itself Windows utilities WriteConsoleW Windows ComputerName Cryptographic key				3.0			ZeroCERT

13557	2023-05-02 09:20	######################.doc 88a907c3e36d9ddfb106c9ad66408b46 MS_RTF_Obfuscation_Objects RTF File doc FormBook Malware download VirusTotal Malware Malicious Traffic RWX flags setting exploit crash Windows Exploit DNS crashed Downloader	2 Keyword trend analysis	4	8 Info ET INFO Executable Download from dotted-quad Host ET MALWARE MSIL/GenKryptik.FQRH Download Request ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 ET MALWARE FormBook CnC Checkin (GET) ET POLICY PE EXE or DLL Windows file download HTTP ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	4.6	M	33	ZeroCERT

13558	2023-05-02 09:19	IMG_5435.exe 3121ecc67e64fdf65b2b3c9f5966ed11 PWS .NET framework RAT .NET EXE PE32 PE File VirusTotal Malware MachineGuid Malicious Traffic Check memory Checks debugger unpack itself Check virtual network interfaces Tofsee	1 Keyword trend analysis	6	1	3.8		44	ZeroCERT

13559	2023-05-02 09:16	SvCpJuhbT.exe c726a4eba148b17c9ccf3692fbc90701 UPX Malicious Packer Malicious Library PE64 PE File VirusTotal Malware Check memory				1.6	M	19	ZeroCERT

13560	2023-05-02 07:43	MsMpEng.hta 6bf27371c148d5fc227f4acf45cec231 Generic Malware Antivirus PowerShell VirusTotal Malware powershell suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files RWX flags setting unpack itself Windows utilities Check virtual network interfaces suspicious process WriteConsoleW Windows ComputerName DNS Cryptographic key	1 Keyword trend analysis	1		11.0	M	21	ZeroCERT