Search tag:Malicious

Microsoft Office document

2313837f1ac6059e8a0c82f9fd33dbfb

MD5 2313837f1ac6059e8a0c82f9fd33dbfb · SHA256 7ec8a37604d9119055090f201a07f54619c29ccbdf[...]a07

CAB:COMPRESSION:MSZIP Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:%ComSpec%Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Managed .NET

7.73 MB 23 hours ago

Malicious

Microsoft Office document

396f1b3ec53070261ed205db297dfdc8

MD5 396f1b3ec53070261ed205db297dfdc8 · SHA256 fd133e64799ab52e50eb290d44e446c426a9f91096[...]8e2

CAB:COMPRESSION:MSZIP Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:%ComSpec%Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Managed .NET

8.37 MB 23 hours ago

Malicious

ZIP archive

9dfc29fcbae3f85a932141966378f274

MD5 9dfc29fcbae3f85a932141966378f274 · SHA256 30e6f65380198bd4d49227d780f19a01d297aa8ed7[...]ca5

PE File Layout PDB Path Zip Bomb Malicious CVE-2022-36114 CVE-2024-0450 CVE-2019-13232 CVE-2019-9674 CVE-2023-46104 CVE-2022-29225

25.6 MB yesterday

QuasarRat

Portable Executable fileRAT

d05e699b6c5340fd0bc35be8f3385c49

MD5 d05e699b6c5340fd0bc35be8f3385c49 · SHA256 9b151f4ffa47622d8b0823c33dfb2471af4b619f1e[...]abf

Managed .NET PE File Layout Win 32 Exe x86 PDB Path SOS: 0.63 Fody/Costura Packer SOS: 0.22 SOS: 0.20 SOS: 0.34

2.26 MB 2 days ago

Malicious

Shortcut Link File

a92a7b0a8659c94870684d402a18e0eb

MD5 a92a7b0a8659c94870684d402a18e0eb · SHA256 d511b6fe91ef43489335dd7608784648506a2cfff5[...]3ef

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

2.48 KB 4 days ago

.NET Reflective Loader

Rar archiveLoaderCrypter

517b77d282d81a15a17f83759108d7ea

MD5 517b77d282d81a15a17f83759108d7ea · SHA256 e4076179d7aea59bc230fd138091d440fc48edf284[...]381

Managed .NET PE File Layout SOS: 0.83 Reflective Loader Payload Malicious .Net Obfuscator .Net Reactor PDB Path T1059.007 SOS: 0.33

3.59 MB 4 days ago

.NET Reflective Loader

Portable Executable fileLoaderCrypter

106c94d5389cd09a776092507c2fca96

MD5 106c94d5389cd09a776092507c2fca96 · SHA256 847ec4c81c1034be7934e37f6f97cde1ff5b555157[...]091

Reflective Loader Payload Malicious Managed .NET PE File Layout Win 32 Exe x86 SOS: 0.83 SOS: 0.33 PDB Path .Net Obfuscator

5.65 MB 4 days ago

Malicious

Shortcut Link File

e887bd3da38db284176b6644523f58a9

MD5 e887bd3da38db284176b6644523f58a9 · SHA256 c9008ac942ce5ac425fa41870069bc1a06a5561e1d[...]9e6

Malicious T1218 LNK: Script Execution

1.36 KB 4 days ago

XBinder

Portable Executable fileLoaderCrypter

61c8753ca0f1bda2d01bb881c9472f2a

MD5 61c8753ca0f1bda2d01bb881c9472f2a · SHA256 2b5085d4a51ac5866db3e9e16311ca09cd8849d6f1[...]773

Malicious XBinder Resource Managed .NET PE File Layout Win 32 Exe x86 SOS: 0.87 SOS: 0.31 PDB Path SOS: 0.23

1.06 MB 5 days ago

Malicious

Shortcut Link File

80e69052f5d6b63cffa71d6a2085e9bd

MD5 80e69052f5d6b63cffa71d6a2085e9bd · SHA256 536836cbe5ff44f996a7bd2b0b85c19bef6a881a21[...]ece

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

2.47 KB 5 days ago

QuasarRat

Portable Executable fileRAT

4dfaee309a8515c5531855ae8184fc71

MD5 4dfaee309a8515c5531855ae8184fc71 · SHA256 bd29b8106ffdde93f23674752ecbbc143b5b92ea7c[...]be6

SOS: 0.61 Malicious Managed .NET PE File Layout Win 32 Exe x86C2 85.121.5.9

356.35 KB 5 days ago

QuasarRat

Portable Executable fileRAT

3bd028fd84572661084373eedd5319cd

MD5 3bd028fd84572661084373eedd5319cd · SHA256 36e185f1c669491893c7416e24a6d323f10730b738[...]9e6

SOS: 0.61 Managed .NET PE File Layout Win 32 Exe x86 MaliciousC2 94.103.188.169

356.35 KB 5 days ago

Malicious

Shortcut Link File

754307f619eb7f09210b95c0361a13bf

MD5 754307f619eb7f09210b95c0361a13bf · SHA256 3147f07bd6405ecafa1c40012524ab48aa62234e95[...]385

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002

2.03 KB 5 days ago

Malicious

Rar archive

e54394789073266fda74a830c558030f

MD5 e54394789073266fda74a830c558030f · SHA256 97ed374fe4ea6c8bd095f4402a4afb94d0fd33eaff[...]8cc

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002

817.15 KB 6 days ago

Malicious

Microsoft Office document

aab36266f41c8ff7b492f6b725441f7b

MD5 aab36266f41c8ff7b492f6b725441f7b · SHA256 fc6095c6cfefef70ff331d2f8911581185b55bae2f[...]87d

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA SOS: 0.67 DeObfuscated VBScript T1059.005 Obfuscated

250.37 KB 6 days ago

Malicious

Microsoft Office document

16730c05015985e503258f87288f88d6

MD5 16730c05015985e503258f87288f88d6 · SHA256 bd3638d874cd3365499e672b2951c6a8cf856b4349[...]946

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA DeObfuscated VBScript T1059.005 Obfuscated T1027

250.37 KB 6 days ago

Malicious

Microsoft Office document

e36455207a595f37c1362d77a6c40b35

MD5 e36455207a595f37c1362d77a6c40b35 · SHA256 10febbe117878eb4949f7bad97bdc5a8c86f69ca9e[...]bd6

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA T1059.005 SOS: 0.75 WScript.Shell microsoft.xmlhttp Shell.Application

252.42 KB 6 days ago

Malicious

Microsoft Office document

dbc9e597e02bc10f17477cc4497ec17c

MD5 dbc9e597e02bc10f17477cc4497ec17c · SHA256 b50cbccb118983cef416958e90cb75d8c7dc2b4466[...]450

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA SOS: 0.71 DeObfuscated VBScript T1059.005 Obfuscated

253.44 KB 6 days ago

Malicious

Microsoft Office document

2f79fdbe69bc34db9929e03a6e423bf0

MD5 2f79fdbe69bc34db9929e03a6e423bf0 · SHA256 74daba04cff68b8a373434c60e39391bedc0f462dd[...]e37

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA SOS: 0.74 WScript.Shell microsoft.xmlhttp Shell.Application adodb.stream

250.37 KB 7 days ago

Malicious

Microsoft Office document

445b87bce06097d259650f6eb8acb4d1

MD5 445b87bce06097d259650f6eb8acb4d1 · SHA256 ab7846ef556987084eadc41f4c16c24ebcb6833e2d[...]939

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA SOS: 0.72 DeObfuscated VBScript T1059.005 Obfuscated

253.44 KB 7 days ago

Malicious

Microsoft Office document

9020a06e67cc9a14e2a66aff2cd172c4

MD5 9020a06e67cc9a14e2a66aff2cd172c4 · SHA256 d8d2d49845fe8dcec9491daa1d40c746b1332ea516[...]a8a

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA DeObfuscated VBScript T1059.005 Obfuscated T1027

254.98 KB 7 days ago

Malicious

Microsoft Office document

392aa3e89971dfb2d4bdda87e283484f

MD5 392aa3e89971dfb2d4bdda87e283484f · SHA256 3aa30f06226f74ac5d99e3893a5b819ddbde990861[...]6e8

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA SOS: 0.71 DeObfuscated VBScript T1059.005 Obfuscated

251.9 KB 7 days ago

Malicious

Microsoft Office document

33f7f4879fe3cb6018f45f5c84e6c90f

MD5 33f7f4879fe3cb6018f45f5c84e6c90f · SHA256 a6645dbb2c35b9658ef4964438bf77f68f4656cf24[...]917

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA SOS: 0.67 DeObfuscated VBScript T1059.005 Obfuscated

250.37 KB 7 days ago

Malicious

Microsoft Office document

597719abd504b23e320fa06a291bd107

MD5 597719abd504b23e320fa06a291bd107 · SHA256 d19a948a2c1f353f3b2e9fa4e415cbaa835f4fb354[...]957

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA DeObfuscated VBScript T1059.005 Obfuscated T1027

250.37 KB 7 days ago

Malicious

Microsoft Office document

37ffa3c3d3d6409ae7ae1d1daa639025

MD5 37ffa3c3d3d6409ae7ae1d1daa639025 · SHA256 0661676bd008f89ff77f3f59feba369208b20a3e48[...]d2f

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA DeObfuscated VBScript T1059.005 Obfuscated T1027

251.9 KB 7 days ago

Malicious

Microsoft Excel document

d83b39d6c5ac33231cfa9c4e8c71d7ba

MD5 d83b39d6c5ac33231cfa9c4e8c71d7ba · SHA256 f0699a95fc39bed963289229b613f2b4684ed034e2[...]774

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA DeObfuscated VBScript T1059.005 Obfuscated T1027

226.69 KB 9 days ago

Malicious

Microsoft Excel document

f6961cde071b1900801c84e282208319

MD5 f6961cde071b1900801c84e282208319 · SHA256 5336bb025edac7d5f76f1dc431e310506cdfc5b7c5[...]bc4

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA T1059.005 SOS: 0.72 SOS: 0.69 DeObfuscated VBScript

226.68 KB 9 days ago

Go Loader (Factory-v3)

ZIP archiveStealer Loader

0fb5130380004263adeff8c311bf6f65

MD5 0fb5130380004263adeff8c311bf6f65 · SHA256 e7552799c3c15c3e3fdf93c3cc2dc04beec2c396cf[...]1ff

Zip Bomb Malicious CVE-2022-36114 CVE-2024-0450 CVE-2019-13232 CVE-2019-9674 CVE-2023-46104 CVE-2022-29225 T1027 T1055

2.2 MB 10 days ago

Go Loader (Factory-v3)

ZIP archiveStealer Loader

9cacf0732eeabb167627850d13b94083

MD5 9cacf0732eeabb167627850d13b94083 · SHA256 0f505061f7eb8ae8b269788b0133c464c15d33fa92[...]bf6

Zip Bomb Malicious CVE-2022-36114 CVE-2024-0450 CVE-2019-13232 CVE-2019-9674 CVE-2023-46104 CVE-2022-29225 T1027 T1055

3.08 MB 10 days ago

Malicious

ZIP archive

a1dcc40ddf65d338fd250de1b280db1a

MD5 a1dcc40ddf65d338fd250de1b280db1a · SHA256 4adb8b4f38f0199a238831a9c8892bae329b8737e5[...]106

SVG Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:conhost.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNKC2 https[:]//blockworks.com/event/digital-ass[...]donC2 https[:]//blockworks.com/event/digital-ass[...]ersC2 https[:]//luma.com/z7g0eoa3

553.66 KB 10 days ago

Malicious

ZIP archive

0aa928627088f5789901d16cae62d5a8

MD5 0aa928627088f5789901d16cae62d5a8 · SHA256 a355496c47d79ab9ad373d34192e1d475806686424[...]2be

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:conhost.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

837.35 KB 11 days ago

Malicious

ZIP archive

111d4f831f1f7b69c1e19910f0af3c5e

MD5 111d4f831f1f7b69c1e19910f0af3c5e · SHA256 725fa840a70c47196797db5977b2d99654063d0131[...]3cc

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001C2 https[:]//shorturl.at/1YNAJC2 https[:]//egrul.nalog.ru

902.33 KB 11 days ago

Malicious

Shortcut Link File

19a610a42153432e1e7d3d78a271c910

MD5 19a610a42153432e1e7d3d78a271c910 · SHA256 429a19e94becd3548a084678fe5e557189469f0eeb[...]d98

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001C2 http[:]//fcxfcxfcxfcxnobodywillfoll[...]xbb.fcxphp

59.56 KB 11 days ago

Malicious

ZIP archive

f0ddf536e91224a634463a39e366c5e0

MD5 f0ddf536e91224a634463a39e366c5e0 · SHA256 1b519c70fe1f04dfed8e09bbbd7deb376b9c7bc6ce[...]6f2

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 PE File Layout PDB Path

149.85 KB 11 days ago

Malicious

ZIP archive

0cae9689f6dcc1b23586493be5cbd71f

MD5 0cae9689f6dcc1b23586493be5cbd71f · SHA256 5a15f996dd4157ea7e88ed80d6a77dfcdd81f54305[...]1b4

PE File Layout PDB Path Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002

149.52 KB 11 days ago

Malicious

ZIP archive

5610d3d379019cdc1c95840d6870a86e

MD5 5610d3d379019cdc1c95840d6870a86e · SHA256 92589172ef4b160bfe6a56ecf224d6be7c1c259923[...]0d8

Corrupted Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK

38.57 KB 11 days ago

Malicious

Disk image

e78d3ab5cd893d4b70bb7d44257b7aef

MD5 e78d3ab5cd893d4b70bb7d44257b7aef · SHA256 247b3244ccbb8e33ebba0d3aa66a38f66cfe7d27d9[...]10e

PE File Layout PDB Path Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:cmd.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002

7.34 MB 11 days ago

QuasarRat

Portable Executable fileRAT

12424064e68c62ea927e16acc4ec5e8f

MD5 12424064e68c62ea927e16acc4ec5e8f · SHA256 9e40aacf77d0caed41a3670eaa817ae178493ccfda[...]b8b

SOS: 0.32 Managed .NET PE File Layout Win 32 Exe x86 Malicious Known C2 infrastructure⚠ C2 patri00-42082.portmap.host

784.38 KB 11 days ago

Malicious

Shortcut Link File

a3da3cad3b4b18a261ce07a9c1669297

MD5 a3da3cad3b4b18a261ce07a9c1669297 · SHA256 211bfcba152a000b2bcdc8e33dc0a53c3830abda5f[...]25f

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

3.9 KB 11 days ago

Malicious

ZIP archive

a720afd7aa01d93e7f845d6f9a22b538

MD5 a720afd7aa01d93e7f845d6f9a22b538 · SHA256 2bc7c63838f751786cb5bfc3e885e7622b6958f99e[...]591

Malicious LOLBin T1218: System Binary Proxy Execution LOLBin:powershell.exe Execution: CMD in LNK T1059.003 T1202: Indirect Command Execution T1204.002 Execution: PowerShell in LNK T1059.001

1.44 KB 11 days ago

Malicious

Microsoft Office document

7183e44271a080f55467c28e4db947f7

MD5 7183e44271a080f55467c28e4db947f7 · SHA256 fa0e68457b06c50d41b92ecf3440b0cb0c37e6ccf1[...]e16

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA SOS: 0.29 DeObfuscated VBScript T1059.005 Obfuscated

712.19 KB 13 days ago

Malicious

VBScript file

e40bd8f8f47e0ae7d7416aadd55b5451

MD5 e40bd8f8f47e0ae7d7416aadd55b5451 · SHA256 e20413254a149c372a43765a020b1c9abc9ba211cf[...]45c

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA T1059.005 DeObfuscated VBScript Obfuscated T1027

675.84 KB 13 days ago

Malicious

VBScript file

3c8a131ce4f2b0f5855ea05b366e24f4

MD5 3c8a131ce4f2b0f5855ea05b366e24f4 · SHA256 debd7a84b7b9a17765e7fe2c0f2855c49f19a4e352[...]aa5

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA T1059.005 SOS: 0.39 DeObfuscated VBScript Obfuscated

712.19 KB 13 days ago

Malicious

Microsoft Office document

c34d10c7f93dc9272b4010e560b41759

MD5 c34d10c7f93dc9272b4010e560b41759 · SHA256 d1ec65537dafbe0e6255892622464983cd890de634[...]3c4

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA DeObfuscated VBScript T1059.005 Obfuscated T1027

675.84 KB 13 days ago

Malicious

Microsoft Office document

ec3d137e22c818d67a32dc889a02a6de

MD5 ec3d137e22c818d67a32dc889a02a6de · SHA256 a14dc55a66c53315929cd8536be054296593790732[...]a93

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA SOS: 0.28 T1059.005 SOS: 0.35 DeObfuscated VBScript

675.84 KB 13 days ago

Malicious

Microsoft Office document

6ddcca3a162aa406d7681c4b81765b4e

MD5 6ddcca3a162aa406d7681c4b81765b4e · SHA256 74ffcff4d4618c1c3fe0c0750b391ea27383131e53[...]a6d

VBA Stomping ATT&CK T1564.007 Malicious Malicious Document Blacklist VBA DeObfuscated VBScript T1059.005 Obfuscated T1027

642.56 KB 13 days ago

Malicious

Microsoft Word document

66517819d6c332c0dc095fb77edc0f2f

MD5 66517819d6c332c0dc095fb77edc0f2f · SHA256 2d8f5187a6208fbb269abfd072663d03adffec6c77[...]89d

Blacklist VBA VBA Stomping ATT&CK T1564.007 Malicious Malicious Document T1059.005 DeObfuscated VBScript Obfuscated T1027

490.82 KB 13 days ago

RedLine Stealer

Portable Executable fileRATStealer

8cb63ec528985e59a1f67c5527d5adad

MD5 8cb63ec528985e59a1f67c5527d5adad · SHA256 f7856dc0d9a74e8bccfc47b55b24fe170f568b87fe[...]68d

Malicious Managed .NET PE File Layout Win 64 Exe x64 SOS: 0.26

329.22 KB 13 days ago

RedLine Stealer

Portable Executable fileRATStealer

683e2c4091b8947da3a092749bf2c12e

MD5 683e2c4091b8947da3a092749bf2c12e · SHA256 4f1271f35cb5bfdb456481302e219e5b8e7341bf1e[...]929

Managed .NET PE File Layout Malicious Win 64 Exe x64 SOS: 0.26

329.22 KB 13 days ago

RedLine Stealer

Portable Executable fileRATStealer

b28942080b8a748312a3fe374916ad79

MD5 b28942080b8a748312a3fe374916ad79 · SHA256 f87d5715903295e50a1c3d370d4fdc30be5128907d[...]7cd

SOS: 0.26 Malicious Managed .NET PE File Layout Win 64 Exe x64

328.7 KB 13 days ago

Search results