Dropped Files | ZeroBOX

Name	edf26cfa150e01f1__lildvctuovula.vbs Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_Lildvctuovula.vbs
Size	188.0B
Processes	7948 (vg23ty.exe)
Type	ASCII text, with no line terminators
MD5	`50371b1ecc1d8cf1c90d52c1821cb9e0`
SHA1	`f8abcabe160d6f35f82832cff5ac2ec4b9ed93c3`
SHA256	`edf26cfa150e01f14990dad83c785768f99dedf479a8c345b713305c7d25f559`
CRC32	`468225B0`
ssdeep	`3:FER/n0eFHgSSJJFkBBVIceGAFddGeWLCXknRAumWxpcL4EaKC5SufyM1K/RFofDC:FER/lFHsQdeGgdEYmRAumQpcLJaZ5Suq`
Yara	Ave_Maria_Zero - Remote Access Trojan that is also called WARZONE RAT
VirusTotal	Search for analysis

Name	f825dd89181e7435_d93f411851d7c929.customdestinations-ms Submit file
Filepath	c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size	7.8KB
Processes	7532 (powershell.exe)
Type	data
MD5	`61d3b003e73f968491bb9de05318fcbd`
SHA1	`abb40732bf72a072c5b176449fdb8f1c56383e03`
SHA256	`f825dd89181e743525684aff8d99cc6d78046e461147c33b6f7a182b98c58ea9`
CRC32	`76116DE9`
ssdeep	`96:wtuCiGCPDXBqvsqvJCwoNtuCiGCPDXBqvsEHyqvJCworc7HwxGlUVul:wt7XoNt7bHnorXxY`
Yara	Antivirus - Contains references to security software
VirusTotal	Search for analysis