popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
13816 2021-10-20 11:27 TDL_011560751103011IMG.exe  

637c0a1232a65aba8a98acb8ec9787af


RAT Generic Malware UPX SMTP KeyLogger AntiDebug AntiVM PE File OS Processor Check PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows utilities Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName Remote Code Execution DNS Cryptographic key DDNS Software crashed 		2 4 3 15.2 M 28 ZeroCERT

13817 2021-10-20 11:28 dby33.exe  

d576c9dc10e4705d5ee7a2d75349f45e


PWS Loki[b] Loki.m Malicious Packer PE File PE32 VirusTotal Malware 		1.4 M 60 ZeroCERT

13818 2021-10-20 11:30 .rundll32.exe  

2ff83d3323dc8b30d6d346e5a5bbdac8


PWS Loki[b] Loki.m RAT .NET framework Generic Malware Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName DNS Software 		1 1 6 1 13.8 M 21 ZeroCERT

13819 2021-10-20 11:31 vbc.exe  

2c426a574c85912e2fb7033c980ade76


Loki NSIS Malicious Library UPX PE File PE32 Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself installed browsers check Browser Email ComputerName DNS Software 		1 3 10 1 10.2 M 27 ZeroCERT

13820 2021-10-20 11:33 128.exe  

72bc361dc77ea1fd40bd6c2e542c0d38


Emotet NPKI Malicious Library UPX Create Service DGA Socket Steal credential DNS Internet API Hijack Network Code injection Sniff Audio HTTP KeyLogger FTP Escalate priviledges Downloader ScreenShot Http API P2P persistence AntiDebug AntiVM PE File PE32 OS VirusTotal Malware Buffer PE AutoRuns PDB Code Injection Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities AppData folder malicious URLs AntiVM_Disk WriteConsoleW VM Disk Size Check Windows ComputerName Remote Code Execution DNS Cryptographic key 		2 12.6 M 19 ZeroCERT

13821 2021-10-20 11:34 .vbc.exe  

9261cdcf86933da34b74afa3da380bc3


NPKI Malicious Library UPX PE File PE32 VirusTotal Malware RWX flags setting unpack itself Tofsee Remote Code Execution crashed 		3 4 1 3.4 M 25 ZeroCERT

13822 2021-10-20 11:38 rundll32.exe  

4d10925c2d52223135b1a2e069bc5ab0


RAT PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		10 9 1 2 9.4 M 25 ZeroCERT

13823 2021-10-20 11:39 TDH_1366621005IMG.exe  

6c616b75c178cecf679cd9b01c628c7a


PWS Loki[b] Loki.m RAT Generic Malware UPX DNS AntiDebug AntiVM PE File OS Processor Check PE32 .NET EXE VirusTotal Malware AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process malicious URLs WriteConsoleW Windows ComputerName Remote Code Execution 		10.4 M 11 ZeroCERT

13824 2021-10-20 13:20 1019_7169909343268.doc  

4e062eb96bf086392a2a33f0f2dd7e69


VBA_macro Generic Malware MSOffice File VirusTotal Malware RWX flags setting unpack itself 		2.8 25 ZeroCERT

13825 2021-10-20 13:55 1019_7169909343268.doc  

4e062eb96bf086392a2a33f0f2dd7e69


VBA_macro Generic Malware MSOffice File VirusTotal Malware unpack itself 		2.4 25 ZeroCERT

13826 2021-10-20 15:20 1019_7169909343268.doc  

4e062eb96bf086392a2a33f0f2dd7e69


VBA_macro Generic Malware MSOffice File Vulnerability VirusTotal Malware unpack itself 		3.0 25 guest

13827 2021-10-20 15:24 1019_7169909343268.doc  

4e062eb96bf086392a2a33f0f2dd7e69


VBA_macro Generic Malware MSOffice File Vulnerability VirusTotal Malware unpack itself 		3.0 25 guest

13828 2021-10-20 15:47 biz-14302409.xls  

0b87d22eedbc86e0209de18c85c079ac


Downloader MSOffice File RWX flags setting unpack itself suspicious process suspicious TLD Tofsee DNS 		4 8 5 4.4 guest

13829 2021-10-20 15:49 biz-1431840176.xls  

b0cca0af3bbafeae72288f34a065de04


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee DNS 		4 8 4 4.0 guest

13830 2021-10-20 15:51 vbc.exe  

b1e98b432deb419643d81c167fe0dc37


NSIS Malicious Library UPX Malicious Packer PE File PE32 OS Processor Check DLL FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder 		18 24 2 10 7.2 M 25 ZeroCERT

keyword