popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name cb5dfbaa34875cab_config.json
Submit file
Filepath C:\ProgramData\SystemFiles\config.json
Size 312.0B
Processes 2936 (dllhost.exe)
Type ASCII text, with CRLF line terminators
MD5 7a8cfc637b9388da58d47d4e79100aa0
SHA1 497ec9c5ae66569cb716b3eb95a80d9d9f243f7d
SHA256 cb5dfbaa34875cabb3a7be639b6b0f5ebe6a8d4152936aceecc096f1bc757e71
CRC32 D496E147
ssdeep 6:h3T6tyHuMRwg5p+/6m17iHKsIdm7wsUcPboTrFshfGB3Qvm1aERrMI9:h3T6tyHdpq6mMHikIFs5G2vm0ExT
Yara None matched
VirusTotal Search for analysis
Name d6431d5645fffd05_d93f411851d7c929.customDestinations-ms~RFba0b9f.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFba0b9f.TMP
Size 7.8KB
Processes 1692 (powershell.exe) 2616 (powershell.exe)
Type data
MD5 260d23ce04a8f8555a73b7d2dc15e911
SHA1 ebad746fb7de847c50f7502a44f6e35534733efd
SHA256 d6431d5645fffd05a23166d630253bc7ce8c099cf6e9c956f8ae5e1249ee8588
CRC32 11D6B213
ssdeep 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXo5tvbHnorrxQ
Yara
  • Generic_Malware_Zero - Generic Malware
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RFba044c.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFba044c.TMP
Size 7.8KB
Type data
MD5 b0c9ff441742f3847ea27da9dee7f2cd
SHA1 c42a1eb32ba953a0ce5d8635caabf71b5b281495
SHA256 a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4
CRC32 0BBCAB1A
ssdeep 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ
Yara
  • Generic_Malware_Zero - Generic Malware
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name 25e1285c3271ef91_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2676 (powershell.exe)
Type data
MD5 dc96830ba5584089185e726be65068a5
SHA1 4ff45e8e88b5c1a7fcfe4e45c77447586c9831a5
SHA256 25e1285c3271ef914560b614026b25b946bdb113c90233371ac2d79f61dc7887
CRC32 F7168A42
ssdeep 96:6JtuCeGCPDXBqvsqvJCwo3JtuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:6JtvXo3JtvbHnorrxQ
Yara
  • Generic_Malware_Zero - Generic Malware
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name 64c80419e5ca81a5_dllhost.exe
Submit file
Filepath C:\ProgramData\Dllhost\dllhost.exe
Size 24.5KB
Processes 2084 (update.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 acf4152befc5768daaf11c92fd3899b0
SHA1 f8a210a2a00876f15008f275063988e5cf534722
SHA256 64c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6
CRC32 83DC4B2A
ssdeep 384:6pDzRxQY2QaZLixTecaPEPrAIvWZUBp4Qdbi8LNbkus6wCwC7kzCYbmFCTxdccdH:6pD9elPqL3bhD9Ff2X
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name e3b0c44298fc1c14_System.exe
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\System.exe
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 4548c497e66eeb7c_update.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\update.exe
Size 62.5KB
Processes 2700 (MSBuild.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 34b13de397e2d25f22dd9de0acf26d96
SHA1 38965e2273f74ed168924c955c45694173732c67
SHA256 4548c497e66eeb7c73e76843fa893bcb680eb41a9882d8d42e0bf367a89d654f
CRC32 124E488B
ssdeep 768:tiZXl8OZU9AEnh8Ab6RkC0eP/jmnMbEJYk/BDc0P9s4yZaiKRWN:GXl8OgxJ62O/inMbEWk5Dc0VRyZdKc
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Generic_Malware_Zero - Generic Malware
  • ConfuserEx_Zero - Confuser .NET
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name a12c34fef1d6475d_winlogson.exe
Submit file
Filepath C:\ProgramData\Dllhost\winlogson.exe
Size 5.2MB
Processes 2936 (dllhost.exe)
Type PE32+ executable (console) x86-64, for MS Windows
MD5 6c454e10bbea489cfc96253fe55ec282
SHA1 22fd5c79495ad06036635eff26a31c76d859e3b7
SHA256 a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
CRC32 16169542
ssdeep 98304:u0eUU9n9S8uIqzzCRrXdKrMiAeA4qG36UiVuiTK5GaRqayVMBzi0:rU9bZB4L3RYu3GaRqVaW0
Yara
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
  • IsPE64 - (no description)
VirusTotal Search for analysis
Name 3ba4b690f090c1d6_sys_rh.bin
Submit file
Filepath C:\ProgramData\sys_rh.bin
Size 1.6KB
Processes 2084 (update.exe)
Type ASCII text, with CRLF line terminators
MD5 91ab5398d0944f25d2a42b2d82b28887
SHA1 d3b2af41e6aa348af8898e787ff9286238d23d51
SHA256 3ba4b690f090c1d61a7360a88cc281d17e78d040c40bf13a6e801e4c11f87c89
CRC32 17A2EAB9
ssdeep 48:qiz0VROPTmjXd1iBqcIEho2sn1qAQ/cdw7K:zAbi4XHi/tSZAAK2
Yara None matched
VirusTotal Search for analysis