Dropped Files | ZeroBOX

Name	f9349585a2393d43_i7lucnz5rlhcwjtou0nr5dlf.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\I7LuCNz5rLHcWJTOu0NR5dLf.exe
Size	494.0KB
Processes	6096 (eammf30lGlNkfSZ4t4chClgx.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`28345a7bb63babaf99e760965ce493b7`
SHA1	`7e752390f6ebca4e1e8889302549be4dd0845f62`
SHA256	`f9349585a2393d4378e283e73fc48d04941666ec0ccae4dd2fb68c2cad7ac9a1`
CRC32	`1DB82DEF`
ssdeep	`12288:qpHLo/ADRUoBhT3d7ybbicrZumiAgp+zjgm6sFuMLGx:SroGRU+Fu+clhl/JVuMSx`
Yara	win_registry - Affect system registries win_files_operation - Affect private profile PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero IsPE32 - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check
VirusTotal	Search for analysis

Name	86a6c1de969eefeb_kszrvcsp6usiqgbc7legiyka.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\kSzRVcsP6usiqGBc7LEgiyKA.exe
Size	4.3KB
Processes	6096 (eammf30lGlNkfSZ4t4chClgx.exe)
Type	HTML document, ASCII text
MD5	`5e2afd6b1e92d054d7f7c30a27e6aa92`
SHA1	`0f5b1c938f5e3ea1f1fbec5bbcaeeab745e01a74`
SHA256	`86a6c1de969eefeba4dd711c984fc404e675b890511963c16ea2e89eb8b56156`
CRC32	`EB1D8780`
ssdeep	`96:1j9jwIjYjyDK/DZD8jH+k1CZBvJADh/pRsWsgszbGD:1j9jhjYjWK/lyH+kMBRADh/pmWsgsfGD`
Yara	None matched
VirusTotal	Search for analysis

Name	0099e62ea3beb0f1_eammf30lglnkfsz4t4chclgx.exe Submit file
Filepath	C:\Users\test22\Documents\eammf30lGlNkfSZ4t4chClgx.exe
Size	7.5KB
Processes	8072 (updatechannel2.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`6be41709f8bfbf06307cc56d04249801`
SHA1	`911d8ade72bef752233237351fbdb7a9f96e2cf0`
SHA256	`0099e62ea3beb0f1631eb088bd697fd829963713ef4cb0e3a0a72b8c950c2383`
CRC32	`F4B3FBBE`
ssdeep	`192:3rFqRMky3fM9V7FKI47Wd+h4+0XoQ9DWhL3mj9:3rFqRMh3KlFP47Wd+hr059UL3m`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check
VirusTotal	Search for analysis

Name	bde8b16e5e32de86_pql96hcvhyxijamaiv7iqtwd.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\pql96hcvHyxiJAMAiV7iQtWD.exe
Size	4.3KB
Processes	6096 (eammf30lGlNkfSZ4t4chClgx.exe)
Type	HTML document, ASCII text
MD5	`015635f5dfcd4089a6c2b9ea510e6616`
SHA1	`03fe82e693ccdaadcc614208b921e5d2860c5167`
SHA256	`bde8b16e5e32de862d21885bf5a1b29dbaf8f9489f34492167f3256ef0e785b6`
CRC32	`0A3EFBC6`
ssdeep	`96:1j9jwIjYjyDK/DZD8jH+k1CZBvJADh/pRsCsgszbGD:1j9jhjYjWK/lyH+kMBRADh/pmCsgsfGD`
Yara	None matched
VirusTotal	Search for analysis