popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
14281 2021-10-29 17:55 awsa.exe  

d23ca1a68c0067ad0bd32dda2109c7db


PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted ICMP traffic unpack itself 		2 7.8 18 ZeroCERT

14282 2021-10-29 18:00 awsa.exe  

d23ca1a68c0067ad0bd32dda2109c7db


PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself 		4 8 1 9.2 18 ZeroCERT

14283 2021-10-29 18:02 vbc.exe  

8980a24aeb5d63283add48c1391ebc40


Malicious Library UPX PE File PE32 FormBook Emotet Malware download VirusTotal Malware Buffer PE AutoRuns Code Injection Malicious Traffic buffers extracted Creates executable files RWX flags setting unpack itself Tofsee Windows DNS crashed 		15 26 4 2 8.0 6 ZeroCERT

14284 2021-10-29 18:11 .csrss.exe  

c2c509a61a1d811d29ade6067e54c011


PWS Loki[b] Loki.m RAT Generic Malware UPX Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName Software 		1 2 7 14.4 14 ZeroCERT

14285 2021-10-29 18:20 PE.txt.ps1  

964c031b3cca7673f0af28adf461f2b3


PowerShell MZ Generic Malware Antivirus VirusTotal Malware Check memory unpack itself WriteConsoleW Windows Cryptographic key 		1.6 17 ZeroCERT

14286 2021-10-29 18:20 rundll32.exe  

5273a14914db4656593872056f2ced12


RAT PWS .NET framework Generic Malware PE File PE32 .NET EXE VirusTotal Malware PDB suspicious privilege Code Injection Check memory Checks debugger unpack itself 		5.2 16 ZeroCERT

14287 2021-10-29 18:20 adal.jar  

e83ec42ad9c282b28e4561dc5fec346d

VirusTotal Malware Check memory heapspray unpack itself Java 		2.2 19 ZeroCERT

14288 2021-10-29 18:22 vbc.exe  

d031d354378993ddf3aca597f723b301


Loki NSIS Malicious Library UPX PE File PE32 OS Processor Check DLL Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Creates executable files unpack itself AppData folder installed browsers check Browser Email ComputerName DNS Software 		2 2 10 1 10.0 26 ZeroCERT

14289 2021-10-29 18:22 vbc.exe  

cd848603273b1d0f6227a7ef17180cc9


Loki PWS Loki[b] Loki.m RAT Generic Malware UPX Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName Software 		2 2 7 1 12.8 18 ZeroCERT

14290 2021-10-29 18:25 .csrss.exe  

c2c509a61a1d811d29ade6067e54c011


Loki PWS Loki[b] Loki.m RAT Generic Malware UPX Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName Software 		2 2 7 1 14.4 14 ZeroCERT

14291 2021-10-29 18:25 ConsoleApp11.exe  

cc63cb7d19ca8cffa27530b760c81528


RAT Generic Malware UPX AntiDebug AntiVM PE File PE32 .NET EXE DLL Browser Info Stealer Malware download Vidar VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities Collect installed applications Check virtual network interfaces suspicious process AppData folder malicious URLs WriteConsoleW anti-virtualization installed browsers check Tofsee Stealer Windows Browser Email ComputerName DNS Cryptographic key crashed 		3 5 5 17.2 M 19 ZeroCERT

14292 2021-10-29 18:27 B86b0mDlYqpH2306105pdf.exe  

ff8d08be90a98bf46f8f359ee4cb35f7


RAT PWS .NET framework Generic Malware Malicious Packer Malicious Library UPX Admin Tool (Sysinternals etc ...) SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE GIF Format Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files unpack itself Windows utilities Check virtual network interfaces suspicious process AppData folder AntiVM_Disk WriteConsoleW IP Check VM Disk Size Check Tofsee Windows Browser Email ComputerName DNS Cryptographic key DDNS Software crashed 		2 4 4 17.4 30 ZeroCERT

14293 2021-10-29 18:29 vbc.exe  

ca3406debaf00a3dda67a24153c4b2a8


NSIS Malicious Library UPX PE File PE32 OS Processor Check DLL Dridex TrickBot VirusTotal Malware Code Injection Check memory Creates executable files unpack itself AppData folder Kovter 		2 1 5.4 32 ZeroCERT

14294 2021-10-29 18:30 test.exe  

5dfe5aee3f22321fe7efbb310a79a235


Malicious Library PE64 PE File VirusTotal Malware MachineGuid RWX flags setting Tofsee ComputerName 		1 2 1 3.2 51 ZeroCERT

14295 2021-10-29 18:31 .csrss.exe  

4fb2f672e188592f43da7b4c6d64e80e


PWS Loki[b] Loki.m RAT Generic Malware UPX Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Browser Email ComputerName DNS Software 		1 2 6 1 13.6 M 13 ZeroCERT

keyword