popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 3b046d30dc2e6021_MO8YUSRQ
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\MO8YUSRQ
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 e185515780e9dcb21c3262899c206308
SHA1 230714474693919d93949ab5a291f7ec02fd286f
SHA256 3b046d30dc2e6021be55d1bd47c2a92970856526c021df5de6e4ea3c4144659b
CRC32 25EF2A64
ssdeep 24:TLNg/5UcJOyTGVZTPaFpEvg3obNmCFk6Uwcc85fBvlllYu:TC/ecVTgPOpEveoJZFrU1cQBvlllY
Yara None matched
VirusTotal Search for analysis
Name c041f723ce1bc58e_MSBuild.exe
Submit file
Filepath C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Size 260.9KB
Type PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 bf516883a362948a6e81886ed24796b5
SHA1 69fcff0a865a1adfb8a4b9a51ee64232779a1332
SHA256 c041f723ce1bc58e81640ad58d20a650847e1b52b848dd0d6b748a7e5eb22472
CRC32 ED26FC80
ssdeep 3072:xgzqE9WOuRlNSErx3jnKkBGEuzywysawso1G0bv/34uf02RFitcPAksZ8e9qy/dT:NRtzKlS402bit9ce9L4LRL/ElA6
Yara
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win_Trojan_Formbook_Zero - Used Formbook
  • Is_DotNET_EXE - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • ASPack_Zero - ASPack packed file
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 6ec867dc1caa77ec_5XBAIMGL
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\5XBAIMGL
Size 18.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 f3a100cba30b2a07a7af8886e439024e
SHA1 a454cca0db028b4d0fb29fa932c9056519efe2cf
SHA256 6ec867dc1caa77ecfd8e457d464b6bebc3be8694b4c88734fa83d197c0b214cc
CRC32 72CF6AF8
ssdeep 24:LLI10KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6Uwc6KaW:oz+JH3yJUheCVE9V8MX0PFlNU1faW
Yara None matched
VirusTotal Search for analysis
Name 38c389720b75365f_FU3EKN7Y
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\FU3EKN7Y
Size 72.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 c480140ee3c5758b968b69749145128d
SHA1 035a0656bc0d1d376dfc92f75fa664bdf71b3e4d
SHA256 38c389720b75365fcb080b40f7fdc5dc4587f4c264ec4e12a22030d15709e4a9
CRC32 954A724F
ssdeep 96:f0CWo3dOEctAYyY9MsH738Hsa/NTIdE8uKIaPdUDFBlrrVY/qBOnx4yWTJereWbY:fXtd69TYndTJMb3j0
Yara None matched
VirusTotal Search for analysis
Name 6f878c485ee7d776_YMGD2V3W
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\YMGD2V3W
Size 120.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 7cd1f915719aa3f01dcb5d1d04018ba0
SHA1 6e50a73815aae25bd6295d7240d517f0758b94be
SHA256 6f878c485ee7d776face2b6f0f72d6b2b383041ce5abd23ee5948d987afa9c64
CRC32 AA763EF2
ssdeep 48:T1HW6tdfxNPp+suktLReRK+NaUvdWSZ00LTL0drQHHp7C5fVcS2+VANUXq6uw5Nb:DJQpWSZ00LTL0QCbc0VANPjwQU+
Yara None matched
VirusTotal Search for analysis
Name dac5f2e7bcabc924_pm.exe
Submit file
Filepath C:\Users\test22\AppData\Roaming\pm.exe
Size 1.9MB
Processes 3068 (MSBuild.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 22e6d862d6f51b6283b60badf02b6f81
SHA1 11920f1bf418f67cdbef320aa1afee596ef27537
SHA256 dac5f2e7bcabc924576254aed4a53b112bb19ca9869dfbc7b427765746374d33
CRC32 A0191B2D
ssdeep 49152:tE732hD2KlDO/4QGJpvmcyVHHRT5pFq8:tE2F8wKVHRT5pQ8
Yara
  • IsPE32 - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Is_DotNET_EXE - (no description)
  • hide_executable_file - Hide executable file
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 26f35270f7140657_azne.exe
Submit file
Filepath C:\Users\test22\AppData\Roaming\azne.exe
Size 100.5KB
Processes 3068 (MSBuild.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 683600b61a32d3eb2cd44cb34fdf7ab3
SHA1 e8bdd864c2610495850bf525cd1529c66c0b0b53
SHA256 26f35270f714065705474f3a330a9b7676c2d7e30b9cb9de57d726930768fe29
CRC32 0511B825
ssdeep 3072:kiQpXFDYuJGJWq8EYByWZmaRO4KVppjU:MFeDYUWEa04wj
Yara
  • IsPE32 - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis