Dropped Files | ZeroBOX

Name	84671fc0c97b0c0b_wzyxotsj.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\wZYXOtsj.exe
Size	824.0KB
Processes	2952 (SECH.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`c272d7b6b2c0b86e6883edbaa57f61f4`
SHA1	`61d2977d3a1c8a29f3007f62bca4776c8d182d8c`
SHA256	`84671fc0c97b0c0b080a66b2c7a1627f4c304716edca95890d02d633e18e2ce0`
CRC32	`721FD327`
ssdeep	`12288:YSv1rbb+UWjd08M6UlfR+wREdgKnO7DZ1gIpt2ELA1HwTSs+YA+yBZPHz0+CM/DI:nvB+Uu0YUlfkwu7md1gIPP6KSs+Ybyl`
Yara	PE_Header_Zero - PE File Signature Zero Win32_Trojan_PWS_Azorult_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check
VirusTotal	Search for analysis

Name	e965210a96e992d4_tmp781.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp781.tmp
Size	1.6KB
Processes	2952 (SECH.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`a0b761d6bb770b72590c18870fff12c5`
SHA1	`57f05be1b5597f427460cac0ba756bcdd916cb9e`
SHA256	`e965210a96e992d4d0c10098ad99cdf8e15a6dc0586721740a55a7791e9e001a`
CRC32	`AD9DAAD9`
ssdeep	`24:2dH4+SEqCH/7IlNMFQ/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBDqndNtn:cbhf7IlNQQ/rydbz9I3YODOLNdq3kF`
Yara	None matched
VirusTotal	Search for analysis