Home
Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide
2020-06-10
Version history
2020-06-10
login
popup
Submissions
10
15
20
50
Request
Connection
hash(md5,sha256)
Signature
PE API
Tag or IDS
Icon
user nickname
Date range button:
Date range picker
First seen:
Last seen:
No
Date
Request
Urls
Hosts
IDS
Rule
Score
Zero
VT
Player
Etc
14236
2023-04-10 09:27
1.exe
c6d83d1d068d0a0e1bb9e38d6946402a
UPX
Malicious Library
OS Processor Check
PE32
PE File
unpack itself
Remote Code Execution
DNS
1
Info
×
162.19.139.184
1.6
ZeroCERT
14237
2023-04-10 09:10
Updater.exe
6fa2a8de3fc30b9c80d12c2ac4ad2e3f
PE64
PE File
VirusTotal
Cryptocurrency Miner
Malware
Cryptocurrency
DNS
CoinMiner
4
Info
×
pastebin.com(104.20.68.143) - mailcious
xmr.2miners.com(162.19.139.184) - mailcious
162.19.139.184
172.67.34.170 - mailcious
2
Info
×
ET INFO Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com)
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner)
1.6
M
51
ZeroCERT
14238
2023-04-08 07:00
VoiceControlEngine.exe
aa57f0d7a099773175006624cc891b29
PWS
.NET framework
RAT
Generic Malware
UPX
Antivirus
HTTP
Http API
Internet API
AntiDebug
AntiVM
.NET EXE
PE32
PE File
VirusTotal
Malware
powershell
AutoRuns
suspicious privilege
Code Injection
Check memory
Checks debugger
buffers extracted
Creates shortcut
Creates executable files
unpack itself
powershell.exe wrote
suspicious process
AppData folder
Windows
ComputerName
Cryptographic key
crashed
12.6
M
37
guest
14239
2023-04-08 06:57
FreeWMAToMP3Converter.exe
b4d654755e5fb496138ed0e9c4121e84
Emotet
Gen1
UPX
Malicious Library
Malicious Packer
AntiDebug
AntiVM
MZP Format
PE32
PE File
PNG Format
DLL
PE64
OS Processor Check
MSOffice File
GIF Format
JPEG Format
Code Injection
Check memory
Checks debugger
Creates shortcut
Creates executable files
RWX flags setting
unpack itself
Windows utilities
AppData folder
AntiVM_Disk
VM Disk Size Check
Tofsee
Windows
ComputerName
1
Keyword trend analysis
×
Info
×
http://mp3-tools.com/smart-mp3-converter.html
2
Info
×
mp3-tools.com(45.84.226.205)
45.84.226.205
2
Info
×
ET INFO TLS Handshake Failure
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
5.4
guest
14240
2023-04-08 06:56
FreeWMAToMP3Converter.exe
b4d654755e5fb496138ed0e9c4121e84
Emotet
Gen1
UPX
Malicious Library
Malicious Packer
AntiDebug
AntiVM
MZP Format
PE32
PE File
MSOffice File
PNG Format
DLL
PE64
OS Processor Check
GIF Format
JPEG Format
Code Injection
Check memory
Checks debugger
buffers extracted
Creates shortcut
Creates executable files
RWX flags setting
exploit crash
unpack itself
Windows utilities
AppData folder
AntiVM_Disk
VM Disk Size Check
Tofsee
Windows
Exploit
ComputerName
DNS
crashed
1
Keyword trend analysis
×
Info
×
http://mp3-tools.com/smart-mp3-converter.html
2
Info
×
mp3-tools.com(45.84.226.205)
45.84.226.205
2
Info
×
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
ET INFO TLS Handshake Failure
7.0
guest
14241
2023-04-08 06:55
FreeWMAToMP3Converter.exe
b4d654755e5fb496138ed0e9c4121e84
Emotet
Gen1
UPX
Malicious Library
Malicious Packer
AntiDebug
AntiVM
MZP Format
PE32
PE File
PNG Format
DLL
PE64
GIF Format
OS Processor Check
MSOffice File
JPEG Format
Code Injection
Check memory
Checks debugger
buffers extracted
Creates shortcut
Creates executable files
RWX flags setting
exploit crash
unpack itself
Windows utilities
AppData folder
AntiVM_Disk
VM Disk Size Check
Tofsee
Windows
Exploit
ComputerName
DNS
crashed
1
Keyword trend analysis
×
Info
×
http://mp3-tools.com/smart-mp3-converter.html
2
Info
×
mp3-tools.com(45.84.226.205)
45.84.226.205
2
Info
×
ET INFO TLS Handshake Failure
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
7.4
guest
14242
2023-04-08 06:31
Comcast_HotSpot_NextGenPeopleS...
4d8dc60169d7caa641d0ae52053405ff
PDF
guest
14243
2023-04-08 05:51
JoSetp.exe
ed59308f9e2b59ec4195a99788cee8ee
Confuser .NET
.NET EXE
PE32
PE File
VirusTotal
Malware
MachineGuid
Check memory
Checks debugger
unpack itself
Check virtual network interfaces
Tofsee
Ransomware
DNS
3
Info
×
topnewsdesign.xyz() - mailcious
iplogger.org(148.251.234.83) - mailcious
148.251.234.83
3
Info
×
ET POLICY IP Check Domain (iplogger .org in DNS Lookup)
ET POLICY IP Check Domain (iplogger .org in TLS SNI)
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
3.6
M
57
guest
14244
2023-04-07 18:25
VoiceControlEngine.exe
aa57f0d7a099773175006624cc891b29
PWS
.NET framework
RAT
Generic Malware
UPX
Antivirus
HTTP
Http API
Internet API
AntiDebug
AntiVM
.NET EXE
PE32
PE File
Malware download
VirusTotal
Malware
powershell
AutoRuns
suspicious privilege
Code Injection
Malicious Traffic
Check memory
Checks debugger
buffers extracted
Creates shortcut
Creates executable files
unpack itself
powershell.exe wrote
suspicious process
AppData folder
Windows
ComputerName
DNS
Cryptographic key
crashed
2
Keyword trend analysis
×
Info
×
http://45.159.189.105/bot/online?guid=TEST22-PC\\test22&key=6a2714906f1325d666e4cf9f6269c2352ccfb7e7f1a23c114287dc69ddf27cb0 - rule_id: 26212
http://45.159.189.105/bot/regex - rule_id: 26211
1
Info
×
45.159.189.105 - mailcious
1
Info
×
ET MALWARE Laplas Clipper - SetOnline CnC Checkin
2
Info
×
http://45.159.189.105/bot/online
http://45.159.189.105/bot/regex
14.6
M
34
ZeroCERT
14245
2023-04-07 18:24
Updater.exe
6fa2a8de3fc30b9c80d12c2ac4ad2e3f
PE64
PE File
VirusTotal
Cryptocurrency Miner
Malware
Cryptocurrency
DNS
CoinMiner
4
Info
×
pastebin.com(104.20.68.143) - mailcious
xmr.2miners.com(162.19.139.184) - mailcious
162.19.139.184
104.20.68.143 - mailcious
2
Info
×
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner)
ET INFO Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com)
1.6
M
51
ZeroCERT
14246
2023-04-07 18:02
Impulse.exe
951ac38437711fc0c4fc6268250a823d
Gen1
UPX
Malicious Library
OS Processor Check
PE64
PE File
DLL
ZIP Format
VirusTotal
Malware
Check memory
Creates executable files
crashed
1.8
M
22
ZeroCERT
14247
2023-04-07 17:59
auz.jar
fe4b915fc460a3efc2475946a62bc86a
ZIP Format
AutoRuns
suspicious privilege
Check memory
WMI
RWX flags setting
unpack itself
Windows utilities
Check virtual network interfaces
suspicious process
Windows
Java
ComputerName
crashed
1
Keyword trend analysis
×
Info
×
http://www.geoplugin.net/json.gp?ip=175.208.134.152
6
Info
×
checkmybones.dns.army(185.91.69.172)
carrozzeriabalestra.it(46.16.95.61)
www.geoplugin.net(178.237.33.50)
185.91.69.172
178.237.33.50
46.16.95.61 - mailcious
2
Info
×
ET INFO DYNAMIC_DNS Query to a *.dns .army Domain
ET POLICY Vulnerable Java Version 1.8.x Detected
4.8
ZeroCERT
14248
2023-04-07 17:57
1004234865.exe
8d2f112db11626030db59b4177770991
PE64
PE File
VirusTotal
Malware
crashed
2.2
M
41
ZeroCERT
14249
2023-04-07 17:57
CC.exe
0abca5a76379dc774f4c133a177cde59
NPKI
Generic Malware
UPX
Malicious Library
Malicious Packer
OS Processor Check
PE64
PE File
VirusTotal
Malware
crashed
1.4
M
47
ZeroCERT
14250
2023-04-07 17:45
20230406.exe
7875c200c4659e920e9c5091a34bc10e
Gen2
Downloader
UPX
Malicious Library
Antivirus
ASPack
ScreenShot
AntiDebug
AntiVM
OS Processor Check
PE32
PE File
JPEG Format
DLL
PE64
VirusTotal
Malware
Code Injection
Check memory
Creates executable files
unpack itself
Windows utilities
AppData folder
AntiVM_Disk
WriteConsoleW
VM Disk Size Check
Windows
4.8
9
guest
First
Previous
941
942
943
944
945
946
947
948
949
950
Next
Last
Total : 49,696cnts
Delete
×
Do you want to delete it?
View
×
Insert
×
http
domains
hosts
ips
Memo
Tag
Alert
×
Insert error....
keyword