popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
14446 2021-11-02 17:45 sqlservr.exe  

0235dd2db63e1e5623f2ef0801f4fdf6


PWS Loki[b] Loki.m .NET framework Generic Malware Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName DNS Software 		1 12.8 14 ZeroCERT

14447 2021-11-02 17:46 vbc.exe  

bd6966e21dcfc96431ea8480ca155210


Generic Malware Malicious Library UPX Create Service DGA Socket Steal credential DNS Internet API Code injection Sniff Audio HTTP KeyLogger FTP Escalate priviledges Downloader ScreenShot Http API P2P AntiDebug AntiVM PE File PE32 FormBook Emotet Malware download VirusTotal Malware Buffer PE AutoRuns Code Injection Malicious Traffic buffers extracted Creates executable files RWX flags setting unpack itself Windows utilities suspicious process WriteConsoleW Tofsee Windows ComputerName DNS crashed 		11 25 3 12.0 21 ZeroCERT

14448 2021-11-02 17:48 vbc.exe  

4a785dbc6b09f17d9a1975b842a4d34a


PWS Loki[b] Loki.m .NET framework Generic Malware Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself malicious URLs installed browsers check Browser Email ComputerName DNS Software 		1 13.4 14 ZeroCERT

14449 2021-11-02 17:48 .csrss.exe  

96a5e7556e6b7631e4e6655fdd5a757b


Loki PWS Loki[b] Loki.m .NET framework Generic Malware Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName Software 		2 2 7 1 13.4 10 ZeroCERT

14450 2021-11-02 17:50 ziyu.hta  

098a6e795f1b51c28d9f82f90b2aad13

VirusTotal Malware DNS crashed 		1 1.2 1 ZeroCERT

14451 2021-11-02 17:50 isssch.exe  

0587ab2b7897ebbdedb5d5e1289bd683


PWS .NET framework Generic Malware SMTP KeyLogger AntiDebug AntiVM PE File PE32 .NET EXE VirusTotal Malware suspicious privilege Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW Windows ComputerName crashed 		10.6 13 ZeroCERT

14452 2021-11-02 17:54 ziy.exe  

656fa586fb11c81a8120231ed97b0d1a


RAT PWS .NET framework Generic Malware AntiDebug AntiVM PE File PE32 .NET EXE FormBook Malware download VirusTotal Malware suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself suspicious TLD DNS 		7 17 2 11.0 20 ZeroCERT

14453 2021-11-02 17:56 ziyu.hta  

098a6e795f1b51c28d9f82f90b2aad13


Generic Malware Antivirus AntiDebug AntiVM VirusTotal Malware powershell suspicious privilege MachineGuid Code Injection Check memory Checks debugger Creates shortcut RWX flags setting unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces suspicious process Tofsee Windows ComputerName Cryptographic key 		2 1 9.4 1 ZeroCERT

14454 2021-11-02 18:36 ziy.hta  

5c88bf7225ed953a328bf598abfd9ce6


Generic Malware Antivirus AntiDebug AntiVM VirusTotal Malware powershell suspicious privilege MachineGuid Code Injection Check memory Checks debugger Creates shortcut RWX flags setting unpack itself Windows utilities powershell.exe wrote Check virtual network interfaces suspicious process Tofsee Windows ComputerName Cryptographic key 		2 1 9.4 1 ZeroCERT

14455 2021-11-02 22:14 Chiamando.exe.com  

78ba0653a340bac5ff152b21a83626cc


Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware Check memory Checks debugger Creates shortcut unpack itself human activity check ComputerName 		2.2 3 guest

14456 2021-11-02 22:17 Mainsetupv1.0.exe  

689b7bfb1424aa69046653e635ecb9ac


Malicious Library UPX Create Service DGA Socket Steal credential DNS Internet API Hijack Network Code injection Sniff Audio HTTP KeyLogger FTP Escalate priviledges Downloader ScreenShot Http API P2P persistence AntiDebug AntiVM PE File PE32 OS Processor C VirusTotal Malware Code Injection Check memory Checks debugger Creates executable files unpack itself Windows utilities suspicious process malicious URLs AntiVM_Disk WriteConsoleW anti-virtualization VM Disk Size Check Windows 		1 7.0 51 guest

14457 2021-11-03 07:01 VirbelaSetup.exe  

ff260b18bacce2eafa35e1363bb005be


RAT Formbook Gen1 Gen2 Generic Malware Malicious Library UPX Malicious Packer Admin Tool (Sysinternals etc ...) Anti_VM PE File OS Processor Check PE32 .NET DLL DLL GIF Format PE64 Malware Check memory Checks debugger Creates shortcut Creates executable files unpack itself AppData folder AntiVM_Disk VM Disk Size Check human activity check ComputerName 		4.8 guest

14458 2021-11-03 07:50 vbc.exe  

bf5ad5ce60c095fd0e15435c7c7ab862


Malicious Library UPX PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself Remote Code Execution 		2.4 38 ZeroCERT

14459 2021-11-03 08:02 invc_000002340003032030.wbk  

4da8c38808017d5f01ba220a5e02944a


RTF File doc LokiBot Malware download VirusTotal Malware c&c Malicious Traffic buffers extracted exploit crash unpack itself Windows Exploit DNS crashed Downloader 		2 3 14 5.0 30 ZeroCERT

14460 2021-11-03 08:02 csrss.exe  

58efcac56ff319990d2cc6d9110e981e


Loki PWS Loki[b] Loki.m .NET framework Generic Malware Socket DNS AntiDebug AntiVM PE File PE32 .NET EXE Browser Info Stealer LokiBot Malware download FTP Client Info Stealer VirusTotal Email Client Info Stealer Malware c&c suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself malicious URLs AntiVM_Disk VM Disk Size Check installed browsers check Browser Email ComputerName Software 		2 2 7 1 14.2 28 ZeroCERT

keyword