popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name b206eb8eb82ce028_host1.exe
Submit file
Filepath C:\Users\test22\AppData\Roaming\host1.exe
Size 5.7MB
Processes 2688 (powershell.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4911f551695218389a6730f551720e5d
SHA1 a9dc659b9b06defb7c7d33a5ae2f0210463287c2
SHA256 b206eb8eb82ce02889d427ec087813a752382a6888fb2b944bc1bac776dbeee1
CRC32 523C61BC
ssdeep 98304:y10gW3Ij6llvyNNToGMHAkUMW2U4jZukwMs:BgiJGMHzTHlutZ
Yara
  • Is_DotNET_EXE - (no description)
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name e3b0c44298fc1c14_ZmFVVfoJXP
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\ZmFVVfoJXP
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name f43e81bd9d710109_aFex9R9rJK
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\aFex9R9rJK
Size 28.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 d478ce90aca9aa48dca15da2894ca2a7
SHA1 585d064e49780cd258b60fc886df6d735783698b
SHA256 f43e81bd9d71010955598796a24f9d834fc9884c4f97812a742a415de29202ca
CRC32 619B1FFA
ssdeep 24:TLag/5UcJOyTGVZTPaFpEvg3obNmCFk6Uwcc85fBM:Td/ecVTgPOpEveoJZFrU1cQB
Yara None matched
VirusTotal Search for analysis
Name e262d49719dc63e0_r9VDOApU3y
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\r9VDOApU3y
Size 25.0B
Processes 196 (RegAsm.exe)
Type ASCII text, with no line terminators
MD5 54af0dbe4543b5570cb0c4eef3963111
SHA1 14a5c96b4ee97ece9007403da8d25a6682b06931
SHA256 e262d49719dc63e009268d1e5b4b815815718511738d5fb68d6ceddb8523a8ef
CRC32 B29E84F3
ssdeep 3:hyR0tV9Hjk:kRUI
Yara None matched
VirusTotal Search for analysis
Name bbc59eb43822e646_JIXmGoioJB
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\JIXmGoioJB
Size 18.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 53ea322f91d6f0de8448b68583284d22
SHA1 b6c835867fbf7e432b834f7366eb0407f3eebbfa
SHA256 bbc59eb43822e64660cc4ccbca37d6dc016eaa9b85b2c6f5b40826bb03188b34
CRC32 CA013001
ssdeep 24:LLY10KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6Uwc6ocW:4z+JH3yJUheCVE9V8MX0PFlNU12W
Yara None matched
VirusTotal Search for analysis
Name 0b8607fdf72f3e65_RQAhQ7MUW6
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RQAhQ7MUW6
Size 96.0KB
Type SQLite 3.x database, user version 12, last written using SQLite version 3038003
MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
CRC32 842B3569
ssdeep 12:DQAwfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAwff32mNVpP965Ra8KN0MG/lO
Yara None matched
VirusTotal Search for analysis
Name b7c225ef3cc3e875_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2688 (powershell.exe)
Type data
MD5 81ca4510272caf505e8091e9a28cb716
SHA1 71414aeec9f1e4a6f5a461b01700cc9cc992cd9e
SHA256 b7c225ef3cc3e87506150eb140e7b9cc127a3469c50a808854acac71a53d98bf
CRC32 FC31E90F
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCwor/47HwxGlUVul:EtCgXoRtCgbHnorLxY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 512e4e95427a8c66_5wg0n8pB39
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\5wg0n8pB39
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 f4c540f52d5c08d24a79805eda1d7abf
SHA1 22be46826df7693f58736adb232ab2da790f2571
SHA256 512e4e95427a8c66b2993b27bb23d99cdab2ebd6e9e8937c7f6a39ed8c6a5b94
CRC32 95C9FB3A
ssdeep 24:TLmg/5UcJOyTGVZTPaFpEvg3obNmCFk6Uwcc85fB34444z:T5/ecVTgPOpEveoJZFrU1cQB34444z
Yara None matched
VirusTotal Search for analysis
Name 15551532a6b848db_123.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\123.txt
Size 8.0B
Processes 2688 (powershell.exe)
Type ASCII text, with no line terminators
MD5 07d82f48661456568843a7674b2d87e0
SHA1 8e469dddc9eb9701344aea9e9f7421e135a7e128
SHA256 15551532a6b848db73e06ec6a1cf3ba606ad198f0a6ed86738cfcd331cacdafd
CRC32 004CF926
ssdeep 3:YUG:Y
Yara None matched
VirusTotal Search for analysis
Name 783758f5b90c894c_RegAsm.exe
Submit file
Filepath C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Size 62.9KB
Type PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 53690d6dbf8e3f7bd54529131f1be127
SHA1 b28ab7d6a4f0fba872310d0dd60bf9bb233b5cff
SHA256 783758f5b90c894c7d57d6dd257683194b4f4d3bc470e0fd51b1b8c6171494d8
CRC32 C59F6165
ssdeep 768:Z+R1Viwqkh+tGi6HYDKnJzQOgFQ04mzGnvclLz3oWK6Iq8rAOzWipD6BXl:ELiwrh+tL64DKnJJAzGvchUCQFa6D6B1
Yara
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 650d9c01490af33d_36OfNQVtVw
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\36OfNQVtVw
Size 25.0B
Processes 196 (RegAsm.exe)
Type ASCII text, with no line terminators
MD5 b14fec4ba4879e69f00331476ecf9e48
SHA1 329120c6cdef3d556c05d9d6b44793e3437bad36
SHA256 650d9c01490af33db015567bf35db40baafcdd979dd0e04d8a3747ab7519bcaa
CRC32 558AD9CA
ssdeep 3:PUcDhuPUBOn:PUyhqUBOn
Yara None matched
VirusTotal Search for analysis
Name 55e1190786eb6c0a_system32.exe
Submit file
Filepath C:\Users\test22\AppData\Roaming\system32.exe
Size 131.0KB
Processes 2688 (powershell.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 925a33d545b81303f95076ca52264c0a
SHA1 81674cc002e4c98d59480e6365adaa4c4733e170
SHA256 55e1190786eb6c0a8c69827849af9b21ec8ece3936622f9c45ea074f4ee39691
CRC32 DAA4B88D
ssdeep 1536:0kwLskUVwPaELiamqLzBP3og6EoYt9KtL0g6su15vmKWz6ej/Hvc+XHeLjuBwyPH:9wiuJl3og6e9KtQ915ovc+u0wY
Yara
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name c9d2357a874122ac_I8Z7Joxb0y.bat
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\I8Z7Joxb0y.bat
Size 226.0B
Processes 196 (RegAsm.exe) 1864 (cmd.exe)
Type DOS batch file, ASCII text, with CRLF line terminators
MD5 3ffec7178056612f43cdc7bb7446e134
SHA1 ac0cec5039c779ae6c7340c5fae062264d7a3509
SHA256 c9d2357a874122ac16211890ab9e6e6275761a108233799e5d81bbb95d3bf419
CRC32 B896C02A
ssdeep 6:hITg3Nou11zCZGkLW6WAnPL4bKOZG1mQpcLJ23fr5MH:OTg9o4kzZOLMzg
Yara None matched
VirusTotal Search for analysis
Name 9a8ea0e2df7554c5_L6Wq8pw9jp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\L6Wq8pw9jp
Size 72.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 0539a773e44d21a84fd97fee0dffd4a3
SHA1 5904058c20aad54c552edc57826babd36ab61149
SHA256 9a8ea0e2df7554c57fb4ee6a8a12782f5a2474a3e4c23dc61e4768631dc4eb9f
CRC32 964BC0B2
ssdeep 96:P0CWo3dOOctAYyY9MsH738Hsa/NTIdE8uKIaPdUDFBlrrVY/qBOnx4yWTJereWbY:PXt769TYndTJMb3j0
Yara None matched
VirusTotal Search for analysis