dllcodacker.ir · TheFatRat.zip

//tools/

Iran · NOAVARAN SHABAKEH SABZ MEHREGAN (Ltd.)

Yara Suspicious_PowerShell_WebDownload_1 From Florian Roth by Florian Roth (Nextron Systems)

Yara SUSP_PowerShell_IEX_Download_Combo From Florian Roth by Florian Roth (Nextron Systems)

Yara Cobaltbaltstrike_Payload_Encoded From Florian Roth by Avast Threat Intel Team

Yara Empire_PowerShell_Framework_Gen4 From Florian Roth by Florian Roth (Nextron Systems)

Yara SUSP_shellpop_Bash From Florian Roth by Tobias Michalski

Yara Empire_PowerShell_Framework_Gen1 From Florian Roth by Florian Roth (Nextron Systems)

Yara APT_APT29_Win_FlipFlop_LDR From Florian Roth by threatintel@volexity.com

Yara CobaltStrike_Unmodifed_Beacon From Florian Roth by yara@s3c.za.net

Yara Empire_Invoke_MetasploitPayload From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_Invoke_ShellcodeMSIL From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_Invoke_DllInjection From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_Install_SSP From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_Get_SecurityPackages From Florian Roth by Florian Roth (Nextron Systems)

Yara Mimikatz_Memory_Rule_1 From Florian Roth by Florian Roth

Yara Empire_Invoke_Portscan_Gen From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_Invoke_SMBAutoBrute From Florian Roth by Florian Roth (Nextron Systems)

Yara Invoke_SMBExec_Invoke_WMIExec_1 From Florian Roth by Florian Roth (Nextron Systems)

Yara TA17_293A_malware_1 From Florian Roth by US-CERT Code Analysis Team (modified by Florian Roth)

Yara Empire_Invoke_SSHCommand From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_Invoke_PsExec From Florian Roth by Florian Roth (Nextron Systems)

Yara Base64_encoded_Executable From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_Get_GPPPassword From Florian Roth by Florian Roth (Nextron Systems)

Yara p0wnedPotato From Florian Roth by Florian Roth (Nextron Systems)

Yara NTLM_Dump_Output From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_dumpCredStore From Florian Roth by Florian Roth (Nextron Systems)

Yara HKTL_PS1_PowerCat_Mar21 From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_KeePassConfig From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_Get_Keystrokes From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_Out_Minidump From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_Exploit_JBoss From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_Exploit_Jenkins From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_Invoke_PostExfil From Florian Roth by Florian Roth (Nextron Systems)

Yara Empire_Invoke_EgressCheck From Florian Roth by Florian Roth (Nextron Systems)

Yara HKTL_NET_GUID_UnmanagedPowerShell From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara SUSP_NET_NAME_ConfuserEx From Florian Roth by Arnim Rupp

Yara Disable_Defender From AbuseCH by iam-py-test

Yara mimikatz From Florian Roth by Benjamin DELPY (gentilkiwi)

mail.reveantivirus.com · Malware Samples.zip

/reveantivirus.com/linux/Builds/Abhishek_Samples/

United States · IO

Yara INDICATOR_EXE_Packed_Dotfuscator From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_UPolyX From AlienVault by ditekSHen

Yara SUSP_XORed_MSDOS_Stub_Message From Florian Roth by Florian Roth

Yara INDICATOR_EXE_Packed_ConfuserEx From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_Fody From AlienVault by ditekSHen

Yara Base64_encoded_Executable From Florian Roth by Florian Roth (Nextron Systems)

Yara detect_Redline_Stealer From AbuseCH by Varp0s

Yara Disable_Defender From AbuseCH by iam-py-test

Yara INDICATOR_EXE_Packed_RLPack From AlienVault by ditekSHen

Yara Win32_Ransomware_WannaCry From ReversingLabs by ReversingLabs

Yara INDICATOR_EXE_Packed_SmartAssembly From AlienVault by ditekSHen

Yara Nanocore_RAT_Gen_2 From Florian Roth by Florian Roth (Nextron Systems)

Yara IronTiger_Gh0stRAT_variant From Florian Roth by Cyber Safety Solutions, Trend Micro

Yara INDICATOR_EXE_DotNET_Encrypted From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_VMProtect From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_AgileDotNet From AlienVault by ditekSHen

Yara SUSP_NET_NAME_ConfuserEx From Florian Roth by Arnim Rupp

Yara IMPLANT_4_v7 From Florian Roth by US CERT

mail.reveantivirus.com · Malware Samples.zip

/reveantivirus.com/linux/Builds/Abhishek_Samples/

United States · IO

Yara INDICATOR_EXE_Packed_Dotfuscator From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_UPolyX From AlienVault by ditekSHen

Yara SUSP_XORed_MSDOS_Stub_Message From Florian Roth by Florian Roth

Yara INDICATOR_EXE_Packed_ConfuserEx From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_Fody From AlienVault by ditekSHen

Yara Base64_encoded_Executable From Florian Roth by Florian Roth (Nextron Systems)

Yara detect_Redline_Stealer From AbuseCH by Varp0s

Yara Disable_Defender From AbuseCH by iam-py-test

Yara INDICATOR_EXE_Packed_RLPack From AlienVault by ditekSHen

Yara Win32_Ransomware_WannaCry From ReversingLabs by ReversingLabs

Yara INDICATOR_EXE_Packed_SmartAssembly From AlienVault by ditekSHen

Yara Nanocore_RAT_Gen_2 From Florian Roth by Florian Roth (Nextron Systems)

Yara IronTiger_Gh0stRAT_variant From Florian Roth by Cyber Safety Solutions, Trend Micro

Yara INDICATOR_EXE_DotNET_Encrypted From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_VMProtect From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_AgileDotNet From AlienVault by ditekSHen

Yara SUSP_NET_NAME_ConfuserEx From Florian Roth by Arnim Rupp

ftp.04d.co · ExecTI.exe

/dl/software/exe/

Romania · Orange Romania S.A.

Yara SUSP_NET_NAME_ConfuserEx From Florian Roth by Arnim Rupp

Download archived sample

The password is "infected"

mail.reveantivirus.com · Malware Samples.zip

/reveantivirus.com/linux/Builds/Abhishek_Samples/

United States · IO

Yara INDICATOR_EXE_Packed_Dotfuscator From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_UPolyX From AlienVault by ditekSHen

Yara SUSP_XORed_MSDOS_Stub_Message From Florian Roth by Florian Roth

Yara INDICATOR_EXE_Packed_ConfuserEx From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_Fody From AlienVault by ditekSHen

Yara Base64_encoded_Executable From Florian Roth by Florian Roth (Nextron Systems)

Yara detect_Redline_Stealer From AbuseCH by Varp0s

Yara Disable_Defender From AbuseCH by iam-py-test

Yara INDICATOR_EXE_Packed_RLPack From AlienVault by ditekSHen

Yara Win32_Ransomware_WannaCry From ReversingLabs by ReversingLabs

Yara INDICATOR_EXE_Packed_SmartAssembly From AlienVault by ditekSHen

Yara Nanocore_RAT_Gen_2 From Florian Roth by Florian Roth (Nextron Systems)

Yara IronTiger_Gh0stRAT_variant From Florian Roth by Cyber Safety Solutions, Trend Micro

Yara INDICATOR_EXE_DotNET_Encrypted From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_VMProtect From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_AgileDotNet From AlienVault by ditekSHen

Yara SUSP_NET_NAME_ConfuserEx From Florian Roth by Arnim Rupp

Yara IMPLANT_4_v7 From Florian Roth by US CERT

Yara INDICATOR_EXE_Packed_MPress From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_Goliath From AlienVault by ditekSHen

Yara Typical_Malware_String_Transforms From Florian Roth by Florian Roth (Nextron Systems)

Yara INDICATOR_EXE_Packed_aPLib From AlienVault by ditekSHen

Yara Win32_Ransomware_CryptoJoker From ReversingLabs by ReversingLabs

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Yara Cloaked_RAR_File From Florian Roth by Florian Roth (Nextron Systems)

Yara Office_as_MHTML From Florian Roth by Florian Roth (Nextron Systems)

Yara EXE_extension_cloaking From Florian Roth by Florian Roth (Nextron Systems)

Yara SUSP_Base64_Encoded_Hex_Encoded_Code From Florian Roth by Florian Roth (Nextron Systems)

Yara FeliksPack3___PHP_Shells_ssh From Florian Roth by Florian Roth (Nextron Systems)

Yara connectback2_pl From Florian Roth by Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

dl.04d.co · ExecTI.exe

/software/exe/

Romania · Orange Romania S.A.

Yara SUSP_NET_NAME_ConfuserEx From Florian Roth by Arnim Rupp

Download archived sample

The password is "infected"

114.227.13.211 · ConfuserEx.zip

/软件/ConfuserEx/

China · Chinanet

Yara SUSP_NET_NAME_ConfuserEx From Florian Roth by Arnim Rupp

Download archived sample

The password is "infected"

114.227.13.211 · ConfuserEx-GUI.zip

/软件/ConfuserEx/

China · Chinanet

Yara SUSP_NET_NAME_ConfuserEx From Florian Roth by Arnim Rupp

Download archived sample

The password is "infected"

114.227.13.211 · ConfuserEx-CLI.zip

/软件/ConfuserEx/

China · Chinanet

Yara SUSP_NET_NAME_ConfuserEx From Florian Roth by Arnim Rupp

Download archived sample

The password is "infected"