Dropped Files | ZeroBOX

Name	4dc41961e976e863_5552d379.exe Submit file
Filepath	C:\ProgramData\Check Management v1.4.9\5552d379.exe
Size	4.7MB
Processes	3024 (yuMBYoKlosa.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`412ccd97ae4128d870e27b704e3e348f`
SHA1	`41e87863d43ba0caea21f968cba70fd5f26b7f53`
SHA256	`4dc41961e976e863273d9eeed25affa22dc57291410bcba1475b8e6ffdc73c94`
CRC32	`C525FEA2`
ssdeep	`98304:X5CCynB/7MO8t5WRmfu8Gbi/9ePOZ+CG6tLvZLHmrel7Ml7cTBYS7Z/:pCrnJoO8IkG+/9ePO4CVtLvBielMlQdh`
Yara	IsPE32 - (no description) UPX_Zero - UPX packed file Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature
VirusTotal	Search for analysis

Name	9ff2e6275d3d9e43_zh0ouccaah2.exe Submit file
Filepath	C:\Users\Public\ZH0OUCCaah2.exe
Size	102.0KB
Processes	2904 (1_KpCGvNj.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`00221a6351e7426f7e88c157373f9b80`
SHA1	`198c2862a7fe3f2e0ec0913cc877bdd5fb7f11c4`
SHA256	`9ff2e6275d3d9e43de22d1acce77cb536cda79b86f6605a73312110b0e74e78b`
CRC32	`8EF2A8C8`
ssdeep	`1536:p0DskCrlG2IxAvcZHbc209JmqhGWdVoJJJJJJJJJJJJJJJJJJJJJJJRJJJJJJJJL:pICrlGI2CXmQ25XwvER`
Yara	IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature
VirusTotal	Search for analysis

Name	bf4e14ae5732b6f8_tmp4EA7.tmp.bat Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp4EA7.tmp.bat
Size	350.0B
Processes	3024 (yuMBYoKlosa.exe) 2060 (cmd.exe)
Type	DOS batch file, ASCII text, with CRLF line terminators
MD5	`ca1b36e1936e9739048b18fb05d53520`
SHA1	`15ae1d33e38dedd1a1ba8482fdc36e2c59a26ce7`
SHA256	`bf4e14ae5732b6f83a522d5890a572141cceb2f225f38bc4e6dc1e76dbe39e18`
CRC32	`50898366`
ssdeep	`6:hwsCtuH1jUXJKQe8F8ZIAYdJiXCKStcV3aoTPXCKStc6gSJbmq1mQpcLJ23fTm1H:nVjnQe8F+YdE2cFaoTP2c6gS8COLMLuX`
Yara	None matched
VirusTotal	Search for analysis

Name	98c0617a52694e05_yumbyoklosa.exe Submit file
Filepath	C:\Users\Public\yuMBYoKlosa.exe
Size	42.0KB
Processes	2904 (1_KpCGvNj.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`c523d423234494eeb7b60a892d7a4bea`
SHA1	`db992908237ee2ab5c07f4362b9a29516ac09a5d`
SHA256	`98c0617a52694e05760b7f0584a3a0f15f772a4e8598cdd7bd833401e6c596d3`
CRC32	`6208D6A6`
ssdeep	`768:bR0gNnVyaPAjsie9cObVjCO8QMQluISZCVD25P7/vG8R78/ayU:b5nVy8bVG3quISaa73B7eI`
Yara	IsPE32 - (no description) UPX_Zero - UPX packed file Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature
VirusTotal	Search for analysis