MalShare

SHA256 Hash	File type	Added	Source	Yara Hits
2fc6d0c6c22cbb2091a1af6c400259d4abda88c55a987e6477622f04bcdd20c1	PE32	2022-02-24 19:13:46	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Big_Numbers3 FlorianRoth/DragonFly_APT_Sep17_3
8cf20090fdd3aed49805e8d2d5f5bf1f6454c1c941a77edab56c49bcb9d54ac3	PE32	2022-02-24 17:14:26	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/MASM_TASM YRP/PackerMASMTASM_Lenguaje_Compilador [+] YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 FlorianRoth/DragonFly_APT_Sep17_3
72634a37b360590f5f305e26ebe850826120cd907337367b815d2a58262a32ac	PE32	2022-02-24 16:21:57	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Misc_Suspicious_Strings YRP/Big_Numbers1 YRP/Big_Numbers3 FlorianRoth/DragonFly_APT_Sep17_3
cb26580597e0d11486fcdac26c7fdaaccf2b38907eea77d4573e7dbd3115d2d1	PE32	2022-02-24 10:27:52	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/MASM_TASM YRP/PackerMASMTASM_Lenguaje_Compilador [+] YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 FlorianRoth/DragonFly_APT_Sep17_3
d30b1c23b24a06ef7de00363cf9570e8622c68a1adef80570fcc44ce46b586d0	PE32	2022-02-24 09:28:00	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/MASM_TASM YRP/PackerMASMTASM_Lenguaje_Compilador [+] YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 FlorianRoth/DragonFly_APT_Sep17_3
59332a62605f3bca4526748778be8e374e427b5244a60ab7596625a916099c39	PE32	2022-02-24 03:14:25	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/RE_Tools YRP/Antivirus YRP/Big_Numbers1 YRP/Big_Numbers3 YRP/suspicious_packer_section
fe9eeb0b7c828c72da230c443d5caf2bffda6e0c9c96e1c99fbbfc61104adaf7	PE32	2022-02-24 00:22:58	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Misc_Suspicious_Strings YRP/Big_Numbers1 YRP/Big_Numbers3 FlorianRoth/DragonFly_APT_Sep17_3
86b706fbd79d9587749bc3adf3196c53bb473ba9c6c41f8ec50ca3cdc3ab0d90	PE32	2022-02-23 22:54:13	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Big_Numbers3 FlorianRoth/DragonFly_APT_Sep17_3
a8f5de8fc92f27efcfddfcdab7a5353d643b9d677e4975e29ae115160316c606	PE32	2022-02-23 21:16:01	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/MASM_TASM YRP/PackerMASMTASM_Lenguaje_Compilador [+] YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 FlorianRoth/DragonFly_APT_Sep17_3
cc3b3abdaa8b3e75558af7547fb8045d05fbc9987d494a754fb4766568aee0c6	PE32	2022-02-23 21:00:49	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Misc_Suspicious_Strings YRP/Big_Numbers1 YRP/Big_Numbers3 FlorianRoth/DragonFly_APT_Sep17_3
50a21c9b8a21364e1cd97907c6d62650471984b09f819ed64bc45814c182ee51	PE32	2022-02-23 18:12:07	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/MASM_TASM YRP/PackerMASMTASM_Lenguaje_Compilador [+] YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 FlorianRoth/DragonFly_APT_Sep17_3
72aaf1d4021adddfec4fbea5dece0690cd49a3a1a88015379632f69f2e032584	PE32	2022-02-23 15:06:25	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/RE_Tools YRP/Antivirus YRP/anti_dbg YRP/win_files_operation YRP/Big_Numbers3 YRP/PUP_InstallRex_AntiFWb YRP/suspicious_packer_section FlorianRoth/PUP_InstallRex_AntiFWb
f07a8f9a2ac4e28e0309b8beeab1a183387a383fb943446105295c3325575265	PE32	2022-02-23 08:39:22	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/MASM_TASM YRP/PackerMASMTASM_Lenguaje_Compilador [+] YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 FlorianRoth/DragonFly_APT_Sep17_3
d79ac03f11b50215188718215c0c53ed5294ce7318af645ce9e4b40427d6a184	PE32	2022-02-23 08:23:13	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/RE_Tools YRP/Antivirus YRP/Misc_Suspicious_Strings YRP/anti_dbg YRP/win_files_operation YRP/Big_Numbers1 YRP/Big_Numbers3 YRP/PUP_InstallRex_AntiFWb YRP/suspicious_packer_section FlorianRoth/PUP_InstallRex_AntiFWb
429578e127b2335eac72b69c6ad1b51dca1ef714716ab7eb643a87c1c71acee4	PE32	2022-02-23 07:49:55	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/RE_Tools YRP/Antivirus YRP/Misc_Suspicious_Strings YRP/anti_dbg YRP/win_files_operation YRP/Big_Numbers1 YRP/Big_Numbers3 YRP/PUP_InstallRex_AntiFWb YRP/suspicious_packer_section FlorianRoth/PUP_InstallRex_AntiFWb
bc548942b6496408689aea2794d26ff4f579fac904bcaafafd34aaec8b3cc1aa	PE32	2022-02-22 23:35:39	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/MASM_TASM YRP/PackerMASMTASM_Lenguaje_Compilador [+] YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 FlorianRoth/DragonFly_APT_Sep17_3
cdc6f25228e81547f496f8092232bd72a26ea5b12a9539ba1786ec8b090cbc4d	PE32	2022-02-22 22:38:39	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/RE_Tools YRP/Antivirus YRP/anti_dbg YRP/win_files_operation YRP/Big_Numbers3 YRP/PUP_InstallRex_AntiFWb YRP/suspicious_packer_section FlorianRoth/PUP_InstallRex_AntiFWb
c9b3c0738a1e30bcb6c03fe7c68782910f25145becf7b65a431ab02491d4f7b2	PE32	2022-02-22 22:13:02	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/Antivirus YRP/Misc_Suspicious_Strings YRP/Big_Numbers1 YRP/Big_Numbers3 YRP/suspicious_packer_section
cd6139ace98a6d01fa730714851e2b401942048ff521b8c6824393e9981ba082	PE32	2022-02-22 22:01:35	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/NETexecutableMicrosoft YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/System_Tools YRP/RE_Tools YRP/Antivirus YRP/Misc_Suspicious_Strings YRP/anti_dbg YRP/win_files_operation YRP/Big_Numbers1 YRP/Big_Numbers3 YRP/PUP_InstallRex_AntiFWb YRP/suspicious_packer_section FlorianRoth/PUP_InstallRex_AntiFWb
0975ddf307fa869509383298bc2f4fc967cb246dbe8600456a95557a76758336	PE32	2022-02-22 18:18:44	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/win_files_operation FlorianRoth/DragonFly_APT_Sep17_3
faef9b987b9eb1667c0aadaf7b6a9d205c2fb784281d20478f09661f2977aa03	PE32	2022-02-22 11:54:03	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/MASM_TASM YRP/PackerMASMTASM_Lenguaje_Compilador [+] YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 FlorianRoth/DragonFly_APT_Sep17_3
968036fb666d5622e55d7420ae61bc460b161df4c2b642fc53a05ca3f582c28f	PE32	2022-02-17 23:44:21	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/maldoc_getEIP_method_1 YRP/domain YRP/contentis_base64 FlorianRoth/DragonFly_APT_Sep17_3
2501afb3298a4c65b53705c06695cdf2f842d995fb637f09428e4f596048cce4	PE32	2022-02-17 19:48:13	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/ThreadControl__Context
6e9ed34e592b5da7ac49e76b88a2d5892c6b694775645d3d932fab98e8640fb1	PE32	2022-02-17 19:02:11	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasModified_DOS_Message YRP/domain YRP/IP YRP/contentis_base64 YRP/win_files_operation
938e28468712830cdbd2d950d4190d75f4ae792439c426828ab57e4473db8ea2	PE32	2022-02-17 15:31:27	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/maldoc_getEIP_method_1 YRP/domain YRP/contentis_base64 FlorianRoth/DragonFly_APT_Sep17_3
577164e21a2385cfe585c873e0477843bddf5006de22fe888946682b5f899218	PE32	2022-02-17 14:54:34	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasModified_DOS_Message YRP/domain YRP/contentis_base64 YRP/win_files_operation
704d5fc238f123818a93d877b9e02ae806b2a479d2d2a9ea94f52a8daed217bd	PE32	2022-02-17 11:51:01	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/win_files_operation FlorianRoth/DragonFly_APT_Sep17_3
7dfb60be33700ac3accf6961d28a311235b82a9e9fcd4e4bef33a35141e7539e	MS-DOS	2022-02-17 11:44:57	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/ImportTableIsBad YRP/HasModified_DOS_Message YRP/domain YRP/contentis_base64 YRP/Browsers YRP/inject_thread YRP/escalate_priv YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/suspicious_packer_section FlorianRoth/DragonFly_APT_Sep17_3
78c0e60a4a0d6cf7657fbad880f420d03ee0386bcdba72d7d0991061d5e5e3d0	PE32	2022-02-17 10:39:49	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64
a3ddb1774cbe6b151c029b949fcbfe680579492a8723e22c91a3861e19ac197e	PE32	2022-02-17 10:34:11	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/IsSuspicious YRP/domain YRP/url YRP/contentis_base64 FlorianRoth/DragonFly_APT_Sep17_3
6365eb9ff759698466150eeb1709afbb901db93d9869ad2fecc7fae8c88205c9	PE32	2022-02-17 10:29:21	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/domain YRP/contentis_base64 YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Str_Win32_Winsock2_Library
46a110cd792aae1186484c63e365af8c0878dbf3c78b63420b15cb337b743ec2	PE32	2022-02-17 09:11:28	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsDLL YRP/IsWindowsGUI YRP/HasRichSignature YRP/maldoc_getEIP_method_1 YRP/domain YRP/contentis_base64 YRP/DebuggerException__SetConsoleCtrl YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook
01e5fe3b17fc0dd02766b650c6e9dcea248fc21de6c6dd2e272b656438febb11	PE32	2022-02-17 03:50:53	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Dropper_Strings YRP/DebuggerException__SetConsoleCtrl YRP/disable_antivirus YRP/network_http YRP/network_ftp YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/VC8_Random YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
ffd2b7c775144a9e3bb0ec18248b3b088dfeecba5772a8e4f8c2b695137fc1b5	PE32	2022-02-16 19:40:02	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasModified_DOS_Message YRP/domain YRP/contentis_base64 YRP/win_files_operation
2bb3f80bdc9ed7ffa49d9b880957bb2462a037af56986924a586952d257c7d5b	PE32	2022-02-16 17:52:03	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/screenshot YRP/win_registry YRP/win_files_operation YRP/CRC32_poly_Constant YRP/Str_Win32_Winsock2_Library YRP/UPX YRP/suspicious_packer_section
01a4adc9271d75a9a25d83283ae37d2932305f96a2d89a73811702cb7f60851d	PE32	2022-02-16 13:05:50	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
6a0fe3af767f7f537e017e285c6ac9c782cbf447037772bf61b7afddb153d395	PE32	2022-02-16 12:55:06	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasModified_DOS_Message YRP/domain YRP/contentis_base64 YRP/win_files_operation FlorianRoth/DragonFly_APT_Sep17_3
a7981b705bb2ac1452a763c28861eda850d2ecd75a079133a8275b93c5103bb9	PE32	2022-02-16 12:43:13	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/System_Tools YRP/screenshot YRP/win_files_operation
f5d37c2f9df516f3b459d3b2ce9f803bd28b046fd6e33d5d60e0f73db63335d4	PE32	2022-02-16 11:11:21	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/maldoc_getEIP_method_1 YRP/domain YRP/contentis_base64 YRP/BASE64_table YRP/UPX YRP/suspicious_packer_section
46a6901036650904fba6512221fe9d44b218adf6e6b5e1b085ac0a74a608015e	PE32	2022-02-16 08:55:22	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsDLL YRP/IsWindowsGUI YRP/HasRichSignature YRP/maldoc_getEIP_method_1 YRP/domain YRP/contentis_base64 YRP/DebuggerException__SetConsoleCtrl YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook
fe435a179c8a05d1f606ab0ca8d005c6a02a6ce3e38e62c3a0ee5ff1b2fb7270	PE32	2022-02-16 05:51:25	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsDLL YRP/IsWindowsGUI YRP/HasRichSignature YRP/maldoc_getEIP_method_1 YRP/domain YRP/contentis_base64 YRP/anti_dbg YRP/win_registry YRP/win_files_operation
e1d180eb097c1be95de71b2902e98ca09f553e1dbd6096504d61acb7f49de276	PE32	2022-02-16 01:05:32	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/without_images YRP/without_urls YRP/domain YRP/contentis_base64 YRP/System_Tools YRP/Dropper_Strings YRP/WMI_strings YRP/network_dyndns YRP/network_smtp_raw YRP/network_irc YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
1a0e0215377d7173a479f3b54961687f71b1f1d8599f627c7d3a2b6b682187b7	PE32	2022-02-15 20:55:58	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Misc_Suspicious_Strings YRP/network_tcp_socket YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
b9d6bf45d5a7fefc79dd567d836474167d97988fc77179a2c7a57f29944550ba	PE32	2022-02-10 03:03:05	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/powershell YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/network_tcp_socket YRP/network_dns YRP/win_mutex YRP/win_token YRP/win_files_operation YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
876c2b332d0534704447ab5f04d0eb20ff1c150fd60993ec70812c2c2cad3e6a	PE32	2022-02-01 13:00:55	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/powershell YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/network_tcp_socket YRP/network_dns YRP/win_mutex YRP/win_token YRP/win_files_operation YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
6298c8c988c66a49060bf7d7a32fa0dc96ba8b5db679321994b0194f2f077fa8	PE32	2021-12-11 16:01:34	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/ImportTableIsBad YRP/HasModified_DOS_Message YRP/domain YRP/url YRP/Misc_Suspicious_Strings FlorianRoth/DragonFly_APT_Sep17_3
45b9e820b3ab997c498a28d59601b1b72fbbf3b9415f8c75843ff24c2b250193	PE32	2021-11-04 15:01:15	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/powershell YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/network_tcp_socket YRP/network_dns YRP/win_mutex YRP/win_token YRP/win_files_operation YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
cea699be9ae7dfa92d1725a9ece33071f1e707e9cde5ec5137d4a28f1f74a10d	PE32	2021-08-28 18:01:30	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/powershell YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/network_tcp_socket YRP/network_dns YRP/win_mutex YRP/win_token YRP/win_files_operation YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
1aef94e54c1af9a8d0c4fa4cbdc602c025a2b10a097e87184ceb89e124d26e6a	PE32	2021-07-13 19:02:46	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/powershell YRP/maldoc_find_kernel32_base_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/network_tcp_socket YRP/network_dns YRP/win_mutex YRP/win_token YRP/win_files_operation YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
6a3acf3c2a723f10426f63a2068a5f222f1385d15a55a1807f2e885586a960a3	PE32	2020-06-30 13:30:58	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/HasRichSignature YRP/domain YRP/contentis_base64 FlorianRoth/DragonFly_APT_Sep17_3
777ddb9774acf3cae295bbd36b35a7a507a17433147b1d72b73e8386d605ecd9	PE32	2020-06-30 12:17:02	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/win_registry FlorianRoth/DragonFly_APT_Sep17_3
11c0aa48a8932d9f10cc7d44b237500d4bee8cfd5bf3c1049e03f3f3aa23f047	PE32	2020-06-30 04:06:01	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64
118491b60878e4b43a740aa4373f4967196fb73d68c9a423bc356809c32e8366	PE32	2020-06-29 16:54:52	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/win_registry YRP/win_files_operation FlorianRoth/DragonFly_APT_Sep17_3
119827618fd4600d0a34fae9d8ede152727c7280bda5262527f3abe85df8737e	PE32	2020-06-29 16:48:46	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/ThreadControl__Context
ed1ed6979e2b38b77cc62730f7dc4cc0b96eca3558669a62a6e91cabef242aa9	PE32	2020-06-29 14:24:24	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/win_registry YRP/win_files_operation YRP/Str_Win32_Winsock2_Library YRP/UPX YRP/suspicious_packer_section FlorianRoth/DragonFly_APT_Sep17_3
fd2f6db337f63dc40967fd62c0245c91a145836aecb482770af50462d00d89c7	PE32	2020-06-29 03:27:31	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/FSG_v110_Eng_dulekxt_Microsoft_Visual_C_Basic_NET YRP/TASM_MASM_additional [+] YRP/PE_Diminisher_v01_additional YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Check_FindWindowA_iat YRP/anti_dbg YRP/anti_dbgtools YRP/screenshot YRP/keylogger YRP/Big_Numbers0
ec40329196e3494dc56d8b46a02d241355520ad64c86338ba2f177c26055eea1	PE32	2020-06-28 01:32:50	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/win_registry FlorianRoth/DragonFly_APT_Sep17_3
11b229ca2caf2a6d372ddddaaeff00259333a32c60ea91eb5a63fa4c781707a6	PE32	2020-06-27 13:46:34	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/maldoc_getEIP_method_1 YRP/domain YRP/contentis_base64 FlorianRoth/DragonFly_APT_Sep17_3
70feb2b554f823bffe61b87deface6b9bd5e4d4d30c3fa22f0a46e3b3e01d7e7	PE32	2020-06-27 11:15:02	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/dUP2xPatcherwwwdiablo2oo2cjbnet YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/HasRichSignature YRP/maldoc_getEIP_method_1 YRP/domain YRP/contentis_base64 YRP/System_Tools YRP/win_files_operation YRP/CRC32_poly_Constant FlorianRoth/DragonFly_APT_Sep17_3
11b2157fb813076079783972bf21337eaf864d08cc1f69736ba8bcc729e70fe3	PE32	2020-06-27 10:56:31	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/UPX YRP/suspicious_packer_section
22f180db8a4fbe4870d169949901896f80415f8f67b1556bd5e75f2fb1cd42f5	PE32	2020-06-27 07:50:16	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/screenshot YRP/win_files_operation YRP/Big_Numbers5 YRP/RIPEMD160_Constants YRP/SHA1_Constants YRP/BASE64_table
8d44a0f347e87588ba68c74c66d3b074aeae3a209708ef5a11eb80ef8b34db65	PE32	2020-06-27 05:47:37	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/win_files_operation YRP/CRC32_poly_Constant FlorianRoth/DragonFly_APT_Sep17_3
11342a9735c6ba28ee3673f0d3fbaccdef38f2144ffd346702c5b8b41ee41cb4	PE32	2020-06-27 05:44:55	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/ThreadControl__Context
112fc887c10ff91d1e370c7208b41c393fa2c7ef332fcdd7ef5128ef4bb8c31d	PE32	2020-06-27 03:52:54	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsDLL YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/DebuggerException__SetConsoleCtrl YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation
2231eb02d205c1243eea52a1f834cb5186567fea78578dbb6812eb9885f1bc31	PE32	2020-06-27 02:41:10	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/win_registry FlorianRoth/DragonFly_APT_Sep17_3
7fd7386a0fd13fc081f9b26e4911c294f397a184dec5a639a3aaa0e3eb4425a5	PE32	2020-06-26 22:45:19	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/win_registry FlorianRoth/DragonFly_APT_Sep17_3
11111c84d6703e9996feb6a346176ec3b62185f8162d2f1aec03afed229f9efe	PE32	2020-06-26 19:36:27	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/win_registry FlorianRoth/DragonFly_APT_Sep17_3
111d08367233379a21fea15759ffda577f556f3019c8e0114c8c17a5ad31809a	PE32	2020-06-26 18:37:01	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/win_registry YRP/win_files_operation YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/UPX YRP/suspicious_packer_section
125499362a40028ea42c10666189f262d5d2d21756242bd9f6021a5969563385	PE32	2020-06-26 18:22:39	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/win_registry FlorianRoth/DragonFly_APT_Sep17_3
111fd4c847f0b733620d5ae85194dda945fd3719b408bdf2e78c065913b8c8b7	PE32	2020-06-26 18:22:32	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/dUP2xPatcherwwwdiablo2oo2cjbnet YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature YRP/maldoc_getEIP_method_1 YRP/domain YRP/url YRP/contentis_base64 YRP/System_Tools YRP/win_files_operation YRP/CRC32_poly_Constant
596110c32767001526818ebecb23c93d69099b61b6d99de422842ecec9f82a5c	PE32	2020-02-19 18:31:39	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature YRP/domain YRP/contentis_base64
23d636f8929017900900fab72654ad446bf0200c51a9676af066001c2fec3141	PE32	2020-01-15 15:43:06	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/HasRichSignature YRP/domain YRP/contentis_base64 FlorianRoth/DragonFly_APT_Sep17_3
78d3b4cc95e380b6eecf0c4084cd511138c22c3e8b54014ee4636c4c2010ffae	PE32	2020-01-15 14:50:10	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/win_registry FlorianRoth/DragonFly_APT_Sep17_3
1608b92d2def5bdab318e3b4b9d916845dc394998c2b0a98c2ed86d4eb62785b	PE32	2020-01-15 13:01:53	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/win_files_operation YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
07ec16104f3c6f07d38305269fb2e7f97d134a0ae3e8b407e54e99813a210927	PE32	2020-01-15 12:12:55	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/maldoc_getEIP_method_1 YRP/domain YRP/contentis_base64 YRP/Browsers YRP/Antivirus YRP/ThreadControl__Context YRP/inject_thread YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/win_registry YRP/win_token YRP/win_files_operation YRP/CRC32_poly_Constant YRP/Str_Win32_Winsock2_Library
989ce53abfb1ed18a03487f6321d8bc31498246574a8125a194640b5931d5fbd	PE32	2020-01-15 09:57:53	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/ImportTableIsBad YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Dropper_Strings YRP/win_registry YRP/Str_Win32_Winsock2_Library YRP/suspicious_packer_section FlorianRoth/DragonFly_APT_Sep17_3
d927efbfdd069ec94dc4e848acd0dce9a4348753b481babe9746fc23819a0ad4	PE32	2020-01-13 18:13:00	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/win_registry FlorianRoth/DragonFly_APT_Sep17_3
47d2843d0980756444b8924ceb31aa4f917350873d4dc5425d28dbb9dee5ac6a	PE32	2020-01-13 18:12:42	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/Dropper_Strings YRP/win_registry YRP/win_files_operation YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
17e6071f9aa9e2301fedd1bd4dec6c6b7d41742a7cf1369faa52fead426322fc	PE32	2020-01-13 18:12:40	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/win_registry YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
55439d11a44ac87ed2ad889e3c93bd52b5185fb240c9d9e78aa7ad46771483e1	PE32	2020-01-13 17:24:54	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/win_files_operation YRP/Str_Win32_Wininet_Library FlorianRoth/DragonFly_APT_Sep17_3
d216cdd532fa08a509ffb36151fb636113a6388d5565a482689ab1969f8234c0	PE32	2020-01-13 17:21:09	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/without_images YRP/without_attachments YRP/without_urls YRP/domain YRP/contentis_base64 YRP/Dropper_Strings YRP/network_smtp_raw YRP/network_tcp_socket YRP/network_dns YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/BASE64_table YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
ca247012905ecfb1003dca2cb82c252513e9c3f8d85cc3a8740865946529c757	PE32	2020-01-13 16:50:34	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/domain YRP/url YRP/contentis_base64 YRP/network_dropper YRP/win_registry YRP/win_files_operation YRP/UPX YRP/suspicious_packer_section FlorianRoth/DragonFly_APT_Sep17_3
d45f355e6b1b5196765c34a28be49cdb71c9a82ee330be6223af83d3c2c74bf1	PE32	2020-01-13 15:27:14	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/Borland YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/Delphi_CompareCall YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API FlorianRoth/DragonFly_APT_Sep17_3
0592fd2feafa434f6985d34f0313fd996fdfe9125278fb0796314d3d62e00085	PE32	2020-01-13 14:45:12	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Dropper_Strings YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API FlorianRoth/DragonFly_APT_Sep17_3
4d1ee3330b88a8a9d92187a0aeb1283925d46fc0910f558d87b809c70333d8e2	PE32	2020-01-13 13:35:52	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/VM_Generic_Detection YRP/win_registry YRP/Big_Numbers0 YRP/Big_Numbers1 FlorianRoth/DragonFly_APT_Sep17_3
e3ea3ac9b27f046701eb318dff69a8f0f2d9b1f7b390cced8f871c0820c9dd1c	PE32	2019-12-02 19:29:51	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/win_registry FlorianRoth/DragonFly_APT_Sep17_3
4435772dbfa0fcb95bc4f830e146452507994c16e35f5279ef939cd7a070b15c	PE32	2019-12-02 19:29:37	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasDigitalSignature YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/Browsers YRP/win_registry FlorianRoth/DragonFly_APT_Sep17_3
404178baf41be5d53f580b610b92c7202fc986c2a493a4c67b4ad5741baf59cb	PE32	2019-12-02 18:39:52	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/HasRichSignature YRP/domain YRP/Misc_Suspicious_Strings FlorianRoth/DragonFly_APT_Sep17_3
d21a2758ded26b82e46b51790b483601116bf1b4762ee53a83e45f86c12d2c7d	PE32	2019-12-02 18:37:37	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsBeyondImageSize YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/win_files_operation YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
f0adca374f0d841a6740779e796a06c89cd73931ff0d6e9fc0c5b91072328729	PE32	2019-11-24 12:37:04	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/domain YRP/IP YRP/contentis_base64 YRP/win_files_operation
233476219fdd5574fee09e82e76cd744eb5206ec94b0da21d6a9c96712dca2d9	PE32	2019-11-24 12:13:25	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/url YRP/contentis_base64 YRP/System_Tools YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/win_registry YRP/win_files_operation YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API FlorianRoth/DragonFly_APT_Sep17_3
fe0cb8d54d265cc9ea92e0b23128635d996833b59418bc835a232082cf00ddda	PE32	2019-11-24 11:56:44	User Submission	YRP/MASMTASM YRP/MASMTASM_Lenguaje_Compilador YRP/TASM_MASM YRP/TASM_MASM_additional [+] YRP/PE_Diminisher_v01_additional YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/win_files_operation YRP/suspicious_packer_section FlorianRoth/DragonFly_APT_Sep17_3
1e76c56624567139f12e32991809bfccffa7719aecab9bedf478cf6f962d6728	PE32	2019-11-24 11:56:23	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/win_files_operation FlorianRoth/DragonFly_APT_Sep17_3
f8fc95c942d48b97f39be054ae1ade2e8bf60dd4d80e0b7a2521a08134150e01	PE32	2019-11-24 11:42:48	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/win_files_operation YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API FlorianRoth/DragonFly_APT_Sep17_3
95840a31c5264231ad38ced531546c4839f099dd33d374dc9319e9131b17f68f	PE32	2019-11-24 10:39:06	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/network_tcp_socket YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
2c8c158337b2b58819a114cb1d04dae1cf641b90eb69a370b84593e926baacf4	PE32	2019-11-24 10:38:58	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/network_tcp_socket YRP/win_files_operation YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
f4a600e12b612ddee1cfaab5c7257fe75eab88c430be8b40b4e5a0d7ed212fe1	PE32	2019-11-24 10:34:00	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/domain YRP/url YRP/contentis_base64 YRP/win_registry FlorianRoth/DragonFly_APT_Sep17_3
20bef404a79aa323a9b71079bd4ca6081f312761bd4e6622be5ff952fc582a5c	PE32	2019-11-24 10:22:52	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/Armadillo_v4x YRP/TASM_MASM_additional [+] YRP/PE_Diminisher_v01_additional YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/domain YRP/IP YRP/contentis_base64 YRP/network_tcp_listen YRP/network_tcp_socket YRP/win_files_operation YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
82159ad0036f6d9b13129d6e372e4729d3132ae0d81d890a46f5efe064ebc963	PE32	2019-11-24 10:19:53	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Misc_Suspicious_Strings YRP/network_tcp_listen YRP/network_tcp_socket YRP/win_files_operation YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3
3803b8626b74f44bfdb3271a221adaa041c7a9cbe9b56380dfc6d688e569eb03	PE32	2019-11-24 10:15:48	User Submission	YRP/MASMTASM YRP/TASM_MASM YRP/TASM_MASM_additional YRP/PE_Diminisher_v01_additional [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature YRP/domain YRP/contentis_base64 YRP/Str_Win32_Winsock2_Library FlorianRoth/DragonFly_APT_Sep17_3

Recent Searches
yrp/tasm_masm_additional
yrp/bin_client
yrp/dbgntboot
yrp/expressorprotection_v150x_cgsoftlabs_sign_by_fly_additional
yrp/ikat_command_lines_agent
yrp/js_wrong_version
yrp/multiple_webshells_0028
yrp/onimiki
yrp/php_obf_malfunctions
yrp/telock_v099_te_tmd

Search

Recent Searches