popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 340c8464c2007ce3_cred64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
Size 162.0B
Processes 2860 (oneetx.exe)
Type HTML document, ASCII text, with CRLF line terminators
MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
CRC32 CC58D737
ssdeep 3:qVoB3tURObOb0qHXboAcMBXqWrKb0GklIVLLPROZ/eIwcWWGu:q43tIkObRHXiMIWObtklI5LPROeIpfGu
Yara None matched
VirusTotal Search for analysis
Name b8c8aedd84c36385_clip64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
Size 89.0KB
Processes 2860 (oneetx.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 8451a2c5daa42b25333b1b2089c5ea39
SHA1 700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256 b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
CRC32 05D62A3B
ssdeep 1536:Bo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU7faB89p:BoUCWbBNpplToUs1uNhj25LJUDaB89p
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
VirusTotal Search for analysis
Name 1b535e3945852b0f_oneetx.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\c3912af058\oneetx.exe
Size 964.2KB
Processes 320 (c6805445.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 fce04306d395bf9fddeeb9aed0130287
SHA1 9ef119c0df3cb0cc2f8d6275353d3b4b28557c7a
SHA256 1b535e3945852b0f684bca5b72644d21370739802b2ea3fcdffb22bc974ee681
CRC32 3FEC44F5
ssdeep 12288:XTunKobECuu3C3O32STjl6owrL5PAjEwmfnfa6RmmHXLnWawunLKXau9LaIddisi:WK9ZuyemAxDg6jFo3RV3
Yara
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • ConfuserEx_Zero - Confuser .NET
  • RedLine_Stealer_Zero - RedLine stealer
VirusTotal Search for analysis
Name 351433f5aeb47824_fotocr23.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000021051\fotocr23.exe
Size 1.1MB
Processes 2860 (oneetx.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 21ef487afb52372d642b33083ac236dd
SHA1 b04248d5937cae3db317efb3e3f277d2c847b125
SHA256 351433f5aeb47824e62a9698cc0c45bb04a8f00a2337963d1d24d8dd95bf86b0
CRC32 EDB63116
ssdeep 24576:IyPNRvSq29KpIp/SIJE339TV8OqYeUL9XNny2flfLLDAb2baK:PPj1d09J0tB8OqOLy2fljYb7
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • Malicious_Library_Zero - Malicious_Library
  • CAB_file_format - CAB archive file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name d26b013e1e7ed3e2_foto0174.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000020051\foto0174.exe
Size 1.1MB
Processes 2860 (oneetx.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2ceddbfea77ef2c18f9ee3d860f29451
SHA1 0dd069fd2721ec9686550246347068c9153325db
SHA256 d26b013e1e7ed3e2293ff36faf366ac9df27ba21aca44adff1a6301a53f0a5d9
CRC32 E2C6B7E9
ssdeep 24576:Ly9TNNTbUm/oEt6tdcj0cX8heYq9rYxr+euSVB:+lN1Um/oEt6tyj0cM1+rE5uS
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • Malicious_Library_Zero - Malicious_Library
  • CAB_file_format - CAB archive file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 936541eef94df1a6_i6821669.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP002.TMP\i6821669.exe
Size 904.3KB
Processes 2612 (foto0174.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 23e059d85931fe38da69d11a9deab7d5
SHA1 3afe2bdfd6479621033a98296dd8dce0c6c7c162
SHA256 936541eef94df1a67c85a0c955c820d278726c0444e5bb152daab7b6b7d36132
CRC32 875B569D
ssdeep 12288:HNwT3TWdEMKJxfKpDkiv8EMSGSX/y8pj3otbujoXMj9KgErlhK21WbsxijSk77kH:HNwTTowihnGUp9yb3
Yara
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • ConfuserEx_Zero - Confuser .NET
  • RedLine_Stealer_Zero - RedLine stealer
VirusTotal Search for analysis
Name da307e35032c39e6_x1404399.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP002.TMP\x1404399.exe
Size 750.5KB
Processes 2612 (foto0174.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0262d8530e8a27ed3e3c5c06478087bb
SHA1 0231affde9ec60a6944ee4ae12b1df8b1f5b2a71
SHA256 da307e35032c39e6bc3a81f0b902cbb036dfd406f500b1b72fe7854acb57e016
CRC32 F7F3BDA3
ssdeep 12288:fMrAy90/pO47YcePskpimHzbUvLXSUXEt1tdM4mLqRj0bSPaJNfNWMehEe:zyypO47CsKbUD/XEt1tdPj0mPaNEHhv
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • Malicious_Library_Zero - Malicious_Library
  • CAB_file_format - CAB archive file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis