Reverser Reports
Sandbox Reports
Cloud 42.3.0
Rhadamanthys delivered by an in-browser fake Windows Update, abusing the Fullscreen API (on-click), and using ClickFix-style
hxxps://thefatshallot[.]com/
Open ReportCloud 42.0.0
CloudFlare Theme ClickFix/CAPTCHAScam dropping Redline
hxxp://gogocharters[.]com/lexington-charter-bus
Open ReportCloud 42.0.0
Phishing Chain from e-Mail to Catpcha to Tycoon2FA
SHA256: c99ce182e582b618ae2fe4c7258fc113625730739086e73029f022fb689588b4
Open ReportCloud 41.0.0
CloudFlare Theme ClickFix/CAPTCHAScam dropping NetSupport RAT
hxxps://webdemo[.]biz
Open ReportCloud 40.0.0
EvilProxy using open redirect vulnerability
https://m.exactag.com/ai.aspx?tc=d9282403bc40b07205bbd26a23a8d2e6b6b4f9&url=http%3Asellartatauction.com/oplo/osiwuhjfmniek/bobibobi@outlook.com
Open ReportCloud 40.0.0
HTML payload leading to download and installation of WSHRAT
SHA256: 427fb9938ca75db1a362fe51356a1dc06350daa5f9db788a4ca2f7e2cb21fd34
Open ReportCloud 40.0.0
HTML based phisher exhibiting a large spectrum of malicious behaviors
SHA256: 360a04ca0c6ef3401d14f04089d6e7e08869ab298dbf842d8f063bfaca618891
Open ReportCloud 38.0.0
CVE-2023-36884 using RTF to load Word DOC via MSHTML iframe injection
SHA256: a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f
Open ReportCloud 38.0.0
SolarMarker with file pumping, valid PE signature, Powershell dropper and .Net backdoor
SHA256: 6f7332625d573ccc7b14264ee0db7e671305e1206c7eaf920e17c26f7b5b64a7
Open ReportCloud 37.0.0
STOP Djvu Ransomware via SmokeLoader with full config extracted
SHA256: 5ea4451ca1ce36db2dc6e7a85f07c748ddbb758b65f2194d734afd08bd141126
Open ReportCloud 36.0.0
AgentTesla v3 with full malware configuration
SHA256: c6dae959f8e5373c6ac8746cfd8227b8d8099b692ee726aacbe18ecf1479282e
Open ReportCloud 35.0.0
Stealthy new payload delivery method: HTML (showing a PW) -> ZIP encrypted -> ISO -> LNK -> Calc.exe -> DLL -> DLL -> QBOT
SHA256: f5c16248418a4f1fd8dff438b26b8da7f587b77db9e180a82493bae140893687
Open ReportCloud 33.0.0
noPac using CVE-2021-42287 - CVE-2021-42278 Exploit to gain DC Admin
SHA256: 4e37819484e865f8e20c2aaa94ec05f3bfe3bb6f36ea4bb6df376c8d4f1ffcca
Open ReportCloud 33.0.0
SysJoker Multi-Platform Backdoor
SHA256: 1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c
Open ReportCloud 33.0.0
Emotet dropped by Hidden Macro
SHA256: bb1f500a59544aa8e44a0377cc506dfbebca1ecb7a8c73dc72d3268803976ff5
Open ReportCloud 33.0.0
Kimsuky Espionage Campaign, JS instrumentation
SHA256: 20eff877aeff0afaa8a5d29fe272bdd61e49779b9e308c4a202ad868a901a5cd
Open ReportCloud 33.0.0
Hanictor analysis with VBA and shellcode execution graph, dropping FickerStealer
SHA256: 83c9c9beaca0a147e23995b84792f56cd130ccf262147374bd1114c2ac698fee
Open ReportCloud 33.0.0
Kaseya attack dropping Sodinokibi
SHA256: 939aae3cc456de8964cb182c75a5f8cc
Open Report