popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
13846 2021-10-20 17:44 rundll32.exe  

725291dd1448ff28fe626c6dae96e7d4


RAT PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		16 17 2 12 8.4 M 22 ZeroCERT

13847 2021-10-20 17:45 vbc.exe  

95dbac1d5762155f81369b309e48d13f


Loki PWS Loki[b] Loki.m RAT .NET framework Generic Malware DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Report c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName DNS Software 		1 3 8 1 13.4 M 18 ZeroCERT

13848 2021-10-20 17:49 vbc.exe  

39b814d05cc6de9aeb935ac49c11e28f


PWS Loki[b] Loki.m RAT .NET framework Generic Malware DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName DNS Software 		1 2 6 1 13.4 M 15 ZeroCERT

13849 2021-10-20 17:50 boobb.exe  

975b9c5518e9839fd0c6ee927370edf2


RAT PWS .NET framework Generic Malware SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW Windows ComputerName Cryptographic key crashed 		12.0 M 27 ZeroCERT

13850 2021-10-20 17:50 news.exe  

d7eac25ddf1e2da8348052e2290bf485


NSIS Malicious Library UPX PE File PE32 DLL Malware download Nanocore Malware c&c Buffer PE suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself AppData folder human activity check Windows ComputerName DNS DDNS 		2 2 9.0 M ZeroCERT

13851 2021-10-20 17:52 migfbewnaeopmguywjfffrvgqg.exe  

2c4879e89081ba55d518f1c457072ac3


NPKI email stealer Generic Malware Malicious Library UPX Malicious Packer DNS Code injection KeyLogger Escalate priviledges Downloader persistence AntiDebug AntiVM PE File PE32 .NET EXE PE64 OS Processor Check DLL Browser Info Stealer VirusTotal Email Client Info Stealer Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself AntiVM_Disk VM Disk Size Check human activity check installed browsers check Windows Browser Email ComputerName DNS Cryptographic key DDNS crashed 		2 1 13.4 M 24 ZeroCERT

13852 2021-10-20 17:52 tdh_0082205005img.exe  

26108db5b69562376697d90215395c87


RAT Generic Malware UPX SMTP KeyLogger AntiDebug AntiVM PE File OS Processor Check PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows utilities Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName Remote Code Execution DNS Cryptographic key DDNS Software crashed 		2 4 3 15.0 M 37 ZeroCERT

13853 2021-10-20 17:52 Porcal4.exe  

27828516c38739491a3d20e733850aa5


Gen2 Gen1 RAT Generic Malware Antivirus Malicious Library UPX ASPack Malicious Packer PE File OS Processor Check PE32 PNG Format DLL .NET DLL MSOffice File .NET EXE VirusTotal Malware Buffer PE PDB suspicious privilege Check memory Checks debugger buffers extracted Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check Ransomware ComputerName Remote Code Execution DNS crashed 		1 6.4 M 5 ZeroCERT

13854 2021-10-20 17:52 dllhost.exe  

c78d5e89ebecb4d88d3ab36bc47fd7ba


RAT PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself DNS 		2 6 1 8.6 M 28 ZeroCERT

13855 2021-10-20 17:53 ooooo.exe  

11b360256d049349f51a67e92fd49ae4


AgentTesla(IN) Generic Malware Malicious Packer Malicious Library UPX PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Check memory Checks debugger unpack itself DNS 		1 3.0 M 44 ZeroCERT

13856 2021-10-20 17:56 origggg.exe  

ff6a62c5f7b65a3c8a193dad5705c563


AgentTesla(IN) RAT Generic Malware Malicious Packer Malicious Library UPX PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege Check memory Checks debugger unpack itself Windows Browser Email ComputerName Cryptographic key Software crashed keylogger 		6.4 M 43 ZeroCERT

13857 2021-10-20 18:00 1.ppam  

e5a35f8c565ddea415804d4b05244e28


Generic Malware Antivirus AntiDebug AntiVM PNG Format VirusTotal Malware AutoRuns suspicious privilege Code Injection Check memory Checks debugger buffers extracted WMI Creates shortcut Creates executable files RWX flags setting unpack itself Windows utilities suspicious process WriteConsoleW Tofsee Interception Windows ComputerName Cryptographic key 		12 10 1 10.4 31 ZeroCERT

13858 2021-10-21 08:07 WIRE TRANSFER.exe  

3d6ede6db43836cf8a5304f7e9f3a1cd


Generic Malware Admin Tool (Sysinternals etc ...) UPX DNS AntiDebug AntiVM PE File PE32 .NET EXE Malware download Nanocore Malware c&c Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder WriteConsoleW human activity check Windows ComputerName DNS DDNS 		2 2 14.8 ZeroCERT

13859 2021-10-21 08:08 invoice_00930003322.wbk  

59efb49438295ee8736f72f126d94ed5


RTF File doc Malware download VirusTotal Malware Malicious Traffic exploit crash unpack itself Windows Exploit DNS crashed Downloader 		1 2 6 4.2 33 ZeroCERT

13860 2021-10-21 08:11 kred.exe  

d5e1b1e2d4448b7af40c177a7cff819b


Generic Malware Themida Packer Malicious Library UPX PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Malware suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted WMI unpack itself Checks Bios Collect installed applications Detects VMWare Check virtual network interfaces VMware anti-virtualization installed browsers check Tofsee Windows Browser ComputerName Remote Code Execution Firmware DNS Cryptographic key Software crashed 		2 5 1 12.2 33 ZeroCERT

keyword