popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
13861 2021-10-21 08:13 451200001308IMG.exe  

104bfff4e7a7f04efd06e865cce96c4d


RAT Generic Malware PE File PE32 .NET EXE VirusTotal Malware Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces Tofsee ComputerName 		1 4 1 3.2 32 ZeroCERT

13862 2021-10-21 08:18 vbc.exe  

f83c7eb1b65ad46bc00d8c95ce4c1275


Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself Remote Code Execution 		2.2 30 ZeroCERT

13863 2021-10-21 08:21 iKrjYFB.exe  

d75805611df55ea0b527e2c8b37be919


Emotet Malicious Library UPX Create Service DGA Socket Steal credential DNS Internet API Hijack Network Code injection Sniff Audio HTTP KeyLogger FTP Escalate priviledges Downloader ScreenShot Http API P2P persistence AntiDebug AntiVM PE File PE32 OS Proc Browser Info Stealer Malware download FTP Client Info Stealer VirusTotal Malware Buffer PE AutoRuns PDB suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted WMI Creates executable files unpack itself Windows utilities Collect installed applications Check virtual network interfaces AppData folder malicious URLs AntiVM_Disk suspicious TLD WriteConsoleW VM Disk Size Check installed browsers check SectopRAT Windows Browser Backdoor ComputerName Remote Code Execution DNS Cryptographic key Software crashed 		2 6 1 19.2 34 ZeroCERT

13864 2021-10-21 08:25 invc_000780000060.wbk  

226035129ac9645a54d6e4af36f5b5b0


RTF File doc Malware download VirusTotal Malware Malicious Traffic exploit crash unpack itself Windows Exploit DNS crashed Downloader 		1 2 6 4.0 28 ZeroCERT

13865 2021-10-21 08:32 inv_0098788000.wbk  

9aaf287388698afd5ef8bfeb1fb8ee24


RTF File doc Malware download VirusTotal Malware Malicious Traffic buffers extracted RWX flags setting exploit crash Windows Exploit DNS crashed Downloader 		13 28 7 10 4.6 M 30 ZeroCERT

13866 2021-10-21 08:33 FTD_21000160852.exe  

63c984080f6aaec5b7f2dca4af13c5f8


RAT Generic Malware UPX SMTP KeyLogger AntiDebug AntiVM PE File OS Processor Check PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware AutoRuns suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Windows utilities Check virtual network interfaces suspicious process WriteConsoleW IP Check Tofsee Windows Browser Email ComputerName Remote Code Execution DNS Cryptographic key DDNS Software crashed 		2 5 3 15.6 33 ZeroCERT

13867 2021-10-21 08:34 updater.exe  

4ae4ab4a84a78e5b00b5edf0941d4354


RAT PWS .NET framework Generic Malware Antivirus UPX PE File PE32 .NET EXE PDB Check memory Checks debugger unpack itself human activity check DNS DDNS 		2 1 3.2 ZeroCERT

13868 2021-10-21 08:38 toolspab2.exe  

0aa9e41d45a609dae2f9e507f38f24bb


Malicious Library UPX AntiDebug AntiVM PE File OS Processor Check PE32 Malware PDB Code Injection Checks debugger buffers extracted unpack itself Remote Code Execution 		6.4 ZeroCERT

13869 2021-10-21 08:42 biz-1268037327.xls  

5bba6b76de46547bcb02fd539261257e


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		2 4 2 3.6 guest

13870 2021-10-21 08:44 biz-1268549549.xls  

ddfbaf703dde24059d7176488119a78c


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		2 4 2 3.6 guest

13871 2021-10-21 08:46 biz-1267896036.xls  

420b2cc7bf39507ded9f96d8af3745e9


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		2 4 2 3.6 guest

13872 2021-10-21 08:52 vbc.exe  

36e60a2ecd13869a78ad7bc9312681d0


NSIS Malicious Library UPX PE File PE32 DLL FormBook Malware download Malware suspicious privilege Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder 		14 30 2 11 5.0 M ZeroCERT

13873 2021-10-21 09:04 vbc.exe  

7e03d277e60e3ab52416937b82a9f23d


Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself Remote Code Execution 		2.4 47 ZeroCERT

13874 2021-10-21 10:40 http://209.141.41.233/Porcal4....  

27828516c38739491a3d20e733850aa5


Gen2 Antivirus Malicious Library UPX Create Service DGA Socket Steal credential DNS Internet API Hijack Network Code injection Sniff Audio HTTP KeyLogger FTP Escalate priviledges Downloader ScreenShot Http API P2P persistence AntiDebug AntiVM MSOffice Fil VirusTotal Malware Code Injection Malicious Traffic Creates executable files exploit crash unpack itself Windows utilities AppData folder malicious URLs Tofsee Windows Exploit DNS crashed 		1 5 6.2 M 8 Kim.GS

13875 2021-10-21 11:07 Porcal4.exe  

27828516c38739491a3d20e733850aa5


Gen2 Gen1 RAT Generic Malware Antivirus Malicious Library UPX ASPack Malicious Packer PE File OS Processor Check PE32 PNG Format DLL .NET DLL MSOffice File .NET EXE VirusTotal Malware Buffer PE PDB suspicious privilege Check memory Checks debugger buffers extracted Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check Ransomware ComputerName Remote Code Execution DNS crashed 		1 6.4 M 8 ZeroCERT

keyword