popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 3d9f9e660fd7d59f_sys30.lnk
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys30.lnk
Size 984.0B
Processes 1116 (vbc.exe)
Type MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 15:32:08 1600, mtime=Sun Dec 31 15:32:08 1600, atime=Sun Dec 31 15:32:08 1600, length=0, window=hide
MD5 d6fb5dcf976119c7663ac9efd5939b95
SHA1 4a075d4af9c6c9b6913a916cbc2fb43450ff53e5
SHA256 3d9f9e660fd7d59f1778328b06577d03abe0a16171a46a28b396c8589b6f19d1
CRC32 AB16428E
ssdeep 12:8wl0eY3HV7GyuRA9m5Ew1/fCNmm/Q1/fCrg/omNJkKA54t2YLEPKzlX8:85ZqRYEEwdCadCr4oCHADPy
Yara
  • Lnk_Format_Zero - LNK Format
VirusTotal Search for analysis
Name b126aaa5532808b2_run.dat
Submit file
Filepath C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\run.dat
Size 8.0B
Processes 1032 (sys30.exe)
Type Non-ISO extended-ASCII text, with no line terminators
MD5 6e1fe56aaa266cc752c0330d81bbc564
SHA1 043aba38730d73dc9b6c631c5986c9196ddcbc7d
SHA256 b126aaa5532808b245b4f8cb9a65a775e25787898847d12afd5417c9c6440242
CRC32 47BAF9AC
ssdeep 3:652n:60n
Yara None matched
VirusTotal Search for analysis
Name f8098a6290118f29_settings.bin
Submit file
Filepath C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\settings.bin
Size 40.0B
Processes 1032 (sys30.exe)
Type data
MD5 4e5e92e2369688041cc82ef9650eded2
SHA1 15e44f2f3194ee232b44e9684163b6f66472c862
SHA256 f8098a6290118f2944b9e7c842bd014377d45844379f863b00d54515a8a64b48
CRC32 C6B6460B
ssdeep 3:9bzY6oRDT6P2bfVn1:RzWDT621
Yara None matched
VirusTotal Search for analysis
Name 0bd3aac12623520c_storage.dat
Submit file
Filepath C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\storage.dat
Size 319.8KB
Processes 1032 (sys30.exe)
Type data
MD5 7e8f4a764b981d5b82d1cc49d341e9c6
SHA1 d9f0685a028fb219e1a6286aefb7d6fcfc778b85
SHA256 0bd3aac12623520c4e2031c8b96b4a154702f36f97f643158e91e987d317b480
CRC32 F31C2239
ssdeep 6144:oX44S90aTiB66x3Pl6nGV4bfD6wXPIZ9iBj0UeprGm2d7Tm:LkjYGsfGUc9iB4UeprKdnm
Yara None matched
VirusTotal Search for analysis
Name f4c70796d2c3c07b_sys30.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\sys30.txt
Size 60.0B
Processes 2724 (sys30.exe) 1460 (sys30.exe) 2880 (sys30.exe)
Type ASCII text, with CRLF line terminators
MD5 6bd047fa5315c0a8e2ab80d6e1607d76
SHA1 20a7db9322cb45924595b5743d31e03ae662903a
SHA256 f4c70796d2c3c07b50a859af9a21726f0d26cbc5ad2309def1a9e0ca440dea25
CRC32 A6C8B95F
ssdeep 3:cWOmWxpcL4E2J5WcQkSn:XOmQpcLJ23WcIn
Yara None matched
VirusTotal Search for analysis
Name 5347661365e7ad2c_catalog.dat
Submit file
Filepath C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\catalog.dat
Size 232.0B
Processes 1032 (sys30.exe)
Type data
MD5 32d0aae13696ff7f8af33b2d22451028
SHA1 ef80c4e0db2ae8ef288027c9d3518e6950b583a4
SHA256 5347661365e7ad2c1acc27ab0d150ffa097d9246bb3626fca06989e976e8dd29
CRC32 36FCB1A3
ssdeep 6:X4LDAnybgCFcpJSQwP4d7ZrqJgTFwoaw+9XU4:X4LEnybgCFCtvd7ZrCgpwoaw+Z9
Yara None matched
VirusTotal Search for analysis
Name 2d0dc6216f613ac7_sys30.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\sys30.exe
Size 76.5KB
Processes 2724 (sys30.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 0e362e7005823d0bec3719b902ed6d62
SHA1 590d860b909804349e0cdc2f1662b37bd62f7463
SHA256 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
CRC32 F321DAF6
ssdeep 768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv
Yara
  • PE_Header_Zero - PE File Signature
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
VirusTotal Search for analysis