Dropped Files | ZeroBOX

Name	b4d19e9f0b618ff3_bqxhki.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\BqxhKI.exe
Size	1.2MB
Processes	900 (eSZhus81sRHwOek.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`383470069d167d1fc6d1aec6251a0c1f`
SHA1	`6e9e9aad90ad043af6223d4c91c57c78573250c3`
SHA256	`b4d19e9f0b618ff3ef5e3b7887d182a115b3ba8f541e6008791992ab410e1092`
CRC32	`10625898`
ssdeep	`24576:+JM6yjp90S9rR2i6r7jGdCjJxKZxs3hgh90ycWpfcm9ka1EkpjOiu+:+JMLp90S9YKZKRgLwy0y71Ex`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature Antivirus - Contains references to security software anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description) Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description)
VirusTotal	Search for analysis

Name	43e7b553fd3b0fbb_tmp83AB.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp83AB.tmp
Size	1.6KB
Processes	900 (eSZhus81sRHwOek.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`1ebb1158c30e60c00ad842bd67d4fe1e`
SHA1	`466ad2911fed120b09b323052a92d0c3d785b7e0`
SHA256	`43e7b553fd3b0fbba85e8525fede7275fbafa3c1c315679bc83d36d7c5727e91`
CRC32	`05D7D68B`
ssdeep	`24:2dH4+SEqCH/7IlNMFQ/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBgdytn:cbhf7IlNQQ/rydbz9I3YODOLNdq3Gd0`
Yara	None matched
VirusTotal	Search for analysis