popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name d6431d5645fffd05_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 1480 (powershell.exe)
Type data
MD5 260d23ce04a8f8555a73b7d2dc15e911
SHA1 ebad746fb7de847c50f7502a44f6e35534733efd
SHA256 d6431d5645fffd05a23166d630253bc7ce8c099cf6e9c956f8ae5e1249ee8588
CRC32 11D6B213
ssdeep 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXo5tvbHnorrxQ
Yara
  • Generic_Malware_Zero - Generic Malware
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name 3b04548e24bcb504_w.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000012001\w.exe
Size 16.0KB
Processes 1208 (oneetx.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c200ea136a598e37eb83c8c6031b3f29
SHA1 51ff8101eea8d51a6178635ed26c19678a3d8aa3
SHA256 3b04548e24bcb504a04734a24d47d7f880ca12c5575478d823d27020aea721f8
CRC32 BAC89AA0
ssdeep 96:kEVg6r1wCCbBarsanJtRHJeZW+RElJ869X/Q+sjsTNTSEnrtDINyncI+vL/mg56D:XVZZrDRgAKErjOEnrtDINynT+vCgcNXh
Yara
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 88f9dc0b9a633e43_NswYNsGRussVmaoz
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\NswYNsGRussVmaoz
Size 512.0KB
Processes 2716 (2023.exe)
Type SQLite 3.x database, user version 11, last written using SQLite version 3031001
MD5 dd47ebe6866ad2ab59d0caa1de28d09e
SHA1 afdf6eb7a01bb7ef4c9d768b65abbbeae5ba2663
SHA256 88f9dc0b9a633e43c6d2c6fae136e782c15aa38c1601dcff948987f1c2a391c3
CRC32 8DEE9EEA
ssdeep 24:DQHtJl32mNVpP965hKN0MG/lZpNjCKRIaU5BnCMOkC0JCpL3FYay:DQfrbWTTTqtStLm
Yara None matched
VirusTotal Search for analysis
Name 340c8464c2007ce3_cred64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\a091ec0a6e2227\cred64.dll
Size 162.0B
Processes 1208 (oneetx.exe)
Type HTML document, ASCII text, with CRLF line terminators
MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
CRC32 CC58D737
ssdeep 3:qVoB3tURObOb0qHXboAcMBXqWrKb0GklIVLLPROZ/eIwcWWGu:q43tIkObRHXiMIWObtklI5LPROeIpfGu
Yara None matched
VirusTotal Search for analysis
Name 97a489a4b544ec0c_123dsss.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000003001\123dsss.exe
Size 175.0KB
Processes 1208 (oneetx.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 20b01b94fec9143a2adf624945aa41c3
SHA1 3e3690bb58b1a42cea254a0eb039019c7ebbbf3f
SHA256 97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9
CRC32 370159B8
ssdeep 3072:4xqZWVba1Qhu/q55e55FQhMvxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+c3:mqZ9q52Qh
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name aa8c6dfd7a53e4e4_tcuAxhxKQFDaFpL
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tcuAxhxKQFDaFpL
Size 228.2KB
Type UTF-8 Unicode text, with very long lines, with no line terminators
MD5 211b97f75eeaf7c339331e4517360d9f
SHA1 32b2370763a1fdcc10d1bb67d36ea7b4ad0e677e
SHA256 aa8c6dfd7a53e4e4588822d5ed2f2b0982fbad22f73569cd44473b607283275b
CRC32 6C5AED94
ssdeep 6144:DEenE5aINjhmAUhv+B/1q8Pi2G+D8VbnRl:DbINjhmAuvK/YoVLDOD
Yara
  • NPKI_Zero - File included NPKI
VirusTotal Search for analysis
Name 882a94b59aef6d34_oneetx.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\c5d2db5804\oneetx.exe
Size 236.9KB
Processes 2088 (y53BD64.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 3c827286b7c0749931664ba86ba6a2cf
SHA1 228bb822b75a1acb9d78b947af780c16a22c3879
SHA256 882a94b59aef6d34ad84e4d78f197be9f075edc068ecb0178b8bdfa8bced6af6
CRC32 88DA40EC
ssdeep 3072:N2gKdS0PkjvF5fHdjdyhRGc6zMBdSkbcaKhSdctuVi1VWQO3eIb1NcaWVJ5L:A9d78jt5fHbyhRFMMBd/ySMuViNSc39
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 3dbde13894aa65f3_2023.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000011001\2023.exe
Size 3.1MB
Processes 1208 (oneetx.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 027a60b4337dd0847d0414aa8719ffec
SHA1 80f78f880e891adfa8f71fb1447ed19734077062
SHA256 3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168
CRC32 69E9DFD0
ssdeep 49152:ZRxujKxS2EuSIYkgSc71bdf5k6N21D5MwICiaiSLE6k1/lRr:ZRM282P2jScBbS2lRr
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 8b6af7cc4fc3bcb4_clip64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\a091ec0a6e2227\clip64.dll
Size 89.0KB
Processes 1208 (oneetx.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 6a4c2f2b6e1bbce94b4d00e91e690d0d
SHA1 f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57
SHA256 8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f
CRC32 B54F5143
ssdeep 1536:xo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUjOaB89p:xoUCWbBNpplToUs1uNhj25LJUiaB89p
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 54cfed4f859d0ec3_SjFbcXoEFf
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\SjFbcXoEFf
Size 116.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 6f490da5428093674c9e609077dcdef2
SHA1 d77592944313656a90f359fea62921c20078ff19
SHA256 54cfed4f859d0ec37535b9f16acfe42cae6206fad4b1652c2a3d33d5acf636c7
CRC32 A046246D
ssdeep 48:T4ItVG+3C7nNfVcS2+VANULn36uw5NPM5ETQTpUPxK2PIs6kJL5R2+zaSZ00LTLU:ce/C7n/c0VANUjwQU+KraSZ00LTL0J
Yara None matched
VirusTotal Search for analysis
Name 20f9eb4bd36001f8_tarlatan.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000004001\Tarlatan.exe
Size 897.5KB
Processes 1208 (oneetx.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 b26480dce772642635204619f30c35d6
SHA1 7693a39461090bde35919ea4f6652955f5159a47
SHA256 20f9eb4bd36001f8c3c80ad01078221bb823b2846a00c12549f77f07ef5498ec
CRC32 A1C8551A
ssdeep 12288:GUw49Bd51RtJFh9NKXEoXpM501eVM+SMgYvVHiBFqmpQ5i9rwH4a:eEH1VtSMPfmp5GH4a
Yara
  • ConfuserEx_Zero - Confuser .NET
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • RedLine_Stealer_Zero - RedLine stealer
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name c119a54b6bef3a48_pfRFEgmota
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\pfRFEgmota
Size 80.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 255929949dea51a2f43a1f40e63764ec
SHA1 8f32ab419264fdad05f4f3828db3c1cd38d919fd
SHA256 c119a54b6bef3a48234950dc07fe70f73b69d1390ef0235e66481faa1048ead6
CRC32 F7A79605
ssdeep 96:5Bc7fYLKYZCIdE8XwUWaPdUDg738Hsa/NhuK0l0q8oc5PyWTJereWb3lxzasq9u4:5BPOUNlCTJMb3rEDFAa6E/
Yara None matched
VirusTotal Search for analysis
Name 0b8607fdf72f3e65_NKAReKJyiXJrscct
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\NKAReKJyiXJrscct
Size 96.0KB
Processes 2716 (2023.exe)
Type SQLite 3.x database, user version 12, last written using SQLite version 3038003
MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
CRC32 842B3569
ssdeep 12:DQAwfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAwff32mNVpP965Ra8KN0MG/lO
Yara None matched
VirusTotal Search for analysis
Name 7fb411ee3e34e4b7_gmeyad.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000007001\Gmeyad.exe
Size 3.9MB
Processes 1208 (oneetx.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 a8001f151c1ce13aac56097a2bf1f789
SHA1 414d9f4219570bc75eb6e6cf2932c4fb407afa56
SHA256 7fb411ee3e34e4b79b372b7d2321bf69b46de30c3286edccb7621562caefb60b
CRC32 DC101E45
ssdeep 49152:ZHVpQMSWLLKUmQUSgYaNrb5c90DNQdjK/c0kCs:Z1pjSWL5
Yara
  • NPKI_Zero - File included NPKI
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name b47f96ba63f6861e_tmpbeb8.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000017001\tmpBEB8.exe
Size 36.0KB
Processes 1208 (oneetx.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 5aa405d35131a36ce1647c6937d3e529
SHA1 aaa19a9fa3652a1d39509aac28d3db7b95d276a2
SHA256 b47f96ba63f6861ef3d07ef0bc62d99ce4bd809c79a3121cc3ed18bee2a51358
CRC32 41EF0BBA
ssdeep 768:wtJHrFZuGtbhPAbCFRbPuJHHpXlKm/oAT1wdhMSWgU:wtJLFZuAbUcbPgHpXlKmgAT1wdh3U
Yara
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 824fae3331b95e2f_lgTeMaPEZQ
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\lgTeMaPEZQ
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 41c19a9e8541fcb934c13c075bf47721
SHA1 648a7622d533d79b9a0bb31dc370134ec3a75ed7
SHA256 824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c
CRC32 560F7642
ssdeep 48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u
Yara None matched
VirusTotal Search for analysis
Name edb006e05cfa8501_MRAjWwhTHc
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\MRAjWwhTHc
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 3f5ca3e29b1b60e298aeca0a32164c03
SHA1 f9b5ee59c31a3b06a6b8e476b22d2d7cf1fa8b66
SHA256 edb006e05cfa85015aa76c758d6298c279fd318cff0dbb286927c7ad45105488
CRC32 E1ACA097
ssdeep 24:TL2C0RlPbXaFpEO5bNmISHdL6UwcOxvo5:TYLOpEO5J/KdGU1Eo5
Yara None matched
VirusTotal Search for analysis