MalShare

SHA256 Hash	File type	Added	Source	Yara Hits
e21670df59190d3739b19dd9e1d55d321c935ffa38796ddcb69dc85dbae3f4ad	PE32+	2022-03-09 15:47:18	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsWindowsGUI [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/RE_Tools YRP/Antivirus YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Misc_Suspicious_Strings YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antivm_virtualbox YRP/network_tcp_listen YRP/network_smtp_raw YRP/network_tcp_socket YRP/network_dns YRP/win_files_operation YRP/vmdetect_misc YRP/Advapi_Hash_API YRP/CRC32_poly_Constant YRP/CRC32_table YRP/BASE64_table YRP/Str_Win32_Winsock2_Library YRP/suspicious_packer_section
837a474947d80d86f1d35a59dbef26a14d184d015648b1e1d79937942a9eda44	PE32	2022-03-06 19:01:38	User Submission	CuckooSandbox/vmdetect YRP/Borland_Delphi_40_additional YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional [+] YRP/Borland_Delphi_30_ YRP/Borland_Delphi_Setup_Module YRP/Borland_Delphi_40 YRP/Borland_Delphi_v40_v50 YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Delphi_CompareCall YRP/Delphi_Copy
c56792bea8ac5fbf893ae3df1be0c3c878a615db6b24fd5253e5cbbc2e3e1dd3	PE32	2022-02-21 19:15:50	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsDLL [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/contentis_base64 YRP/System_Tools YRP/VM_Generic_Detection YRP/VMWare_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/WMI_strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbgtools YRP/antivm_virtualbox YRP/antivm_bios YRP/network_http YRP/network_dga YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/Advapi_Hash_API YRP/CRC32b_poly_Constant YRP/MD5_API YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
37b88a783a39c8217291509309c4154bd80cd1c7b581a41f2f4a0c6aca82f990	PE32	2022-02-19 05:39:34	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/DarkComet_1 YRP/DarkComet_3 FlorianRoth/RAT_DarkComet KevTheHermit/DarkComet
feadfb592e58fdd9db1de2bb384ef5031fc79d8bede991f5308b49145334e947	PE32	2022-02-18 06:27:40	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/escalate_priv YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_token YRP/Delphi_CompareCall YRP/Delphi_Copy
0f6dbbd33f333545a147c4b54c2d735a50005b139f60d6d9b8ccd3b40aa362d8	PE32	2022-02-18 03:57:15	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/D1S1Gv11betaD1N [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/Check_VBox_Description YRP/vmdetect YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/antivm_bios YRP/disable_antivirus YRP/inject_thread YRP/create_service YRP/network_udp_sock YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/sniff_audio YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/DarkComet_1 YRP/DarkComet_3 FlorianRoth/Typical_Malware_String_Transforms FlorianRoth/RAT_DarkComet KevTheHermit/DarkComet
b315ad447078e9dbaad29b4d4652ee64371dc82ede0017444a6989320f56894d	PE32	2022-02-18 01:20:51	User Submission	CuckooSandbox/vmdetect YRP/VC8_Microsoft_Corporation YRP/Microsoft_Visual_Cpp_8 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Misc_Suspicious_Strings YRP/DebuggerException__SetConsoleCtrl YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/antivm_vmware YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/BLOWFISH_Constants YRP/BASE64_table YRP/VC8_Random YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Http_API YRP/suspicious_packer_section
5116c025903794c57640f12b9d8adb5ad349d3d429b3f4af02d5e99d30ec2da5	PE32	2022-02-18 01:14:52	User Submission	CuckooSandbox/vmdetect YRP/Borland YRP/D1S1Gv11betaD1N YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/create_service YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/sniff_audio YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/DarkComet_1 YRP/DarkComet_3 FlorianRoth/RAT_DarkComet KevTheHermit/DarkComet
1c289f9aeb483881a663bc4abdf127fcdd667d458de35990bcdca2008924fca2	PE32	2022-02-17 20:25:02	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/dyndns YRP/cred_local YRP/cred_ff YRP/cred_ie7 YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Advapi_Hash_API YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/CyberGate FlorianRoth/RAT_CyberGate KevTheHermit/CyberGate BAMFDetect/CyberGate
516291b27f4c244b3ff74d81dc4c7ba3cb56c7a660d202873ba53301bb426db9	PE32	2022-02-17 20:13:31	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature [+] YRP/maldoc_getEIP_method_1 YRP/domain YRP/url YRP/contentis_base64 YRP/VMWare_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/vmdetect YRP/antivm_virtualbox YRP/disable_antivirus YRP/network_dropper YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/Advapi_Hash_API YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API
66e58ae7bc60cce88a3aa7a455c883d2f4c492254801fb6a186a292ae935754a	PE32	2022-02-17 11:45:42	User Submission	CuckooSandbox/vmdetect YRP/Borland_Delphi_40_additional YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional [+] YRP/Borland_Delphi_30_ YRP/Borland_Delphi_Setup_Module YRP/Borland_Delphi_40 YRP/Borland_Delphi_v40_v50 YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/Borland YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/System_Tools YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
96db17cb0f187ca58c8108a444068cd4c51af74c8d9b058084f13db53d7541b4	PE32	2022-02-17 11:33:18	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50v60 YRP/Microsoft_Visual_Basic_v50 YRP/Microsoft_Visual_Basic_v50_v60 [+] YRP/Microsoft_Visual_Basic_v50_additional YRP/Microsoft_Visual_Basic_v50v60_additional YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/IsSuspicious YRP/domain YRP/contentis_base64 YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/SEH__vba YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/win_registry YRP/win_files_operation YRP/Big_Numbers0 YRP/Delphi_CompareCall YRP/Delphi_Copy
f0701ecae15c65f23eecdab3a790827e02403c02e1f03f7ad1cfac1b3e27a8bd	PE32	2022-02-17 09:13:51	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/D1S1Gv11betaD1N [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/create_service YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/sniff_audio YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/DarkComet_1 YRP/DarkComet_3 FlorianRoth/RAT_DarkComet KevTheHermit/DarkComet
061df43675030dad921664329f0dbea416efd69c46430cefb9080c35fbb863f3	PE32	2022-02-17 08:18:11	User Submission	CuckooSandbox/vmdetect YRP/AHTeam_EP_Protector_03_fake_PCGuard_403_415_FEUERRADER YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/HasOverlay YRP/domain YRP/contentis_base64 YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/win_registry YRP/win_files_operation
3a6be3abc429d773411dbbb20b89c915f96f62a936231880d473ae6d26c2a008	PE32	2022-02-17 05:22:22	User Submission	CuckooSandbox/vmdetect YRP/Borland_Delphi_40_additional YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional [+] YRP/Borland_Delphi_30_ YRP/Borland_Delphi_Setup_Module YRP/Borland_Delphi_40 YRP/Borland_Delphi_v40_v50 YRP/BobSoft_Mini_Delphi_BoB_BobSoft_additional YRP/Borland_Delphi_v60_v70 YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/Borland YRP/BobSoftMiniDelphiBoBBobSoft YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/RE_Tools YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antivm_virtualbox YRP/screenshot YRP/keylogger YRP/spreading_file YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate
468e7bf4683f3683ead964271f0ff17902c0458040689431d8d8e9ba40b121c0	PE32	2022-02-17 01:17:58	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/DarkComet_1 YRP/DarkComet_3 FlorianRoth/RAT_DarkComet KevTheHermit/DarkComet
b501a88bc7ef59905977a817c10dea64640a2c7237c57882359e87795d88b720	PE32	2022-02-17 00:36:27	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50v60 YRP/Microsoft_Visual_Basic_v50 YRP/Microsoft_Visual_Basic_v50_v60 [+] YRP/Microsoft_Visual_Basic_v50_additional YRP/Microsoft_Visual_Basic_v50v60_additional YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/SEH__vba YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/dyndns YRP/cred_local YRP/cred_ff YRP/cred_ie7 YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Advapi_Hash_API YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/CyberGate FlorianRoth/RAT_CyberGate KevTheHermit/CyberGate BAMFDetect/CyberGate
a6c2de44816b18ee569ad1503ab02b8a23e79bcb1e5d41158ff3afce294f0b83	PE32	2022-02-16 23:20:42	User Submission	CuckooSandbox/vmdetect YRP/VC8_Microsoft_Corporation YRP/Microsoft_Visual_Cpp_8 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Misc_Suspicious_Strings YRP/DebuggerException__SetConsoleCtrl YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/antivm_vmware YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/BLOWFISH_Constants YRP/BASE64_table YRP/VC8_Random YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Http_API
20c8a6d277974d84fe3b55c13f3333215689aeb3732cb9a0749fbfe186bb6a56	PE32	2022-02-16 21:57:32	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/Browsers YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/escalate_priv YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
6fcfdae466a526d417a053205db10b19d858fe255f86283059f8f2fc970cb8ec	PE32	2022-02-16 19:28:32	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/DarkComet_1
be2cb75049def7afcbd979674225cd7eb62d88643bb08e5009167ac85fbab1ce	PE32	2022-02-16 11:27:17	User Submission	CuckooSandbox/vmdetect YRP/Petite_v22_Compresor_wwwun4seencompetite YRP/PEtite_v21 YRP/FSG_v110_Eng_dulekxt_Borland_Delphi_Borland_Cpp_additional [+] YRP/Petite_v21_2_additional YRP/Petite_v22_wwwun4seencompetite_additional YRP/PackerPetite_v22_Compresor_wwwun4seencompetite YRP/Petite_v22_wwwun4seencompetite YRP/PEtite_v21_additional YRP/Petite_v21_2_Hint_WIN_EP YRP/Petite_v21_2 YRP/PEtite_v21_Ian_Luck YRP/Borland YRP/Petite21 YRP/Petitev212 YRP/PEtitev21 YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/IsBeyondImageSize YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
2595f5c96528f07e2b498720e49c765bb299937706f73e08765cdc68266ea573	PE32	2022-02-16 03:41:00	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/borland_delphi YRP/domain YRP/contentis_base64 YRP/Browsers YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/escalate_priv YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
2fb327f002d91d2b6539cdc2e5133564b296d196186f8121d3363b270afb38c8	PE32	2022-02-15 23:38:07	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/borland_delphi YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/DarkComet_1
15758e91ed9bbead48c23b487dc945343532b898a6bb0639160850df4e8c4817	PE32	2022-02-13 15:01:04	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v4x YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/dyndns YRP/cred_local YRP/cred_ff YRP/cred_ie7 YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Advapi_Hash_API YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/CyberGate FlorianRoth/RAT_CyberGate KevTheHermit/CyberGate BAMFDetect/CyberGate
11513e7948c07f47ebc09a0c7a83a73d4ea766c7b262e5db284eefea03ea718d	PE32+	2022-01-24 15:50:20	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 YRP/IsConsole [+] YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__RemoteAPI YRP/vmdetect YRP/Check_Debugger YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/win_files_operation YRP/vmdetect_misc FlorianRoth/DragonFly_APT_Sep17_3
3d451109f739f998f4823635e2055913fc00fcae8beacabc53064b693c3effdd	PE32	2021-09-30 18:02:50	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Studio_NET YRP/Microsoft_Visual_C_v70_Basic_NET_additional YRP/Microsoft_Visual_C_Basic_NET [+] YRP/Microsoft_Visual_Studio_NET_additional YRP/Microsoft_Visual_C_v70_Basic_NET YRP/NET_executable_ YRP/NET_executable YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsNET_EXE YRP/IsWindowsGUI YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VMWare_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/vmdetect YRP/antivm_virtualbox YRP/network_smtp_dotNet YRP/lookupip YRP/keylogger YRP/win_hook YRP/vmdetect_misc
aae36322e08a25eb9cb7b043ac379c9db77fb4150b978a291ddccfb49cda49e8	PE32	2021-09-30 13:07:56	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v4x YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/dyndns YRP/cred_local YRP/cred_ff YRP/cred_ie7 YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Advapi_Hash_API YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/CyberGate FlorianRoth/RAT_CyberGate KevTheHermit/CyberGate BAMFDetect/CyberGate
0bb97dce40fb704d418bf56eaac0d0d8a62457920f57f20474d1b05a6e8bcf36	PE32	2021-09-20 12:04:47	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/ThreadControl__Context YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/disable_dep YRP/inject_thread YRP/network_dropper YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Xtreme YRP/xtreme_rat YRP/xtremrat FlorianRoth/RAT_Xtreme FlorianRoth/Xtreme_Sep17_1 KevTheHermit/Xtreme BAMFDetect/Xtreme
5a9be6ab91b206446ee357cb8cad8c2ec9fb0727e895b679886fd35bddc4ae9b	PE32	2021-09-14 23:00:54	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/ThreadControl__Context YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/disable_dep YRP/inject_thread YRP/network_dropper YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Xtreme YRP/xtreme_rat YRP/xtremrat FlorianRoth/RAT_Xtreme FlorianRoth/Xtreme_Sep17_1 KevTheHermit/Xtreme BAMFDetect/Xtreme
70a02538e29f42dd5808bda9017a826d6cf2717347cc2c411a3b4e368b1344d6	PE32	2021-09-14 11:42:23	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
e5f3e0e8ffa3619dea8ef75d285ac7bb74603618b5f82af2a44165da4ab58390	PE32	2021-09-14 11:30:04	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v4x YRP/UPXv20MarkusLaszloReiser [+] YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser YRP/UPX20030XMarkusOberhumerLaszloMolnarJohnReiser YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/dyndns YRP/cred_local YRP/cred_ff YRP/cred_ie7 YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Advapi_Hash_API YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/suspicious_packer_section YRP/CyberGate FlorianRoth/RAT_CyberGate KevTheHermit/CyberGate BAMFDetect/CyberGate
40492804d8bfeb59a629fab0667547da90c16feaaed7f84312ed0a7e627643e3	PE32	2021-09-14 11:29:42	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v4x YRP/UPXv20MarkusLaszloReiser [+] YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser YRP/UPX20030XMarkusOberhumerLaszloMolnarJohnReiser YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasModified_DOS_Message YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/dyndns YRP/cred_local YRP/cred_ff YRP/cred_ie7 YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Advapi_Hash_API YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/suspicious_packer_section YRP/CyberGate FlorianRoth/RAT_CyberGate KevTheHermit/CyberGate BAMFDetect/CyberGate
26eb2ff8d4f84e27f105fe1f93e8964f001433c02c6f70bf4c4e82d9f70967b8	PE32	2021-09-14 11:28:29	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v4x YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/dyndns YRP/cred_local YRP/cred_ff YRP/cred_ie7 YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Advapi_Hash_API YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/CyberGate FlorianRoth/RAT_CyberGate KevTheHermit/CyberGate BAMFDetect/CyberGate
ec382f2ae880294c7032c67e962ee76de8df7203b81a5c3d9c276f0bec5092bb	PE32	2021-09-07 07:11:07	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v4x YRP/UPXv20MarkusLaszloReiser [+] YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser YRP/UPX20030XMarkusOberhumerLaszloMolnarJohnReiser YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/dyndns YRP/cred_local YRP/cred_ff YRP/cred_ie7 YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Advapi_Hash_API YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/suspicious_packer_section YRP/CyberGate FlorianRoth/RAT_CyberGate KevTheHermit/CyberGate BAMFDetect/CyberGate
9068d4510f0f1f7abc7d98ac79909ed8ce66863f1020338cfb5ad010e250e342	PE32	2021-09-02 10:01:24	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_60_70 YRP/Borland [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Delphi_Copy
e5778446d63e571a7b4829719fd88b5f3b7946cefd4797f92a9ff9a9c93f115f	PE32	2021-09-01 01:27:57	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v4x YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/IsBeyondImageSize YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/dyndns YRP/cred_local YRP/cred_ff YRP/cred_ie7 YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Advapi_Hash_API YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/CyberGate FlorianRoth/RAT_CyberGate KevTheHermit/CyberGate BAMFDetect/CyberGate
c57eca59361819324f22e8203e46bb7e5a92bdea1c8b2a1f03b3e9a4e2a309f8	PE32	2021-08-31 07:06:16	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland YRP/D1S1Gv11betaD1N [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi YRP/borland_delphi_dll YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/Sandboxie_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbgtools YRP/antisb_sandboxie YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/create_service YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/cred_local YRP/sniff_audio YRP/cred_ff YRP/spreading_share YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/DarkComet_1 YRP/DarkComet_3 FlorianRoth/RAT_DarkComet KevTheHermit/DarkComet
e568dbee82ecd2d3089f927aed0e8971dd60bb8b3260d01a3acc5726f7233321	PE32	2021-07-13 19:01:34	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v4x YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Obfuscated_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/inject_thread YRP/dyndns YRP/cred_local YRP/cred_ff YRP/cred_ie7 YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Advapi_Hash_API YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/CyberGate FlorianRoth/RAT_CyberGate KevTheHermit/CyberGate BAMFDetect/CyberGate
11b785e77cbfa2d3849575cdfabd85d41bae3f2e0d33a77e7e2c46a45732d6e4	PE32+	2021-07-12 08:08:27	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_80 YRP/Microsoft_Visual_Cpp_80_DLL YRP/IsPE64 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDebugData YRP/HasRichSignature YRP/powershell YRP/domain YRP/url YRP/contentis_base64 YRP/System_Tools YRP/VMWare_Detection YRP/VirtualBox_Detection YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/win_mutex YRP/win_files_operation YRP/vmdetect_misc YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
d2c1eb910324b365fc23e98a80367694d8ebeb76d4d1f12955d27b12b22aca52	PE32	2021-06-29 13:01:44	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_C_Basic_NET YRP/Borland YRP/IsPE32 [+] YRP/IsNET_EXE YRP/IsWindowsGUI YRP/borland_delphi_dll YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Antivirus YRP/VMWare_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antivm_virtualbox YRP/disable_dep YRP/inject_thread YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Prime_Constants_long YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/RIPEMD160_Constants YRP/SHA1_Constants YRP/SHA512_Constants YRP/RijnDael_AES_CHAR YRP/RijnDael_AES_LONG YRP/BASE64_table YRP/Delphi_Random YRP/Delphi_FormShow YRP/Delphi_CompareCall YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate
b0e72b0428ffe8a6d46eba437cafbaab333cb93ab8107f748a3326977dc1dac5	PE32	2021-06-20 00:00:36	User Submission	CuckooSandbox/vmdetect YRP/Borland_Delphi_40_additional YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional [+] YRP/Borland_Delphi_30_ YRP/Borland_Delphi_Setup_Module YRP/Borland_Delphi_40 YRP/Borland_Delphi_v40_v50 YRP/BobSoft_Mini_Delphi_BoB_BobSoft_additional YRP/Borland_Delphi_v60_v70 YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/Borland YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser YRP/BobSoftMiniDelphiBoBBobSoft YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/hijack_network YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/UPX YRP/suspicious_packer_section
9f8d88733008dd5f32990c118fda0dc2ed6d9dde6ba86a911d9f1f03b64d243f	PE32	2021-05-29 18:00:33	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/IsPE32 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/ThreadControl__Context YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/disable_dep YRP/inject_thread YRP/network_dropper YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Delphi_Random YRP/Delphi_CompareCall YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Xtreme YRP/xtreme_rat YRP/xtremrat FlorianRoth/RAT_Xtreme FlorianRoth/Xtreme_Sep17_1 KevTheHermit/Xtreme BAMFDetect/Xtreme
2d78b1529bb319569b0c42109fe9dc227a6d05199b149040fffab43a8f1831cd	PE32	2021-05-19 04:09:24	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/NETDLLMicrosoft YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter YRP/CRC32_poly_Constant YRP/CRC32_table
3cfc8d3886e3cf52a49c23289d3c134a1374c0d855c1cdf466788d28c6c2e7af	PE32	2021-05-19 03:07:18	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
a948da2ce9e1eb70a990c24e22b910595f8cdd59e21c8d219cc1a390d1d2aba4	PE32	2021-05-19 03:05:00	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter
a412094dc7a70b14500d2a79417a8dba954a4f347bfd3671f27a2a7f8ca90b82	PE32	2021-05-19 03:03:33	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc
b2dbc6d8d24d6038a11f9607961aed71afff6c8838a010e57639eb9bf934fff2	PE32	2021-05-19 02:05:27	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDigitalSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/Advapi_Hash_API YRP/CRC32_poly_Constant YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
be177c4198ed7040b20b6ddf6aa99aa50ebde4edeb9f222bf7b9d44261e101d3	PE32	2021-05-19 02:03:48	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/NETDLLMicrosoft YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc
7b3f02023dfda588b43a13e601330a55b5cc5f543bf07cdc2e0b4feaf0c31919	PE32	2021-05-19 02:02:38	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/NETDLLMicrosoft YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc
d0a7b18e0c920ccac57412a18a50962add19288f59eaf14cc2c73d35769c4c2d	PE32	2021-05-19 01:07:28	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
e6ef3eee04b4fe50cfc75f9a503b408685fda7b55ace3b4ce6a774c7554d10a7	PE32	2021-05-19 00:03:52	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/VirtualBox_Detection YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/migrate_apc YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/vmdetect_misc YRP/android_meterpreter YRP/suspicious_packer_section
89b00395723caca7fca97a0943226143513591d2dca97df0a2e4b697220cfdd7	PE32	2021-05-19 00:03:24	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDigitalSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antisb_threatExpert YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter YRP/Big_Numbers0 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/BASE64_table
f826320b4d31c68a1dbff3d5b75b5ad48e53e15303b7c5fe5dd6144c629fcbbc	PE32	2021-05-19 00:02:38	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDigitalSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/screenshot YRP/keylogger YRP/migrate_apc YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter
6bbd4ec8bb4898af7c4f85567dd1b4d7cb288c902f3937e4a79c9b23daf7feb4	PE32	2021-05-19 00:01:29	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
a2b79161f35eef204ee4448399ba10d82075d1f1559f14413e95195cf0007f0a	PE32	2021-05-18 23:07:37	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
1e2c8b465b8fba562487509102a4c761dd1fe2e8e7dc7ab929cf5045b8e563a6	PE32	2021-05-18 23:06:12	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDigitalSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antisb_threatExpert YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter YRP/Big_Numbers0 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/BASE64_table
e81f3f82a5771168932ae21b417832a270b31028fc73cba32794a0e3480cda2a	PE32	2021-05-18 23:05:47	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
e9d4060e75d39ce54ed688c1aff09869d3ed62d4dc6c1ca47f925833b168c362	PE32	2021-05-18 23:05:21	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc YRP/Big_Numbers1
4e7f40821d32d13540ad31ba4927b6cff4ac8dab1edc20ce1c98fceb44ba5a80	PE32	2021-05-18 23:02:29	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc
9c4e119020c1687503dc759a9597751d7c8db8b3778bb683b458a954d2a0198b	PE32	2021-05-18 23:01:54	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter
63808b2c888e0ea750dfb3ae9b655cf6d95740fb4d16a206d3ec1146dd8c32f5	PE32	2021-05-18 23:01:38	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter
81c6fc416ed33fbaced51be11ce35024be4695e1ff09cf96587a74b1e1c41332	PE32	2021-05-18 22:07:21	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDigitalSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/DebuggerException__SetConsoleCtrl YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/escalate_priv YRP/migrate_apc YRP/win_registry YRP/win_token YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter YRP/Advapi_Hash_API
f943cbd3ebb9525d2b3f66933a9fe465d3a8e438b26cb030799ff60ac3430976	PE32	2021-05-18 22:01:25	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/screenshot YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
968954afbc72415f8e496b930faaa506188b5ba25dc8432ae952735ec7c47e64	PE32	2021-05-18 21:05:31	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/NETDLLMicrosoft YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/Big_Numbers1
a755da1212cbbd30ca83a87bcb022dbf20005836976fb56df6b31e27addf54a2	PE32	2021-05-18 21:04:45	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter
86b8a28ec238346a858040221b9bca3f91d51e749cb4615a60db291edf73e7f2	PE32	2021-05-18 21:03:01	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
f81dca23cbc091c80bb1bd0f2a68032de1a062c9bad20e13fb326937b1dfb2ec	PE32	2021-05-18 20:04:48	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/DebuggerException__SetConsoleCtrl YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc YRP/VC8_Random
927e6cda41a9bd5ea2ee0604367285af39fe0b6895bcb13d4cb27c75411e9ddc	PE32	2021-05-18 20:03:55	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDigitalSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/screenshot YRP/keylogger YRP/migrate_apc YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc
808e7c1c64e6e086c6a8e39f43c848468fcf636cedfc1c51b603f4f97b4d53ff	PE32	2021-05-18 20:03:50	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
7f5f2afd85762c0bcc1d24b59f330fec10b90d78f426dd3035e4d8c9d1977c3f	PE32	2021-05-18 19:06:17	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
b783f81d79f6ca3fe6d62fa27ee0c0c6ba603eb6e806ffd98fdad1a57e56817d	PE32	2021-05-18 19:04:45	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/NETDLLMicrosoft YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/VirtualBox_Detection YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc
5916643f48ee35654de35eb3f84a5db098f274f986be386fdce1434855b07cb9	PE32	2021-05-18 19:02:46	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc YRP/Big_Numbers1
c219c55705717698f1c94a9958c1bf1ac1bb9a2fae41643343d9f98c694e666d	PE32	2021-05-18 19:01:42	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
ff4db9e75bb8bc835e01eb999df827cc033b35b1b73df31b48f618acc8153b49	PE32	2021-05-18 18:06:24	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
4d7e90888709fd1e688cad2ad42b00fee107ea40e62182baaf91497f9e412179	PE32	2021-05-18 17:08:08	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
e8f20bbe7b4cb826f9b7f2245687d301f26ad351b1727eb0a1f5b317eaee1e61	PE32	2021-05-18 17:07:34	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/NETDLLMicrosoft YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/with_images YRP/without_attachments YRP/with_urls YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/VirtualBox_Detection YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/network_tcp_listen YRP/keylogger YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/suspicious_packer_section
2a289cdc6cf697e90ff81096b8e650f2c6e0058e483c7202b898253dcdf7477b	PE32	2021-05-18 17:05:57	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDigitalSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Browsers YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/screenshot YRP/keylogger YRP/migrate_apc YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc
0fcf398614875028a6e8e06340a8c66e62b3dfc49ad2ee1fe3068d5d537703c7	PE32	2021-05-18 17:05:42	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
db81bf61de3db5c385342e2b50624b03de861280a9d5e9815ff4c33e02d30347	PE32	2021-05-18 17:04:39	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter
7a0bf3aa0b2e6cf7e0af6eaed4e30f35a27a637a808faf72f8352194927e2060	PE32	2021-05-18 16:07:52	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/NETDLLMicrosoft YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc
fdf390e4a46e7337f0d249076231f87386ef627fa44dcdfff7cfce8097419687	PE32	2021-05-18 16:05:04	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter
aa62c6e2f245e86619aeaa60ece243e8b3cf52d4b9b446818e2a4c42435b79ad	PE32	2021-05-17 13:07:48	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/NETDLLMicrosoft YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/network_dropper YRP/network_tcp_socket YRP/keylogger YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/vmdetect_misc YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/CAP_HookExKeylogger
033eeacdb5c9b19e51aa58fd2e37eaa52e28ce9ba416f43e5910493d3d10d5c0	PE32	2021-05-17 13:07:38	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
81694674c7aee4d677d55d615d557742f785e92bfa51bb3f312118ddb64795d9	PE32	2021-05-17 13:06:02	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/network_dropper YRP/migrate_apc YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/vmdetect_misc YRP/Str_Win32_Wininet_Library
42c9bc417fe6a04984a397d2b28830ba35b94c7868d2105670986d49738a75d4	PE32	2021-05-17 13:05:54	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter
e34460ba93ca277282f842dce2c9acf8784e85c8c2ad9c5a9e6b723a7f586db3	PE32	2021-05-17 13:02:59	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDigitalSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc
f8822d10a4918394ee8fce06747fb7c8b145c390e222e1bee48acd36be421649	PE32	2021-05-17 13:02:50	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDigitalSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antisb_threatExpert YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter YRP/Big_Numbers0 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/BASE64_table
60905cc198af6b44e9fd18de14e64f1ae9bbfca5d185c784ab3be79388881203	PE32	2021-05-17 12:07:46	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
c792e8bb5d012e6670508be0db159fc5fb48616a14397d8fcd99133cc8e78458	PE32	2021-05-17 12:06:28	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
9c7e55234cbfdc924a87c3902182953dc8ab9f814ab132254700b981851e3fce	PE32	2021-05-17 12:04:34	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
9cbfdc3c7e9e6fd235ff7cd8eb33d70fb2349ca60abf3f0ef44a90f3bc2029db	PE32	2021-05-17 12:02:04	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/NETDLLMicrosoft YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/VirtualBox_Detection YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc
6939b58bcf7e9cfb908ab2d8a083fca0c4e5d231f61a0266e83880eea7686460	PE32	2021-05-17 11:07:59	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
7c49ef12a5fcd31f21ba7a3c11e17cee388a5c7f33d52a8a89cafa074e3f04b7	PE32	2021-05-17 11:02:58	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter
8f99bb41e171a8de779c1e096c3ccdd6bf9f75c90c969a1cbb8e2b7ed84d9c71	PE32	2021-05-17 11:01:42	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
35db0107f351e42f080932cbf25d6dafc5803080404cea2d1d0d92f496c7a2fd	PE32	2021-05-17 10:11:39	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/HasDigitalSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/network_dropper YRP/migrate_apc YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/Str_Win32_Wininet_Library
7d02042cab4894b5abce0d89fcd3dc107c0bfa784c7af8384cfb4dde98a8391b	PE32	2021-05-17 10:09:28	User Submission	CuckooSandbox/vmdetect YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay [+] YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_files_operation YRP/vmdetect_misc
5e247e9bffe1a4629f930426e452789f890cfefe6f723da265b9aaf38d138c3c	PE32	2021-05-17 10:07:59	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/NETDLLMicrosoft YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/maldoc_indirect_function_call_3 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc YRP/android_meterpreter
36021427ec8327c8e1704e4fd115bf0bfe74d688e132b642bfc279850626a86f	PE32	2021-05-17 10:07:22	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/migrate_apc YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc
287c8f1e42adbfb4317d83a558561b5c0cf373d383a6dbdbe3a5f259d1e06765	PE32	2021-05-17 10:05:45	User Submission	CuckooSandbox/vmdetect YRP/Microsoft_Visual_Basic_v50 YRP/PureBasic_4x_Neil_Hodgson_additional YRP/PureBasic_4x_Neil_Hodgson [+] YRP/NETDLLMicrosoft YRP/PureBasic4xNeilHodgson YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/PureBasic YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/maldoc_OLE_file_magic_number YRP/VirtualBox_Detection YRP/DebuggerCheck__QueryInfo YRP/vmdetect YRP/anti_dbg YRP/antivm_virtualbox YRP/inject_thread YRP/keylogger YRP/migrate_apc YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/vmdetect_misc
399b5ca1eee21d07a146800fbccb360c524171237b49b1fa415fbabd0c6b92e8	PE32	2021-04-29 21:57:35	User Submission	CuckooSandbox/vmdetect YRP/Borland_Delphi_40_additional YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Borland_Delphi_30_additional [+] YRP/Borland_Delphi_30_ YRP/Borland_Delphi_Setup_Module YRP/Borland_Delphi_40 YRP/Borland_Delphi_v40_v50 YRP/BobSoft_Mini_Delphi_BoB_BobSoft_additional YRP/Borland_Delphi_v60_v70 YRP/Borland_Delphi_v30 YRP/Borland_Delphi_DLL YRP/Borland YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser YRP/BobSoftMiniDelphiBoBBobSoft YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/borland_delphi YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/Sandboxie_Detection YRP/VirtualPC_Detection YRP/VirtualBox_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/Check_Dlls YRP/vmdetect YRP/anti_dbg YRP/anti_dbgtools YRP/antisb_joesanbox YRP/antisb_anubis YRP/antisb_threatExpert YRP/antisb_sandboxie YRP/antisb_cwsandbox YRP/antivm_virtualbox YRP/disable_antivirus YRP/inject_thread YRP/hijack_network YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/spreading_share YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/Delphi_Random YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/UPX YRP/suspicious_packer_section

Recent Searches
yrp/antivm_virtualbox
yrp/warpstrings
yrp/nspackv31northstar
yrp/pezipv10bybagie
yrp/upx_302
yrp/upx_293_300_lzma
yrp/microsoft_visual_cpp_50
yrp/upx_v30_exe_lzma_markus_oberhumer_laszlo_molnar_john_reiser
yrp/upx_v30_exe_lzma_markus_oberhumer_laszlo_molnar_john_reiser_additional
yrp/upx_293_lzma

Search

Recent Searches