Dropped Files | ZeroBOX

Name	9884e9d1b4f8a873__shfoldr.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\is-H15BU.tmp\_isetup\_shfoldr.dll
Size	22.8KB
Processes	2604 (Bolt2.tmp)
Type	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`92dc6ef532fbb4a5c3201469a5b5eb63`
SHA1	`3e89ff837147c16b4e41c30d6c796374e0b8e62c`
SHA256	`9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87`
CRC32	`AE2C3EC2`
ssdeep	`384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4`
Yara	IsPE32 - (no description) IsDLL - (no description) PE_Header_Zero - PE File Signature
VirusTotal	Search for analysis

Name	203d7b61eac96de8_idp.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\is-H15BU.tmp\idp.dll
Size	216.0KB
Processes	2604 (Bolt2.tmp)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`8f995688085bced38ba7795f60a5e1d3`
SHA1	`5b1ad67a149c05c50d6e388527af5c8a0af4343a`
SHA256	`203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006`
CRC32	`90D9CA64`
ssdeep	`3072:6XHWOJd5D0ocxYF0+CT4zNHNpwZNjlhBKL/kg/0r4YLuztNJaFlCx:6G6tae7wZNOpiWP`
Yara	IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file
VirusTotal	Search for analysis

Name	1d07cfb7104b85fc_Bolt2.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\is-NJCLH.tmp\Bolt2.tmp
Size	694.5KB
Processes	2552 (Bolt2.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ffcf263a020aa7794015af0edee5df0b`
SHA1	`bce1eb5f0efb2c83f416b1782ea07c776666fdab`
SHA256	`1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64`
CRC32	`59A45BB2`
ssdeep	`12288:bQhCh1/aLmSKrPD37zzH2A6QGgx/bsQYq9KgERkVfzrrNVyblD4cNaf/yxyR:bQYh1yLmSKrPD37zzH2A6QD/IpqggE29`
Yara	Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file
VirusTotal	Search for analysis

Name	388a796580234efc__setup64.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\is-H15BU.tmp\_isetup\_setup64.tmp
Size	6.0KB
Processes	2604 (Bolt2.tmp)
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`e4211d6d009757c078a9fac7ff4f03d4`
SHA1	`019cd56ba687d39d12d4b13991c9a42ea6ba03da`
SHA256	`388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95`
CRC32	`2CDCC338`
ssdeep	`96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) UPX_Zero - UPX packed file
VirusTotal	Search for analysis