Dropped Files | ZeroBOX

Name	e63d49936b7303eb_user.config Submit file
Filepath	c:\users\test22\appdata\local\։֊շեֆֆօք՗՛պձ֛֋֊՚օ՗։֊ֈֆ՛՜\oki.exe_url_vg2von44gk01w4t3vrg25kvm1nrsfebz\1.845.828.489\user.config
Size	1.6MB
Processes	656 (oki.exe)
Type	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5	`ff29ba5a30771875141a8900db3bb0c3`
SHA1	`d3619669a0b83668716d5d33dd0c61168a6e5882`
SHA256	`e63d49936b7303eb21b3eb683b5ef9ee0f349cc96af3c685d09c7e1ccf775b41`
CRC32	`68885B32`
ssdeep	`12288:dnBzEhW737oEmzaaGSgzwYLUuItLz9fg3CtjKk5iQkZtgBFeRzSxR/miKRnwQ3oe:Ngt30DD`
Yara	None matched
VirusTotal	Search for analysis

Name	7b0f584412669718_qweruiuyt.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\qweruiuyt\qweruiuyt.exe
Size	19.6KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`fb2d85e3503b99fffcb9d2892a5af896`
SHA1	`d0be8421547b36b2f5a09f0861571c80875c225b`
SHA256	`7b0f5844126697187ba59c3aeb4efad204019519366d60eec8ab3c7ab64147ce`
CRC32	`7315F74B`
ssdeep	`384:LZH8Idf3Zoza8ilJLcJvaMFRA8RK5RbB8+yZbwnic9ojYEXbXaC9hoKwqhq0WAV:LZHPPlzmacR0BfTErVQQhqM`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)
VirusTotal	Search for analysis

Name	f825dd89181e7435_d93f411851d7c929.customDestinations-ms~RF2b5d46c.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2b5d46c.TMP
Size	7.8KB
Processes	6928 (powershell.exe) 8992 (powershell.exe)
Type	data
MD5	`61d3b003e73f968491bb9de05318fcbd`
SHA1	`abb40732bf72a072c5b176449fdb8f1c56383e03`
SHA256	`f825dd89181e743525684aff8d99cc6d78046e461147c33b6f7a182b98c58ea9`
CRC32	`76116DE9`
ssdeep	`96:wtuCiGCPDXBqvsqvJCwoNtuCiGCPDXBqvsEHyqvJCworc7HwxGlUVul:wt7XoNt7bHnorXxY`
Yara	Antivirus - Contains references to security software
VirusTotal	Search for analysis

Name	e3b0c44298fc1c14_drqgnjyp.tmp Empty file or file not found
Filepath	C:\Users\test22\AppData\Local\։֊շեֆՖՕՔ՗՛պձ֛֋֊՚Օ՗։֊ֈֆ՛՜\oki.exe_Url_vg2von44gk01w4t3vrg25kvm1nrsfebz\1.845.828.489\drqgnjyp.tmp
Size	0.0B
Type	empty
MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
CRC32	`00000000`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis