popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
13666 2021-10-16 13:01 FSD~039876363-30987.Com  

6dff455b59af4478e43bf4ef5daa9f6f


RAT PWS .NET framework Generic Malware UPX DNS AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process malicious URLs WriteConsoleW human activity check Windows ComputerName DNS DDNS 		2 1 15.4 24 ZeroCERT

13667 2021-10-16 13:03 Hjs~0093876353673-98376536783....  

7d63624fabc2c8179bc4935080fc0604


RAT PWS .NET framework Generic Malware UPX DNS AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName DNS DDNS 		2 1 15.0 28 ZeroCERT

13668 2021-10-16 13:04 New Order.exe  

ab21627d840ca71be2fd3d2397657a54


AgentTesla(IN) RAT Generic Malware UPX Antivirus Malicious Packer Malicious Library DNS SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut Creates executable files RWX flags setting unpack itself Windows utilities suspicious process AppData folder malicious URLs WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS crashed 		2 1 15.8 ZeroCERT

13669 2021-10-16 13:05 trend-1804391448.xls  

883e781ec9576dddd2277c73bc0bf26e


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		3 6 2 4.0 guest

13670 2021-10-16 13:08 trend-1804618933.xls  

7219c4992a9852eaf8b619b165c17cc7


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		3 6 2 4.0 guest

13671 2021-10-16 13:10 trend-1805140215.xls  

0c9961a5d8c7ee6bda37f75d1a59e8d9


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		3 6 2 4.0 guest

13672 2021-10-16 13:11 clipe.exe  

2c55be40df541743683b7be0cdcd31bc


RAT PWS .NET framework Generic Malware Antivirus AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware powershell suspicious privilege Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW Windows ComputerName Cryptographic key 		11.2 23 ZeroCERT

13673 2021-10-16 13:12 TRAN31.exe  

c53015e5e1f2f0fd85f21e00b65f80e2


RAT PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) Anti_VM Malicious Library SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE PDB suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows ComputerName Cryptographic key crashed 		8.4 ZeroCERT

13674 2021-10-16 13:20 csrss.exe  

b2fdec3c92a41a4e140b334184ef4e30


Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself 		2.2 M 47 ZeroCERT

13675 2021-10-16 13:22 rundll32.exe  

09c8e4c071be047a8e47bc7da2144a86


PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		16 19 3 4 8.4 M 17 ZeroCERT

13676 2021-10-16 13:22 .lsass.exe  

f1d94fcc611053cd5162e70dc36fddfa


RAT PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) UPX PE File PE32 .NET EXE VirusTotal Malware Check memory Checks debugger unpack itself crashed 		2.4 M 38 ZeroCERT

13677 2021-10-16 13:22 ole.exe  

53e0ffb4bae3b44092706ccb01cf99f5


NSIS Malicious Library UPX PE File PE32 DLL Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName DNS Software 		1 1 6 11.2 M 34 ZeroCERT

13678 2021-10-16 13:22 kv3.dll  

5c76498485ac6534b1b1aa0d6d543762


Generic Malware Malicious Library UPX PE File PE32 DLL VirusTotal Malware 		1.8 M 46 ZeroCERT

13679 2021-10-16 13:24 chrome.exe  

a6654b9757e5cecbd124a6d157c11ec0


RAT PWS .NET framework Generic Malware PE File PE32 .NET EXE VirusTotal Malware Checks debugger buffers extracted unpack itself Tofsee 		1 4 1 2.2 M 22 ZeroCERT

13680 2021-10-16 13:26 Oxqfxohrjqryauuonybvsdergonzry...  

a8521386eacf0f858077249faa381763


Malicious Library UPX Create Service DGA Socket Steal credential DNS Internet API Code injection Sniff Audio HTTP KeyLogger FTP Escalate priviledges Downloader ScreenShot Http API P2P AntiDebug AntiVM PE File PE32 Emotet VirusTotal Malware AutoRuns Code Injection buffers extracted Creates executable files RWX flags setting unpack itself Windows utilities suspicious process WriteConsoleW Tofsee Windows ComputerName crashed 		3 4 1 9.2 M 22 ZeroCERT

keyword