popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
13996 2021-10-23 10:23 details_010.21.doc  

aca3ce06cbd73347cfdc1019f37fa0b4


VBA_macro Malicious Packer Malicious Library UPX Word 2007 file format(docx) GIF Format PE64 PE File DLL Malware download VirusTotal Malware Check memory buffers extracted Creates shortcut Creates executable files RWX flags setting unpack itself suspicious process AntiVM_Disk VM Disk Size Check Interception Windows crashed 		1 2 3 8.4 10 ZeroCERT

13997 2021-10-23 10:27 Profit and Loss Statement.xlsx...  

a0c1ca01548be7690f2976742f068e67


Generic Malware Create Service DGA Socket Steal credential DNS Internet API Code injection Sniff Audio HTTP KeyLogger FTP Escalate priviledges Downloader ScreenShot Http API P2P AntiDebug AntiVM GIF Format VirusTotal Malware MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted wscript.exe payload download Creates shortcut Creates executable files RWX flags setting unpack itself Check virtual network interfaces suspicious process malicious URLs WriteConsoleW Tofsee Interception Advertising Google ComputerName DNS 		13 14 2 12.0 23 ZeroCERT

13998 2021-10-23 10:28 biz-1951660782.xls  

8c4ebf556800331468c722f83c670a6f


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		3 6 2 3.6 guest

13999 2021-10-23 10:30 biz-1951697195.xls  

c4b92b6602eef756c2d357d707ec4001


Downloader MSOffice File RWX flags setting unpack itself suspicious process Tofsee 		3 6 2 3.6 guest

14000 2021-10-25 09:23 biz-1951697195.xls  

c4b92b6602eef756c2d357d707ec4001


Downloader KeyLogger ScreenShot AntiDebug AntiVM MSOffice File Code Injection unpack itself 		2.0 guest

14001 2021-10-25 09:43 socks2010.exe  

bf03442f038443b9e4eff1081bb51c38


Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself Remote Code Execution 		2.4 51 ZeroCERT

14002 2021-10-25 09:43 socks12110.exe  

fa1bbe98e6ecfc6ac3e8e9c881a7532a


Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself Remote Code Execution 		2.6 51 ZeroCERT

14003 2021-10-25 11:57 Device-4159546084121719159.htm...  

eb67fb7fe4864f7ea2c64921c82801f3


AntiDebug AntiVM MSOffice File Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		2 5 2 3.8 Bird

14004 2021-10-25 13:27 vbc.exe  

db0086d6c41fea58417b589f20de1b52


Loki NSIS Malicious Library UPX PE File PE32 DLL Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder installed browsers check Browser Email ComputerName DNS Software 		2 2 10 1 10.4 47 JYC

14005 2021-10-25 13:43 136.exe  

64420e27dd8930254ff853f4bbcfbbf4


RAT Generic Malware PE File PE32 .NET EXE VirusTotal Malware 		1.2 46 ZeroCERT

14006 2021-10-25 16:12 2.exe  

294fab1523dc3b50cbcc120e67946a5b


Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware DNS 		1 4.0 M 56 guest

14007 2021-10-25 16:56 sefile3.exe  

44a8c9e3ca634b851c48ab01349f5d8a


Malicious Library UPX PE File PE32 VirusTotal Malware PDB unpack itself Remote Code Execution 		2.4 41 guest

14008 2021-10-25 17:00 vbc.exe  

4ff00f9a22ee7a1e2dc3890e6fc59d05


Loki NSIS Malicious Library UPX PE File PE32 DLL Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName DNS Software 		1 2 10 1 10.4 M 20 ZeroCERT

14009 2021-10-25 17:06 reason.exe  

5dc1d41e2f9969d85896921f7b4ae261


Generic Malware DNS AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware Buffer PE suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted WMI unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName DNS DDNS 		2 1 13.6 30 ZeroCERT

14010 2021-10-25 17:07 vbc.exe  

f184c7be5715b6cee3458d2b830788cf


Loki PWS Loki[b] Loki.m RAT .NET framework Generic Malware Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c PDB suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName Software 		1 2 7 1 13.0 M 11 ZeroCERT

keyword