popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
13576 2023-04-29 12:29 EdGen.exe  

591c537adab2a4a720f50d84de2b60ea


AntiDebug AntiVM MSOffice File Code Injection ICMP traffic RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		5 2 6.0 M ZeroCERT

13577 2023-04-29 09:56 NVDIA40.exe  

4a1f2dc9c8df4981eb8f8003afdf21f9


RAT Generic Malware UPX .NET EXE PE32 PE File VirusTotal Malware PDB Check memory Checks debugger unpack itself 		1.8 M 21 ZeroCERT

13578 2023-04-28 21:49 Info.plist  

f657748c487be57acf2028a6b0cbe26c


AntiDebug AntiVM Email Client Info Stealer suspicious privilege Checks debugger Creates shortcut unpack itself installed browsers check Browser Email ComputerName 		3.4 BRY

13579 2023-04-28 17:14 sddd.exe  

f30050237e1e4b07f13d8b4e4ecf8209


Formbook NSIS UPX Malicious Library PE32 PE File FormBook Malware download VirusTotal Malware suspicious privilege Malicious Traffic Check memory Creates executable files unpack itself Windows 		17 20 4 15 6.0 M 43 ZeroCERT

13580 2023-04-28 17:14 originalbuild.exe  

9f9583b07cf9622b9db6299ca6157012


RAT Generic Malware Antivirus .NET EXE PE32 PE File PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName DNS Cryptographic key 		1 6.0 M 28 ZeroCERT

13581 2023-04-28 17:14 locals.ps1  

f5e06be9bc58695ff043f1d9465fb519


Generic Malware Antivirus VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		4.8 2 ZeroCERT

13582 2023-04-28 17:13 build(3).exe  

8bc904cbf806e8b28b6c21f1321fa019


PWS .NET framework RAT Downloader Create Service DGA Socket DNS Code injection HTTP PWS[m] Sniff Audio Steal credential Http API P2P Internet API Escalate priviledges FTP KeyLogger ScreenShot AntiDebug AntiVM .NET EXE PE32 PE File Browser Info Stealer VirusTotal Malware Cryptocurrency wallets Cryptocurrency Telegram AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder WriteConsoleW IP Check Tofsee Ransomware Windows Browser ComputerName DNS 		2 7 5 10.0 M 52 ZeroCERT

13583 2023-04-28 17:12 vbc.exe  

3a15cf1904040c1ce7e87d05c6468d1e


Formbook PWS .NET framework AntiDebug AntiVM .NET EXE PE32 PE File VirusTotal Malware PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself DNS 		1 8.2 M 30 ZeroCERT

13584 2023-04-28 17:12 vbc.exe  

ec0a5abf67bd616d4b77dd264a10c643


UPX Malicious Library OS Processor Check PE32 PE File VirusTotal Malware PDB unpack itself Remote Code Execution 		2.0 M 23 ZeroCERT

13585 2023-04-28 17:10 vpn.exe  

4b32941cd92e048e6a2d16c6069edf62


NPKI Generic Malware UPX MPRESS Antivirus PE32 PE File Browser Info Stealer VirusTotal Malware Cryptocurrency wallets Cryptocurrency powershell suspicious privilege Check memory Checks debugger buffers extracted WMI heapspray Creates shortcut unpack itself Windows utilities Checks Bios Detects VMWare powershell.exe wrote suspicious process VMware anti-virtualization Ransomware Windows Browser ComputerName Remote Code Execution Firmware DNS Cryptographic key crashed 		1 14.6 M 50 ZeroCERT

13586 2023-04-28 09:43 ProjectFunding_B496.wsf  

de0e6380f06d01c12e312b58221c1fcd

VirusTotal Malware VBScript wscript.exe payload download ICMP traffic DNS Dropper 		1 1 10.0 2 ZeroCERT

13587 2023-04-28 09:10 ads.exe  

cd675f6fa51e9a1bca95f3eb11c78fc2


UPX Malicious Library OS Processor Check PE32 PE File VirusTotal Malware Checks debugger RWX flags setting unpack itself DNS crashed 		1 3.0 12 ZeroCERT

13588 2023-04-28 09:09 photo_410.exe  

522ae0a94eb64b2124168a956e661bc3


Gen1 Emotet PWS .NET framework RAT UPX Malicious Library Confuser .NET Malicious Packer Admin Tool (Sysinternals etc ...) CAB PE32 PE File OS Processor Check .NET EXE DLL Browser Info Stealer Malware download Amadey FTP Client Info Stealer Malware AutoRuns PDB suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Disables Windows Security Collect installed applications suspicious process AppData folder AntiVM_Disk WriteConsoleW VM Disk Size Check installed browsers check Windows Update Browser ComputerName Remote Code Execution DNS Cryptographic key Software crashed 		5 2 7 15.8 M ZeroCERT

13589 2023-04-28 09:08 ProjectFunding_D305.wsf  

254f413905e4ba561b0a85fa7c3a4790

VBScript wscript.exe payload download ICMP traffic DNS Dropper 		1 1 10.0 guest

13590 2023-04-28 09:07 ProjectFunding_B496.wsf  

de0e6380f06d01c12e312b58221c1fcd

VirusTotal Malware unpack itself crashed 		1.0 2 guest

keyword