popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name b7c225ef3cc3e875_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2852 (powershell.exe)
Type data
MD5 81ca4510272caf505e8091e9a28cb716
SHA1 71414aeec9f1e4a6f5a461b01700cc9cc992cd9e
SHA256 b7c225ef3cc3e87506150eb140e7b9cc127a3469c50a808854acac71a53d98bf
CRC32 FC31E90F
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCwor/47HwxGlUVul:EtCgXoRtCgbHnorLxY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 6050c167bb78a8eb_build.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\build.exe
Size 2.0MB
Processes 2564 (HalogenSySCheck.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 1987b8ce233909021e877ea3408ccb70
SHA1 b6ff13890de9d32f468b2b59ab183457a3af4837
SHA256 6050c167bb78a8ebddc39497418ca02bf43fe9afce2a43a740f52f6600f6c380
CRC32 71AFEB2A
ssdeep 49152:m+q9PMuqMHzmKqKX8HSFQ6kXQ6JH/54UAMwpUciOhE:dEP5qMTjGSWDQAR4UAMdciOh
Yara
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name e3b0c44298fc1c14_nswF136.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\nswF136.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 262f7601489a81be_stalker-wix64winx32.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\STALKER-wix64winx32.exe
Size 145.5KB
Processes 2564 (HalogenSySCheck.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 e5761f181e221c4a029fa169f3766a94
SHA1 73175ed04161aee5236026eee41ba23664777078
SHA256 262f7601489a81beb8d3551d2425b7c2f080563a10877174024b40a6e44b2925
CRC32 AF7D635F
ssdeep 3072:YV+m5cnQmRSdVx7oW/sk8dV2chWZC8e8hC:YjeSxkkchWI
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • ConfuserEx_Zero - Confuser .NET
VirusTotal Search for analysis
Name 49b7477db8dd22f8_6PH3SWDYZYGKTLW.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nsgF175.tmp\6PH3SWDYZYGKTLW.dll
Size 6.5KB
Processes 2564 (HalogenSySCheck.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 293165db1e46070410b4209519e67494
SHA1 777b96a4f74b6c34d43a4e7c7e656757d1c97f01
SHA256 49b7477db8dd22f8cf2d41ee2d79ce57797f02e8c7b9e799951a6c710384349a
CRC32 A8874D27
ssdeep 96:4BNbUVOFvfcxEAxxxJzxLp+eELeoMEskzYzeHd0+uoyVeNSsX4:EUVOFvf9ABJFHE+FkEad0PLVeN
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis