popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
13591 2023-04-28 09:07 Xjpclientser40.exe  

ffa8c73e6d2a1a51812008ec7f31105b


PWS .NET framework NPKI RAT Generic Malware Downloader UPX Create Service DGA Socket DNS Code injection HTTP PWS[m] Sniff Audio Steal credential Http API P2P Internet API Escalate priviledges FTP KeyLogger ScreenShot AntiDebug AntiVM OS Processor Check .N VirusTotal Malware AutoRuns PDB suspicious privilege Code Injection Check memory Checks debugger Creates shortcut Creates executable files unpack itself Windows utilities suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		5.6 4 ZeroCERT

13592 2023-04-28 07:48 payload  

994bde201ba16c5e33bba7d4e6cbe3f4


Loki_b Loki_m UPX Malicious Packer Malicious Library OS Processor Check PE32 PE File Browser Info Stealer VirusTotal Malware Cryptocurrency wallets Cryptocurrency Malicious Traffic buffers extracted unpack itself Collect installed applications installed browsers check Ransomware Browser ComputerName Remote Code Execution Firmware DNS 		1 1 1 8.0 M 41 ZeroCERT

13593 2023-04-28 07:23 d00390b7-c15a-4019-8240-7d3ab2...  

116857ca1574a5a36da3bb0ddff32eac


.NET EXE PE32 PE File VirusTotal Malware PDB Check memory Checks debugger unpack itself 		2.0 M 31 ZeroCERT

13594 2023-04-27 16:45 Thallium.exe  

8edbcdafc2b2752bb2391b62e9093218


PhysicalDrive Malicious Packer PE32 PE File VirusTotal Malware unpack itself DNS crashed 		1 2.4 M 52 ZeroCERT

13595 2023-04-27 16:45 ddata.jpg.ps1  

24c94559b2c3b1a22b0b8a4b6447df2d


Hide_EXE Generic Malware Antivirus VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut Creates executable files unpack itself suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		7.0 M 13 ZeroCERT

13596 2023-04-27 16:45 HY.exe  

a8ef418e2b5195e436df90c900c28f52


AgentTesla browser info stealer Google Chrome User Data Downloader ScreenShot Create Service Socket DNS PWS[m] Sniff Audio Internet API Escalate priviledges KeyLogger AntiDebug AntiVM PE64 PE File Browser Info Stealer Remcos VirusTotal Email Client Info Stealer Malware PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself AntiVM_Disk sandbox evasion VM Disk Size Check Windows Browser Email ComputerName DNS 		1 3 1 13.0 M 46 ZeroCERT

13597 2023-04-27 16:44 Mjmbjbvye.exe  

042f6ee1428d19409c719956e83f00a8


PWS .NET framework NPKI RAT Generic Malware Antivirus AntiDebug AntiVM .NET EXE PE32 PE File Browser Info Stealer FTP Client Info Stealer VirusTotal Malware powershell Telegram suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Collect installed applications powershell.exe wrote Check virtual network interfaces suspicious process installed browsers check Tofsee Windows Browser ComputerName DNS Cryptographic key Software crashed 		3 4 12.6 M 37 ZeroCERT

13598 2023-04-27 15:21 host1.exe  

4911f551695218389a6730f551720e5d


RAT Generic Malware task schedule Anti_VM ScreenShot AntiDebug AntiVM .NET EXE PE32 PE File Browser Info Stealer Malware download FTP Client Info Stealer NetWireRC VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Checks Bios Detects VMWare Check virtual network interfaces AntiVM_Disk WriteConsoleW VMware anti-virtualization VM Disk Size Check Tofsee DCRat Windows Browser ComputerName Firmware DNS Cryptographic key Software crashed 		14 3 3 12 17.4 M 17 ZeroCERT

13599 2023-04-27 15:18 system32.exe  

925a33d545b81303f95076ca52264c0a


RAT AntiDebug AntiVM .NET EXE PE32 PE File VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows Cryptographic key 		8.6 M 38 ZeroCERT

13600 2023-04-27 15:00 https://dl-mail.ymail.com/ws/d...  


AntiDebug AntiVM Code Injection unpack itself Windows utilities Tofsee Windows 		2 4 1 2.2 BRY

13601 2023-04-27 13:55 https://doc-0o-6g-docs.googleu...  


Downloader Create Service DGA Socket DNS Hijack Network Code injection HTTP PWS[m] Sniff Audio Steal credential Http API P2P Internet API Escalate priviledges persistence FTP KeyLogger ScreenShot AntiDebug AntiVM MSOffice File PNG Format JPEG Format Code Injection RWX flags setting exploit crash unpack itself Windows utilities malicious URLs Tofsee Windows Exploit DNS crashed 		1 2 2 4.2 BRY

13602 2023-04-27 11:36 x64.dll  

679795d1f387d9a6bedda306964f7aca


UPX Downloader Malicious Library OS Processor Check DLL PE64 PE File VirusTotal Malware PDB 		1.6 44 guest

13603 2023-04-27 11:33 x86.dll  

cc55779eab28eb65877eec251b731d5b


UPX Downloader Malicious Library OS Processor Check DLL PE32 PE File VirusTotal Malware PDB 		1.4 54 guest

13604 2023-04-27 10:23 doc.ps1  

f5e06be9bc58695ff043f1d9465fb519


Generic Malware Antivirus VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		4.8 2 ZeroCERT

13605 2023-04-27 10:05 vbc.exe  

c61c14e016aa835ade115c4e8463b20c


NSIS UPX Malicious Library PE32 PE File FormBook Malware download VirusTotal Malware suspicious privilege Malicious Traffic Check memory Creates executable files unpack itself suspicious TLD DNS 		13 15 6 9 4.8 M 38 ZeroCERT

keyword