Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	ff006c86b5ec033f_TEST22-PC_test22.zip Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC_test22.zip
Size	24.0B
Processes	1756 (BTC PAYMENTSCOPY_____________________________.jpg.exe)
Type	Zip archive data (empty)
MD5	`98a833e15d18697e8e56cdafb0642647`
SHA1	`e5f94d969899646a3d4635f28a7cd9dd69705887`
SHA256	`ff006c86b5ec033fe3cafd759bf75be00e50c375c75157e99c0c5d39c96a2a6c`
CRC32	`612F49D6`
ssdeep	`3:pjt/lC:NtU`
Yara	None matched
VirusTotal	Search for analysis

Name	e654a9462d181c04_CREDITCARDNET4.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\NET4\CREDITCARDNET4.exe
Size	34.5KB
Processes	1756 (BTC PAYMENTSCOPY_____________________________.jpg.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`a451ff83e1e0b66af6a3f26ee38bf4ff`
SHA1	`5dc4535a7a059c3aaedf925093e9fbe5f27aae80`
SHA256	`e654a9462d181c047534462ca3f13c1117886dbeded26cc1c0255328fd1046da`
CRC32	`9B0C4146`
ssdeep	`768:iPQFfiGqG8+aXWWZJb8+LBW85/BmoEAm4x17jM6PQ8eQu:ihGqG8+cTB0oEAm4x17jM6Preh`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
VirusTotal	Search for analysis

Name	05f0ac30ce02bc36_PASSWORDSNET4.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
Size	156.0KB
Processes	1756 (BTC PAYMENTSCOPY_____________________________.jpg.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`0c3c728a9b4376e014bc97f7b1da74f0`
SHA1	`de2253d0c3e02ea9d27ae6f46082cec9d0164a02`
SHA256	`05f0ac30ce02bc3608d957b40896240ae750da01393f4e26a8951fc7987959ca`
CRC32	`AC76F87D`
ssdeep	`3072:1BAM/Fi+CZNxEv18lAoKjVpjtCtNSGtUCUDcwQQ57KP:H/FibNxE6+tVpjw9UFQXQ57K`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
VirusTotal	Search for analysis

Name	5763cb06f4abd914_CONTACTSNET4.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\NET4\CONTACTSNET4.exe
Size	15.0KB
Processes	1756 (BTC PAYMENTSCOPY_____________________________.jpg.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`74693b2db7ada9a1db3501e72997f0f3`
SHA1	`33dd21d43620105dcf80092a4252d651756bd734`
SHA256	`5763cb06f4abd9141a8c9a738e0af3ebd4ca5c9113ba5be106715f7f7ef1bdf0`
CRC32	`6049D7A1`
ssdeep	`384:tqOeXQXIDAYB/BIBXJSsn99L6TsEWf1QpSPNK96FA9EetC:tqOeXQXIDAYB/BIB8s99L6Ts5NK9QARI`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
VirusTotal	Search for analysis

Name	c58288019ac83b99_COOKIESNET4.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\NET4\COOKIESNET4.exe
Size	31.5KB
Processes	1756 (BTC PAYMENTSCOPY_____________________________.jpg.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`d3316300349976caf8f66f3be2f97c48`
SHA1	`73f4bd0f87f650be474f8d96b6832ae0cb9f3406`
SHA256	`c58288019ac83b991c8d9f306f0e90d043bfc9a96b8b9ebbc9fe8de082a79058`
CRC32	`115D838E`
ssdeep	`768:qRETnVWG/JVr/CRTpJvE/+o17jMy9/Qb:eEbVWWvr2q17jMO8`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
VirusTotal	Search for analysis

Name	7bc03158a3c0bcb0_PJT2QJ0B04.zip Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\PJT2QJ0B04.zip
Size	122.9KB
Processes	1756 (BTC PAYMENTSCOPY_____________________________.jpg.exe)
Type	Zip archive data, at least v1.0 to extract
MD5	`37ac88bc53abcc353b3a93f68fb30871`
SHA1	`f5165c03b5de33db3704d502227bac35eae1c6c5`
SHA256	`7bc03158a3c0bcb001093d9d40eaf6b9a7adf14e685db68fbd9d0f135d447ebe`
CRC32	`5AAA0D9F`
ssdeep	`3072:V7vp9Y538FxzVSemfu6yVzD2lGRqtc4w2n/GTK:/9Y538LEemG6yJD2wADn/GTK`
Yara	None matched
VirusTotal	Search for analysis