Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	3109b16046109e1e_sys4h57g.txt Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\sys4h57g.txt
Size	62.0B
Processes	2200 (sys4h57g.exe) 328 (sys4h57g.exe) 1188 (sys4h57g.exe)
Type	ASCII text, with CRLF line terminators
MD5	`d822f7d2c3d6b8c710dcba160914f8ea`
SHA1	`73f44bae61a09782e6e0b10c504265da07fc0eee`
SHA256	`3109b16046109e1e78998d5eb6a1c3b24f2f002cb105be638cd5f2d49f4d796d`
CRC32	`85FD31D8`
ssdeep	`3:1sImWxpcL4E2J5Wc8cKH/NVddy:KImQpcLJ23Wc8cKH/zK`
Yara	None matched
VirusTotal	Search for analysis

Name	2d0dc6216f613ac7_sys4h57g.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\sys4h57g.exe
Size	76.5KB
Processes	2200 (sys4h57g.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`0e362e7005823d0bec3719b902ed6d62`
SHA1	`590d860b909804349e0cdc2f1662b37bd62f7463`
SHA256	`2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad`
CRC32	`F321DAF6`
ssdeep	`768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv`
Yara	PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
VirusTotal	Search for analysis

Name	dc3ae604991c9bb8_settings.bak Submit file
Filepath	C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\settings.bak
Size	24.0B
Type	data
MD5	`acd3fb4310417dc77fe06f15b0e353e6`
SHA1	`80e7002e655eb5765fdeb21114295cb96ad9d5eb`
SHA256	`dc3ae604991c9bb8ff8bc4502ae3d0db8a3317512c0f432490b103b89c1a4368`
CRC32	`0E770DA4`
ssdeep	`3:9bzY6oRDIvYk:RzWDI3`
Yara	None matched
VirusTotal	Search for analysis

Name	f8098a6290118f29_settings.bin Submit file
Filepath	C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\settings.bin
Size	40.0B
Processes	2840 (sys4h57g.exe)
Type	data
MD5	`4e5e92e2369688041cc82ef9650eded2`
SHA1	`15e44f2f3194ee232b44e9684163b6f66472c862`
SHA256	`f8098a6290118f2944b9e7c842bd014377d45844379f863b00d54515a8a64b48`
CRC32	`C6B6460B`
ssdeep	`3:9bzY6oRDT6P2bfVn1:RzWDT621`
Yara	None matched
VirusTotal	Search for analysis

Name	0bd3aac12623520c_storage.dat Submit file
Filepath	C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\storage.dat
Size	319.8KB
Processes	2840 (sys4h57g.exe)
Type	data
MD5	`7e8f4a764b981d5b82d1cc49d341e9c6`
SHA1	`d9f0685a028fb219e1a6286aefb7d6fcfc778b85`
SHA256	`0bd3aac12623520c4e2031c8b96b4a154702f36f97f643158e91e987d317b480`
CRC32	`F31C2239`
ssdeep	`6144:oX44S90aTiB66x3Pl6nGV4bfD6wXPIZ9iBj0UeprGm2d7Tm:LkjYGsfGUc9iB4UeprKdnm`
Yara	None matched
VirusTotal	Search for analysis

Name	799ae8b4c28300dd_run.dat Submit file
Filepath	C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\run.dat
Size	8.0B
Processes	2840 (sys4h57g.exe)
Type	Non-ISO extended-ASCII text, with no line terminators
MD5	`fcfcff8dae83eb98766062578ba11d24`
SHA1	`520000fb779d906189fd716e2a12fb1f6b458b91`
SHA256	`799ae8b4c28300ddd73cc45fe7d83aba932f9ceb938a9aa283f223abcc55373d`
CRC32	`B3CAF7A4`
ssdeep	`3:lsn:an`
Yara	None matched
VirusTotal	Search for analysis

Name	5347661365e7ad2c_catalog.dat Submit file
Filepath	C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\catalog.dat
Size	232.0B
Processes	2840 (sys4h57g.exe)
Type	data
MD5	`32d0aae13696ff7f8af33b2d22451028`
SHA1	`ef80c4e0db2ae8ef288027c9d3518e6950b583a4`
SHA256	`5347661365e7ad2c1acc27ab0d150ffa097d9246bb3626fca06989e976e8dd29`
CRC32	`36FCB1A3`
ssdeep	`6:X4LDAnybgCFcpJSQwP4d7ZrqJgTFwoaw+9XU4:X4LEnybgCFCtvd7ZrCgpwoaw+Z9`
Yara	None matched
VirusTotal	Search for analysis

Name	10970e2ab0fcbbe3_sys4h57g.lnk Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys4h57g.lnk
Size	998.0B
Processes	1052 (vbc.exe)
Type	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 15:32:08 1600, mtime=Sun Dec 31 15:32:08 1600, atime=Sun Dec 31 15:32:08 1600, length=0, window=hide
MD5	`64be2a73d03b9826f0014e8c12895287`
SHA1	`edb2dd784bf1d76ed94f8064ee93fbf5d832f6f6`
SHA256	`10970e2ab0fcbbe35afa9fa8cdae7f5942ccf01faef0a232525377f15b3af877`
CRC32	`87D5C187`
ssdeep	`12:8wl0EY3HV7GyuREXusYpEml1/f5XmY/Q1/f5Xmeg/omNJkKA54t2YLEPKzlX8:8XZqRE+nzdIdP4oCHADPy`
Yara	Lnk_Format_Zero - LNK Format
VirusTotal	Search for analysis