popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
13621 2021-10-15 09:51 vbc.exe  

81ecab9fa2aa18c3d5dc61e9b2bebb7b


RAT PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		6 15 2 7.8 M 16 ZeroCERT

13622 2021-10-15 09:53 vbc.exe  

e1ece154e7d217115851bb74b8b79e24


RAT Generic Malware Admin Tool (Sysinternals etc ...) Antivirus SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware powershell PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself powershell.exe wrote suspicious process Windows Browser Email ComputerName Cryptographic key Software crashed 		13.6 M 27 ZeroCERT

13623 2021-10-15 09:53 h_online.exe  

2bfef42ea03e4fbb32243da6cb861205


PWS Loki[b] Loki.m .NET framework NPKI Generic Malware DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself Checks Bios Detects VirtualBox malicious URLs AntiVM_Disk VMware anti-virtualization VM Disk Size Check installed browsers check Browser Email ComputerName DNS Software 		1 16.4 M 42 ZeroCERT

13624 2021-10-15 09:55 vbc.exe  

f11ebc7e0b269ee17f61f7a4ab4ce9ec


UPX Malicious Library PE File PE32 VirusTotal Malware 		1.0 M 14 ZeroCERT

13625 2021-10-15 09:55 CHILESKY.exe  

2838a508700df0b9ae80674c2f42ef4b


RAT Generic Malware PE File PE32 .NET EXE VirusTotal Malware Check memory Checks debugger unpack itself ComputerName 		1.4 6 ZeroCERT

13626 2021-10-15 09:58 vbc.exe  

da7b4c213039524dd2cd661cb20e62ae


PWS .NET framework Gen2 Emotet Gen1 Generic Malware NSIS Malicious Library UPX ASPack Malicious Packer Admin Tool (Sysinternals etc ...) Anti_VM AntiDebug AntiVM PE File PE32 OS Processor Check FormBook Malware download VirusTotal Malware AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files ICMP traffic unpack itself AppData folder installed browsers check Windows Browser DNS 		14 18 2 11.0 M 60 ZeroCERT

13627 2021-10-15 09:58 cssrss1.exe  

1bd356bd20a2de1c53bc28104ee97d18


RAT email stealer Generic Malware ASPack UPX Malicious Packer Malicious Library Antivirus Socket DNS Code injection KeyLogger Escalate priviledges Downloader persistence AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware powershell suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files unpack itself Windows utilities Disables Windows Security powershell.exe wrote Check virtual network interfaces suspicious process AppData folder malicious URLs AntiVM_Disk sandbox evasion WriteConsoleW VM Disk Size Check Tofsee Windows ComputerName DNS Cryptographic key crashed 		2 3 1 16.4 M 34 ZeroCERT

13628 2021-10-15 10:00 Dpo.exe  

19b40e11d12dc217a5fb301437c0d7f7


RAT PWS .NET framework email stealer BitCoin Generic Malware Malicious Library ScreenShot Steal credential DNS SMTP Code injection KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces malicious URLs AntiVM_Disk IP Check VM Disk Size Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key keylogger 		3 7 2 15.8 M 22 ZeroCERT

13629 2021-10-15 10:01 vbc.exe  

ab5135e71815ad27daf57be78754c85d


UPX PE File PE32 VirusTotal Malware Check memory RWX flags setting unpack itself Remote Code Execution 		2.2 M 34 ZeroCERT

13630 2021-10-15 10:05 nwaba.exe  

3567206f02eac9b9b004bf8f7ffad7a2


RAT BitCoin email stealer Generic Malware Malicious Library DNS SMTP Code injection KeyLogger ScreenShot Steal credential AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces malicious URLs AntiVM_Disk IP Check VM Disk Size Check Tofsee Windows Browser Email ComputerName Cryptographic key keylogger 		4 6 2 15.2 M 20 ZeroCERT

13631 2021-10-15 10:10 @haiz_install.exe  

7ae610290258f93dead5795ad70c793d


RAT Generic Malware UPX AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI ICMP traffic unpack itself Collect installed applications Check virtual network interfaces suspicious TLD installed browsers check Windows Browser ComputerName DNS Cryptographic key crashed 		2 4 1 14.0 M 35 ZeroCERT

13632 2021-10-15 10:10 Kofi.exe  

4e956950a9aea405936b0ba0653138ef


RAT PWS .NET framework BitCoin email stealer Generic Malware DNS SMTP Code injection KeyLogger ScreenShot Steal credential AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces malicious URLs AntiVM_Disk IP Check VM Disk Size Check Tofsee Windows Browser Email ComputerName Cryptographic key keylogger 		3 6 2 15.0 M 12 ZeroCERT

13633 2021-10-15 10:17 1562391525.exe  

604b759172262363118ab37833ca63bb


PE File PE32 VirusTotal Malware unpack itself Windows utilities WriteConsoleW Windows ComputerName 		3.0 M 30 r0d

13634 2021-10-15 10:22 1562391525.exe  

604b759172262363118ab37833ca63bb


Admin Tool (Sysinternals etc ...) PE File PE32 VirusTotal Malware unpack itself Windows utilities WriteConsoleW Windows ComputerName 		3.0 M 30 r0d

13635 2021-10-15 10:27 vbc.exe  

025eaccfdecb9df000e526122ce84aa2


Gorgon Group Generic Malware UPX PE File PE32 VirusTotal Malware Check memory RWX flags setting unpack itself Remote Code Execution 		2.6 M 31 r0d

keyword