MalShare

SHA256 Hash	File type	Added	Source	Yara Hits
fcb1c59f0966f41727a1af66a5dbcd7e44476c5618323849d3498770c0cc9117	ASCII	2022-03-20 17:29:54	User Submission	YRP/powershell YRP/domain YRP/contentis_base64 YRP/Antivirus
e6632da29ef19eeac3e6c9e921096e7b1deb2555a860eda82e3e291a60282b4e	ASCII	2022-03-20 14:50:30	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus FlorianRoth/Suspicious_PowerShell_WebDownload_1
bf720acfb3a2f503222eae5a572791a0230dbf4ce5ed2c02b4f8dda85341c4a9	ASCII	2022-03-20 13:28:38	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus YRP/Big_Numbers1 FlorianRoth/Suspicious_PowerShell_WebDownload_1
b64c3249144683345453feac5f2c3ed3374d33a8eaf6bf4e30299e55a1bf1fca	ASCII	2022-03-20 13:08:57	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus YRP/Big_Numbers1 FlorianRoth/Suspicious_PowerShell_WebDownload_1
a2910e378ba4268cb045f69cde6b3ee13ae59234196e845404414917cb6f2aac	ASCII	2022-03-20 12:22:24	User Submission	YRP/powershell YRP/domain YRP/contentis_base64 YRP/Antivirus
9fa84dced6638eb5fa45414bf1ffc50e81623bde1a207a0e51dba8012226def0	ASCII	2022-03-20 12:15:43	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus FlorianRoth/Suspicious_PowerShell_WebDownload_1
8348b0756633b675ff22ed3b840497f2393e8d9587f8933ac2469d689c16368a	PE32	2022-03-20 11:55:55	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional YRP/Borland_Delphi_30_ YRP/Borland_Delphi_v40_v50 [+] YRP/Armadillo_v4x YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/IsPE32 YRP/IsWindowsGUI YRP/HasDebugData YRP/HasRichSignature YRP/powershell YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/inject_thread YRP/network_dropper YRP/network_dns YRP/escalate_priv YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/RIPEMD160_Constants YRP/SHA1_Constants YRP/Str_Win32_Winsock2_Library YRP/Codoso_Gh0st_2 YRP/Codoso_Gh0st_1 YRP/fin7_functions FlorianRoth/Codoso_Gh0st_2 FlorianRoth/Codoso_Gh0st_1
b184f5d15c4e01f114cf8a437fc2587fcc0277e282fa5adea915c50b5cbcf1a2	ASCII	2022-03-20 11:44:15	User Submission	YRP/powershell YRP/domain YRP/contentis_base64 YRP/Dropper_Strings [+] YRP/Base64d_PE YRP/Base64_encoded_Executable
81c9ee2eb3ad8fcbb954cc40080e29598e30fc0794d9a32b7e546870dddb2047	ASCII	2022-03-20 11:13:44	User Submission	YRP/powershell YRP/domain YRP/contentis_base64
8178b2a273ccd3ec4e01c78beeabb8b306e6851906b9581eff43d3af65cb72cb	ASCII	2022-03-20 11:13:00	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus YRP/Big_Numbers1 FlorianRoth/Suspicious_PowerShell_WebDownload_1
65aca88b78d41c561c3ab4b732484deb7ba50a7a3b9499406faf938ee12085b8	ASCII	2022-03-20 10:10:50	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus YRP/Big_Numbers1 FlorianRoth/Suspicious_PowerShell_WebDownload_1
3c3874d8b87ce270f58c80e0fe28fd2324963aa7204d5d03652855a07452fa30	ASCII	2022-03-20 08:00:21	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64
0cdc8537223fa1277b6873cd2a96a75812796498e56ba8e96892ad8f82ad5b2d	PE32	2022-03-20 02:23:15	User Submission	YRP/Microsoft_Visual_Studio_NET YRP/Microsoft_Visual_C_v70_Basic_NET_additional YRP/Microsoft_Visual_C_Basic_NET YRP/Microsoft_Visual_Studio_NET_additional [+] YRP/Microsoft_Visual_C_v70_Basic_NET YRP/NET_executable_ YRP/NET_executable YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsNET_EXE YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/DebuggerCheck__QueryInfo YRP/network_tcp_listen YRP/win_files_operation YRP/android_meterpreter YRP/CRC32_poly_Constant YRP/CRC32b_poly_Constant YRP/RijnDael_AES_CHAR YRP/RijnDael_AES_LONG
3d5f758528c05d9e0f5f1b1b38e77ed5bd5464832a02410fdc8f26d447cfc9b6	PE32	2022-03-20 02:16:54	User Submission	YRP/Borland YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsNET_EXE [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/HasDebugData YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Big_Numbers1
7e9bc0e2cc8c5151cc3c755cad9fe8cf5f1f8b4413538854a742d4577e312b20	PE32	2022-03-20 02:05:05	User Submission	YRP/Borland_Delphi_40_additional YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional YRP/Borland_Delphi_30_ [+] YRP/Borland_Delphi_Setup_Module YRP/Borland_Delphi_40 YRP/Borland_Delphi_v40_v50 YRP/Borland_Delphi_v60_v70 YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/Borland YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/borland_delphi YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Browsers YRP/Antivirus YRP/Qemu_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/disable_antivirus YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Big_Numbers2 YRP/MD5_Constants YRP/RIPEMD160_Constants YRP/SHA1_Constants YRP/BASE64_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/Str_Win32_Winsock2_Library
744f427dca07b505b70ec3a15322c9baea0c369a7c165d5810105867226acbc9	PE32	2022-03-20 02:02:09	User Submission	YRP/Microsoft_Visual_Studio_NET YRP/Microsoft_Visual_C_v70_Basic_NET_additional YRP/Microsoft_Visual_C_Basic_NET YRP/Microsoft_Visual_Studio_NET_additional [+] YRP/Microsoft_Visual_C_v70_Basic_NET YRP/NET_executable_ YRP/NET_executable YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsNET_EXE YRP/IsWindowsGUI YRP/HasOverlay YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/DebuggerCheck__QueryInfo YRP/network_tcp_listen YRP/win_files_operation YRP/android_meterpreter YRP/Big_Numbers3 YRP/CRC32_poly_Constant YRP/CRC32b_poly_Constant YRP/RijnDael_AES_CHAR YRP/RijnDael_AES_LONG
0b6a9da91c9ac4f629523aa199ef138441b6ece1b36ca6430f158a9d30d87815	ASCII	2022-03-19 19:00:40	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64
1fba8dffdc4c1ee9dc491dfac6817956930bf6e1209e535fc878943f23325971	ASCII	2022-03-19 11:00:19	http://14.55.65.217:8080/a/lr.ps1	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus YRP/WMI_strings YRP/GEN_PowerShell FlorianRoth/PowerShell_Susp_Parameter_Combo
9a8b911c18fea44ce3127f75b8c62de9fc356040cb8040c0ce43537ecff73c27	PE32	2022-03-19 02:09:12	User Submission	YRP/Microsoft_Visual_Studio_NET YRP/Microsoft_Visual_C_v70_Basic_NET_additional YRP/Microsoft_Visual_C_Basic_NET YRP/Microsoft_Visual_Studio_NET_additional [+] YRP/Microsoft_Visual_C_v70_Basic_NET YRP/NET_executable_ YRP/NET_executable YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsNET_EXE YRP/IsWindowsGUI YRP/HasOverlay YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/DebuggerCheck__QueryInfo YRP/network_tcp_listen YRP/win_files_operation YRP/android_meterpreter YRP/Big_Numbers3 YRP/CRC32_poly_Constant YRP/CRC32b_poly_Constant YRP/RijnDael_AES_CHAR YRP/RijnDael_AES_LONG
31fc2c191588c1534301ce1ae7d38a1dc3d3a5159a72563f72709ce5535b7981	ASCII	2022-03-18 12:05:35	User Submission	YRP/powershell YRP/domain YRP/url YRP/contentis_base64
581902987aa3b948638f5a0f75bd43e10de95257e233daa24a0ebae3c73acc05	PE32+	2022-03-18 11:07:40	User Submission	YRP/IsPE64 YRP/IsDLL YRP/IsWindowsGUI YRP/HasRichSignature [+] YRP/powershell YRP/domain YRP/url YRP/contentis_base64 YRP/Antivirus YRP/Misc_Suspicious_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/win_files_operation
add510c398d9b82bbd37f3e9f10723c8c76395be078a8bcaef7ed62c48c14cd4	PE32	2022-03-18 11:07:35	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional YRP/Borland_Delphi_30_ YRP/Borland_Delphi_v40_v50 [+] YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/IsPE32 YRP/IsDLL YRP/IsWindowsGUI YRP/HasRichSignature YRP/powershell YRP/domain YRP/url YRP/contentis_base64 YRP/Antivirus YRP/Misc_Suspicious_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/win_files_operation
add510c398d9b82bbd37f3e9f10723c8c76395be078a8bcaef7ed62c48c14cd4	PE32	2022-03-18 11:07:35	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional YRP/Borland_Delphi_30_ YRP/Borland_Delphi_v40_v50 [+] YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/IsPE32 YRP/IsDLL YRP/IsWindowsGUI YRP/HasRichSignature YRP/powershell YRP/domain YRP/url YRP/contentis_base64 YRP/Antivirus YRP/Misc_Suspicious_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/win_files_operation
ddb09babedfc5ec585731221feedbb41a709123ff322ffbdab099d9456482fb8	Composite	2022-03-18 10:00:52	User Submission	YRP/powershell YRP/office_document_vba YRP/Contains_VBA_macro_code YRP/domain [+] YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/Antivirus YRP/Big_Numbers0
6aa5efecddd28d83affa4bfcc0b5edbb4c52a9a48f04d7daea5a21e32d116989	Composite	2022-03-18 10:00:36	User Submission	YRP/powershell YRP/office_document_vba YRP/Office_AutoOpen_Macro YRP/Contains_VBA_macro_code [+] YRP/domain YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/WMI_strings YRP/Big_Numbers0 FlorianRoth/Office_AutoOpen_Macro
907751f1585f23be03b26bb6eba0d0834497b807d63b0c6f1ab772a0e5642db5	DOS	2022-03-18 08:03:46	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Dropper_Strings
7064e6a791ea0f563e5532fa9f29f1f5102f64666f9130d0b00c66d7b68f3eb3	DOS	2022-03-18 08:03:12	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Dropper_Strings
2c239929793d635710c274377b43d6b5d57500802b362c5b407ce116024e81e7	DOS	2022-03-18 08:03:01	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Dropper_Strings
6c46550db4dcb3f5171c69c5f1723362f99ec0f16f6d7ab61b6f8d169a6e6bc8	DOS	2022-03-18 08:02:56	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Dropper_Strings
7ba723d34af2fec8f648720ac5292b0bfaa09e2594f9ae80314b7fc6e4761f5b	DOS	2022-03-18 08:02:35	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Dropper_Strings
57fa583f9161bfc2b2309dbe3e8724cbbd9f44d8df5d40cbf132f0641e6a2338	ASCII	2022-03-18 08:00:18	User Submission	YRP/powershell YRP/domain YRP/contentis_base64 FlorianRoth/PowerShell_Case_Anomaly [+] FlorianRoth/PowerShell_Susp_Parameter_Combo
2d1bce3ec066c40531afcba06712a06bf3c77dd1ecf03568489b16acaec3a3b9	PE32	2022-03-18 02:35:05	User Submission	YRP/Microsoft_Visual_Studio_NET YRP/Microsoft_Visual_C_v70_Basic_NET_additional YRP/Microsoft_Visual_C_Basic_NET YRP/Microsoft_Visual_Studio_NET_additional [+] YRP/Microsoft_Visual_C_v70_Basic_NET YRP/NET_executable_ YRP/NET_executable YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsNET_EXE YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/DebuggerCheck__QueryInfo YRP/network_tcp_listen YRP/win_files_operation YRP/android_meterpreter YRP/CRC32_poly_Constant YRP/CRC32b_poly_Constant YRP/RijnDael_AES_CHAR YRP/RijnDael_AES_LONG
3f696122a5e04c583cd87454a7416f055b60e2ad14bae4829cbf8d7cb5ed83b6	PE32+	2022-03-18 02:03:47	User Submission	YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay YRP/ImportTableIsBad [+] YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/DebuggerCheck__QueryInfo YRP/network_tcp_listen YRP/win_files_operation YRP/android_meterpreter YRP/Big_Numbers3 YRP/CRC32_poly_Constant YRP/CRC32b_poly_Constant YRP/RijnDael_AES_CHAR YRP/RijnDael_AES_LONG
43b862360fd8f62fd68b42e51d2b2d40f8e41984ff71c682fc36f8858f2364c1	PE32	2022-03-18 02:02:24	User Submission	YRP/Microsoft_Visual_Studio_NET YRP/Microsoft_Visual_C_v70_Basic_NET_additional YRP/Microsoft_Visual_C_Basic_NET YRP/Microsoft_Visual_Studio_NET_additional [+] YRP/Microsoft_Visual_C_v70_Basic_NET YRP/NET_executable_ YRP/NET_executable YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsNET_EXE YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/DebuggerCheck__QueryInfo YRP/network_tcp_listen YRP/win_files_operation YRP/android_meterpreter YRP/CRC32_poly_Constant YRP/CRC32b_poly_Constant YRP/RijnDael_AES_CHAR YRP/RijnDael_AES_LONG
1d71aa424590d941211f477d6cb9ec8d6d655d3ef3212931dc644dedbbf1e180	HTML	2022-03-17 23:05:31	https://www.cisa.gov/uscert/ncas/alerts/aa22-...	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/System_Tools YRP/Misc_Suspicious_Strings YRP/hijack_network YRP/Big_Numbers3
10dfa4008dbd0845cbaea54b99fc635019ccea0fb61fef24074865605c63aa04	Composite	2022-03-17 18:03:17	User Submission	YRP/powershell YRP/office_document_vba YRP/Office_AutoOpen_Macro YRP/Contains_VBA_macro_code [+] YRP/domain YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/WMI_strings YRP/Big_Numbers0 FlorianRoth/Office_AutoOpen_Macro
aa061443567b8385559c74fbfa81609f499be77e11982f23febd93c366f8b89a	ASCII	2022-03-17 13:02:42	User Submission	YRP/powershell YRP/domain YRP/contentis_base64 FlorianRoth/PowerShell_Case_Anomaly [+] FlorianRoth/PowerShell_Susp_Parameter_Combo
03e35b1085e2cc694a00fb4d348fcd388376e188ba5632a590ee47a85868c33d	HTML	2022-03-17 11:05:01	https://www.cisa.gov/uscert/ncas/alerts/aa22-...	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/System_Tools YRP/Misc_Suspicious_Strings YRP/hijack_network YRP/Big_Numbers3
aeef432289fa3c6931d3d6ac086c8a0f3cdd101f4d417556156c2e60faeb7e38	PE32+	2022-03-17 02:17:13	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDigitalSignature YRP/HasDebugData YRP/HasRichSignature YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Misc_Suspicious_Strings YRP/anti_dbg YRP/network_tcp_socket YRP/win_mutex YRP/win_files_operation YRP/android_meterpreter YRP/MD5_Constants YRP/Str_Win32_Winsock2_Library
23b612363d5348ed8b723459e9c3610144ae2d859c0bbcda171fc949d6fb5a89	PE32+	2022-03-17 02:13:20	User Submission	YRP/possible_includes_base64_packed_functions YRP/IsPE64 YRP/IsWindowsGUI YRP/IsPacked [+] YRP/HasOverlay YRP/HasDigitalSignature YRP/HasRichSignature YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Antivirus YRP/Dropper_Strings YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/anti_dbg YRP/inject_thread YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/android_meterpreter YRP/Advapi_Hash_API YRP/BASE64_table YRP/suspicious_packer_section
e5537316e796d455162595b47cacd57af77aad6f09f2470de844e7bb5394c680	PE32	2022-03-17 02:01:04	User Submission	YRP/VC8_Microsoft_Corporation YRP/Armadillo_v4x YRP/Microsoft_Visual_Cpp_8 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/HasDebugData YRP/HasRichSignature YRP/QtFrameWork YRP/powershell YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Antivirus YRP/anti_dbg YRP/network_tcp_socket YRP/win_files_operation YRP/Str_Win32_Winsock2_Library
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09	PE32	2022-03-16 18:01:43	User Submission	YRP/Microsoft_Visual_Studio_NET YRP/Microsoft_Visual_C_v70_Basic_NET_additional YRP/Microsoft_Visual_C_Basic_NET YRP/Microsoft_Visual_Studio_NET_additional [+] YRP/Microsoft_Visual_C_v70_Basic_NET YRP/NET_executable_ YRP/NET_executable YRP/IsPE32 YRP/IsNET_EXE YRP/IsWindowsGUI YRP/powershell YRP/domain YRP/IP YRP/contentis_base64 YRP/VMWare_Detection YRP/Sandboxie_Detection YRP/Dropper_Strings YRP/WMI_strings YRP/Base64d_PE YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__RemoteAPI YRP/anti_dbg YRP/network_smtp_dotNet YRP/keylogger YRP/win_hook YRP/Big_Numbers1 YRP/suspicious_packer_section YRP/BlackWorm BAMFDetect/BlackWorm
f6e1c4110682e0b83efa550ffb7014415a615c87362282aa91dca2b7553ccb6e	PE32	2022-03-16 02:34:17	User Submission	YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsNET_EXE YRP/IsWindowsGUI [+] YRP/HasOverlay YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/DebuggerCheck__QueryInfo YRP/network_tcp_listen YRP/win_files_operation YRP/android_meterpreter YRP/CRC32_poly_Constant YRP/CRC32b_poly_Constant YRP/RijnDael_AES_CHAR YRP/RijnDael_AES_LONG
cd75a06d1e2226ee2589bd1671f3c5ad009269fef471b8fac6f0351517969b82	PE32	2022-03-16 02:07:15	User Submission	YRP/VC8_Microsoft_Corporation YRP/Microsoft_Visual_Cpp_8 YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/QtFrameWork YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/Antivirus YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/anti_dbg YRP/network_dropper YRP/escalate_priv YRP/screenshot YRP/win_mutex YRP/win_token YRP/Str_Win32_Internet_API
fdc4ac20e22968088ef1dc27dc4b3746fd2b827d45899ed45c8eec3d14a4defe	PE32+	2022-03-16 00:02:29	User Submission	YRP/IsPE64 YRP/IsWindowsGUI YRP/HasDebugData YRP/HasRichSignature [+] YRP/powershell YRP/domain YRP/contentis_base64 YRP/Antivirus YRP/anti_dbg YRP/BASE64_table FlorianRoth/DragonFly_APT_Sep17_3
46f808c2bf803733d0b8c551b9db9f42c1073ffc844701bd3ed29352550ea66d	HTML	2022-03-15 17:03:41	User Submission	YRP/powershell YRP/domain YRP/url YRP/contentis_base64 [+] YRP/Antivirus FlorianRoth/PowerShell_Case_Anomaly
925577b23cd92114f14e8e9c92f2215e465031526014b9198daa91d6420e45fa	HTML	2022-03-15 17:02:41	User Submission	YRP/powershell YRP/domain YRP/url YRP/contentis_base64 [+] YRP/Antivirus FlorianRoth/PowerShell_Case_Anomaly
9408143fbc58c7ad883b13055422a2cae7f9d9a0bb191561f219b28e361b81de	PE32	2022-03-15 16:02:06	User Submission	YRP/Microsoft_Visual_Studio_NET YRP/Microsoft_Visual_C_v70_Basic_NET_additional YRP/Microsoft_Visual_C_Basic_NET YRP/Microsoft_Visual_Studio_NET_additional [+] YRP/Microsoft_Visual_C_v70_Basic_NET YRP/NET_executable_ YRP/NET_executable YRP/IsPE32 YRP/IsNET_EXE YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/win_token YRP/suspicious_packer_section
5b2f76923f8eb3a6e1f25fb2ad0f2eeb593f27a84b14e7fed7ceaa9fbe8189ed	ASCII	2022-03-15 15:05:08	User Submission	CuckooSandbox/embedded_win_api YRP/powershell YRP/domain YRP/contentis_base64 [+] YRP/Antivirus YRP/Misc_Suspicious_Strings
4ccc8a0286b73b62f34fee2f3927c12a73aa47f272f40a4ba7085d84dc1785aa	ASCII	2022-03-15 15:04:57	User Submission	YRP/powershell YRP/domain YRP/contentis_base64 FlorianRoth/PowerShell_Case_Anomaly
449888a9bd8efbfe0f9c15965882d3ea50fec4a124bc7fd603ac16956289a16c	ASCII	2022-03-15 15:04:22	User Submission	CuckooSandbox/embedded_win_api YRP/powershell YRP/domain YRP/contentis_base64 [+] YRP/Antivirus
81c7eef54c852dd68050147f77f937933cbff1c22722617180ca386ef55918ab	Composite	2022-03-15 14:06:14	User Submission	YRP/Contains_UserForm_Object YRP/powershell YRP/office_document_vba YRP/Contains_VBA_macro_code [+] YRP/domain YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/Antivirus YRP/Big_Numbers0 YRP/suspicious_packer_section
2dff4dc304706a295989d88bb8047644eda4b8c253b1e3ae6e6b9f09cf4ed72a	ASCII	2022-03-15 14:05:33	User Submission	YRP/powershell YRP/domain YRP/contentis_base64 YRP/Antivirus
a54e2ae96e5a23562ba60fc2914edc60ee72600a019c4d41b29636e4710c274d	ASCII	2022-03-15 12:03:29	User Submission	YRP/powershell YRP/domain YRP/contentis_base64 YRP/Misc_Suspicious_Strings [+] FlorianRoth/PowerShell_Case_Anomaly FlorianRoth/PowerShell_Susp_Parameter_Combo
174ab0c6b0889b8d8dfa0f460d465afceaafc0cb1a1273e9ad4ed55c86019138	ASCII	2022-03-15 10:05:40	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus YRP/Dropper_Strings
371f1c351b9d8792d27de6cfe052571039f56fa3552d492e76b37bc1ae518530	ASCII	2022-03-14 19:02:27	User Submission	CuckooSandbox/embedded_win_api YRP/powershell YRP/domain YRP/contentis_base64 [+] YRP/Antivirus YRP/android_meterpreter
d9851bd8deb09e0ada8b0b0cd9963446383d76564c5a095f00e168f5686a80c8	DOS	2022-03-14 04:02:37	User Submission	YRP/powershell YRP/domain YRP/contentis_base64
7226ac59bc82cb7bcde5206534d8bb1901bafb2517f24bd51311e70fa483b662	HTML	2022-03-14 04:02:19	User Submission	CuckooSandbox/embedded_win_api YRP/powershell YRP/domain YRP/IP [+] YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Antivirus YRP/Dropper_Strings YRP/WMI_strings YRP/Misc_Suspicious_Strings
83c6cf032e90aa131c4b808d01935d6f17a9e4aa5283539e815c242ab42ddcb2	PE32	2022-03-12 18:01:36	User Submission	YRP/Visual_Cpp_2005_DLL_Microsoft YRP/Visual_Cpp_2003_DLL_Microsoft YRP/IsPE32 YRP/IsDLL [+] YRP/IsConsole YRP/HasDebugData YRP/HasRichSignature YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Antivirus YRP/Dropper_Strings YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/network_dns YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/BASE64_table YRP/VC8_Random YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library
ff0221d356f7660f6c3a669ad2caf2cadc775f34c395d3504c75e33122eb78aa	DOS	2022-03-12 02:48:37	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Dropper_Strings YRP/Big_Numbers1
f723cc3c8347a9586cb66353d36a33e8c9c3dfcf548d5db6e7001cee674348cb	PE32	2022-03-12 02:07:14	User Submission	YRP/Microsoft_Visual_Studio_NET YRP/Microsoft_Visual_C_v70_Basic_NET_additional YRP/Microsoft_Visual_C_Basic_NET YRP/Microsoft_Visual_Studio_NET_additional [+] YRP/Microsoft_Visual_C_v70_Basic_NET YRP/NET_executable_ YRP/NET_executable YRP/NETDLLMicrosoft YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsNET_EXE YRP/IsWindowsGUI YRP/HasDebugData YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/VM_Generic_Detection YRP/Dropper_Strings YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/disable_antivirus YRP/escalate_priv YRP/win_token YRP/android_meterpreter YRP/suspicious_packer_section
e226c5d1da6c543ed8df78780e8f29441afbbe7d5b9ca9814e6d1e0a5fa00a3a	PE32	2022-03-12 01:03:51	User Submission	YRP/VC8_Microsoft_Corporation YRP/Microsoft_Visual_Cpp_8 YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDebugData YRP/HasRichSignature YRP/powershell YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_token YRP/win_files_operation YRP/android_meterpreter
df91ba06829e03c31b444a5dd0e9f5f00dfa3bf026d80e3aa109fa6246246ca3	ISO-8859	2022-03-11 15:43:48	User Submission	CuckooSandbox/embedded_win_api YRP/powershell YRP/domain YRP/contentis_base64 [+] YRP/Antivirus
001e8cac15de84d6c52022348b0a17cb2a3511055fd52c116a01fddf0f87e1a1	ISO-8859	2022-03-11 13:04:25	User Submission	YRP/powershell YRP/domain YRP/IP YRP/contentis_base64 [+] YRP/Antivirus YRP/android_meterpreter YRP/Big_Numbers0 YRP/Big_Numbers1 YRP/Big_Numbers2
2722b539f1f80de10a6a871c43156adb397d41eb3113ef22bae73d64358ba673	PE32	2022-03-11 03:01:11	User Submission	YRP/Borland_Delphi_40_additional YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional YRP/Borland_Delphi_30_ [+] YRP/Borland_Delphi_Setup_Module YRP/Borland_Delphi_40 YRP/Borland_Delphi_v40_v50 YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/NETexecutableMicrosoft YRP/D1S1Gv11betaD1N YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/borland_delphi YRP/powershell YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/DebuggerException__SetConsoleCtrl YRP/network_tcp_listen YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/spreading_share YRP/win_mutex YRP/win_private_profile YRP/win_files_operation YRP/Big_Numbers1 YRP/Big_Numbers3 YRP/MD5_Constants YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library
4fcdfd483c322ddc5f1c69ea499da6a08ff741ce6547401fa5d47dca2b91c3e2	ASCII	2022-03-10 11:04:02	User Submission	YRP/powershell YRP/domain YRP/contentis_base64 YRP/Antivirus
0faa426103d068eb2a0dff28073ad870ccc4a07c5778f4038f84ceea8d53d28a	ASCII	2022-03-10 11:03:45	User Submission	YRP/powershell YRP/domain YRP/contentis_base64 YRP/Antivirus [+] YRP/android_meterpreter YRP/suspicious_packer_section
57df82d0e4547407bdca25692313c2a95b07438991c4cfd44a85d85e5976a965	PE32	2022-03-09 22:01:56	User Submission	YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional YRP/Borland_Delphi_30_ YRP/Borland_Delphi_v40_v50 [+] YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasDigitalSignature YRP/HasDebugData YRP/ImportTableIsBad YRP/HasRichSignature YRP/powershell YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Antivirus YRP/Dropper_Strings YRP/WMI_strings YRP/CRC32b_poly_Constant YRP/BASE64_table
2fdf647a72523cc5384e2fdb59cfb61e404972ccbec98356d7601e3ec7ab5963	ISO-8859	2022-03-09 15:07:45	User Submission	YRP/powershell YRP/domain YRP/IP YRP/contentis_base64 [+] YRP/Antivirus YRP/Big_Numbers0 YRP/Big_Numbers1 YRP/Big_Numbers2
ae1875d84578de33147aa6a13293b15af610a73835eb5c7d91ab77a83b104c1a	Composite	2022-03-09 15:05:26	User Submission	CuckooSandbox/embedded_win_api YRP/powershell YRP/office_document_vba YRP/Contains_VBA_macro_code [+] YRP/domain YRP/IP YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/Antivirus
1aa032a3d316f19de0c0946185eb7331aa1270d52882550c867eae1ce540ade1	ASCII	2022-03-09 15:02:11	User Submission	YRP/powershell YRP/domain YRP/url YRP/contentis_base64 [+] YRP/WMI_strings
e05a3479cc1be3582990365a2d27c15ac9b71887540a669f3ed824dbb380e6c4	ASCII	2022-03-09 15:02:04	User Submission	YRP/powershell YRP/domain YRP/contentis_base64 FlorianRoth/PowerShell_Case_Anomaly
7f5b2d64df0005db16f4c374c7516ce15b45dc7434c88fbe7d35751306d12763	ASCII	2022-03-09 15:01:58	User Submission	CuckooSandbox/embedded_win_api YRP/powershell YRP/domain YRP/contentis_base64 [+] YRP/Antivirus
9982e2b2669fed19e1a17c19f36bde0f25cc6d44dd9e526e36202adf04e0710d	ASCII	2022-03-09 15:01:51	User Submission	CuckooSandbox/embedded_win_api YRP/powershell YRP/domain YRP/contentis_base64 [+] YRP/Antivirus
79d3e3868ba629fc7c42b8bb59ce48a684e521bc3c88233882209fd64af54e39	ASCII	2022-03-09 15:01:45	User Submission	YRP/powershell YRP/domain YRP/contentis_base64 YRP/Antivirus
46762d829dcf95b5e3fa760a449723b56719e949873eb179eb9013caf124c80e	ISO	2022-03-09 14:01:08	User Submission	CuckooSandbox/embedded_pe CuckooSandbox/embedded_win_api YRP/powershell YRP/domain [+] YRP/contentis_base64 YRP/System_Tools YRP/Antivirus YRP/Misc_Suspicious_Strings YRP/anti_dbg YRP/win_files_operation
7a29d349ffba4169b7b794b5043d522f871a228887662d7c61e3f9bb4c64a125	ASCII	2022-03-09 10:46:51	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64
c839926945c2bdd51f98f6a489e6fc9b6c64b2ea629ba71709189934cc06019e	ISO	2022-03-09 10:13:07	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64
b4449f9cc3f26804acff63a842c8fce3a0670d5c4faaebfd9058d94e0cf1f0bb	PE32	2022-03-09 02:14:12	User Submission	YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsNET_EXE YRP/IsWindowsGUI [+] YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/DebuggerCheck__QueryInfo YRP/network_tcp_listen YRP/win_files_operation YRP/android_meterpreter YRP/CRC32_poly_Constant YRP/CRC32b_poly_Constant YRP/RijnDael_AES_CHAR YRP/RijnDael_AES_LONG
02b5502da435ec69d6bc03075849f3645e29d88cee1b245e5f962913a2176733	HTML	2022-03-08 23:00:46	https://blogs.blackberry.com/ja/jp/2022/01/th...	YRP/powershell YRP/domain YRP/url YRP/contentis_base64 [+] YRP/Misc_Suspicious_Strings YRP/Big_Numbers1 YRP/Big_Numbers3
17994479898f449c85b09f3ab0f6dab102fd0d270eb49e55c36fb61fdee5ce1c	ASCII	2022-03-08 22:01:20	User Submission	YRP/powershell YRP/domain YRP/url YRP/contentis_base64 [+] YRP/Misc_Suspicious_Strings
668779a07751d78171d250ab0016b85e84293cc1703def87a04451a1e2df8b37	PE32	2022-03-08 19:07:35	User Submission	YRP/Microsoft_Visual_Studio_NET YRP/Microsoft_Visual_C_v70_Basic_NET_additional YRP/Microsoft_Visual_C_Basic_NET YRP/Microsoft_Visual_Studio_NET_additional [+] YRP/Microsoft_Visual_C_v70_Basic_NET YRP/NET_executable_ YRP/NET_executable YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsNET_EXE YRP/IsWindowsGUI YRP/powershell YRP/domain YRP/IP YRP/contentis_base64
93f7ff4b83f11561b03c9a038147f5ac29ba618ad82c86f5e75114a1ba129916	PE32	2022-03-08 18:08:47	User Submission	YRP/Microsoft_Visual_Studio_NET YRP/Microsoft_Visual_C_v70_Basic_NET_additional YRP/Microsoft_Visual_C_Basic_NET YRP/Microsoft_Visual_Studio_NET_additional [+] YRP/Microsoft_Visual_C_v70_Basic_NET YRP/NET_executable_ YRP/NET_executable YRP/IsPE32 YRP/IsNET_EXE YRP/IsWindowsGUI YRP/HasDebugData YRP/powershell YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/network_tcp_listen YRP/android_meterpreter
2f7741a7294e4dc6c3ae7fc5b6a5c35f45d128f57aec8831c5270076e709e9da	ASCII	2022-03-08 18:07:48	User Submission	CuckooSandbox/embedded_win_api YRP/powershell YRP/domain YRP/contentis_base64 [+] YRP/Antivirus
8c4477fd5129d549aabcbbcab1950965f7f0e0c934a60043dc7d27e57252868f	ASCII	2022-03-08 18:07:43	User Submission	YRP/powershell YRP/domain YRP/url YRP/contentis_base64 [+] YRP/WMI_strings
908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53	PE32+	2022-03-08 18:07:26	User Submission	YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsConsole YRP/HasDebugData [+] YRP/HasRichSignature YRP/powershell YRP/domain YRP/url YRP/contentis_base64 YRP/Antivirus YRP/win_registry YRP/win_files_operation
15692c35ee4c33b49396542237ca1aad5b33a94ee254fea11f4cf5dd579f714c	UTF-8	2022-03-08 13:04:07	User Submission	YRP/powershell YRP/domain YRP/url YRP/contentis_base64
865ed963cb978f0c9e235329ff07556962342371eee620db9745982d358582fe	MS	2022-03-08 13:02:38	User Submission	YRP/powershell YRP/domain YRP/contentis_base64 YRP/Antivirus
906dd323f150aa788f650d5defc6f89f96c88828a108e4eca666bc9020536b3b	HTML	2022-03-08 11:00:38	https://blogs.blackberry.com/ja/jp/2022/01/th...	YRP/powershell YRP/domain YRP/url YRP/contentis_base64 [+] YRP/Misc_Suspicious_Strings YRP/Big_Numbers1 YRP/Big_Numbers3
0d041f0245993bf70ade0170afe20dffe547eea770caf367a6a86d031a1e61af	ASCII	2022-03-08 10:14:56	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus
ecba3c556a5b55b316eb92bd3bec62dba95199c5d5e7703e131198eabb2e5920	ASCII	2022-03-08 10:14:55	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus
f10500eb6019c07d798ed716f1603213e386488eb2732b52c12f4eab8bd1a46c	ASCII	2022-03-08 10:14:53	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus YRP/Dropper_Strings
7b4278daad5673e07aabee171ede14566075f51f4394b2a35c28ccff19fd99e4	ASCII	2022-03-08 10:14:51	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus YRP/Dropper_Strings
adb8b9c0399ba3c31037112dec463b1f0cce3e6996128700c4d6e37e586bcbfc	ASCII	2022-03-08 10:14:50	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus YRP/Dropper_Strings
ad561fc3a444b482988af90dd4f7947da9a9e333b8b6b686269ad1625a018a9c	ASCII	2022-03-08 10:14:49	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus
b6a30742054be57e23a03352b983152dee7feb63ea840e8b6307f0d882800414	ASCII	2022-03-08 10:14:48	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus
973fe28fcd15579f0e427af89dd79eaf7e044396af4017f79a42661da7f76ec5	ASCII	2022-03-08 10:14:47	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus
4d4f24162fdf08f3331c040b57bd180fdd71d8102d958789831da1a8c83321b0	ASCII	2022-03-08 10:14:46	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus
f9b393718e2ad604faa4976c2c0441fdf93b83b29f1b062a7c79b2c7af421ddf	ASCII	2022-03-08 10:14:44	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus YRP/Dropper_Strings
8b579199e558c80464295761491ba182d6fbfeb20f939d0df2a33632e967a5e1	ASCII	2022-03-08 10:14:42	User Submission	YRP/powershell YRP/domain YRP/IP YRP/url [+] YRP/contentis_base64 YRP/Antivirus

Recent Searches
yrp/powershell
yrp/warning_trojan_huigezi_additional
yrp/nullsoft_install_system_v20a0_additional
yrp/crc16_table
yrp/telock_v099_te_tmd
yrp/apt9002
yrp/webshell_b374k_php
yrp/createinstall_v200335
yrp/createinstall_v200335_additional
yrp/createinstallv200335

Search

Recent Searches