Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	015d60486e75035f_clip64.dll Submit file
Filepath	C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
Size	89.0KB
Processes	2916 (metado.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`547bae937be965d63f61d89e8eafb4a1`
SHA1	`85466c95625bcbb7f68aa89a367149d35f80e1fa`
SHA256	`015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5`
CRC32	`DE80468A`
ssdeep	`1536:Xo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUynTaB89p:XoUCWbBNpplToUs1uNhj25LJUUaB89p`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description) Admin_Tool_IN_Zero - Admin Tool Sysinternals
VirusTotal	Search for analysis

Name	340c8464c2007ce3_cred64.dll Submit file
Filepath	C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
Size	162.0B
Processes	2916 (metado.exe)
Type	HTML document, ASCII text, with CRLF line terminators
MD5	`1b7c22a214949975556626d7217e9a39`
SHA1	`d01c97e2944166ed23e47e4a62ff471ab8fa031f`
SHA256	`340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87`
CRC32	`CC58D737`
ssdeep	`3:qVoB3tURObOb0qHXboAcMBXqWrKb0GklIVLLPROZ/eIwcWWGu:q43tIkObRHXiMIWObtklI5LPROeIpfGu`
Yara	None matched
VirusTotal	Search for analysis

Name	b651e87ec99c8895_fotocr06.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\1000007051\fotocr06.exe
Size	752.5KB
Processes	2916 (metado.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`8c78eb5fc5149b032c634eed879d9c34`
SHA1	`d1deda3dc13594439cbea1afb6e429290e43c8b7`
SHA256	`b651e87ec99c88952024d03fb1483de5a1314be648476c47991ab0a7d1b3c1b5`
CRC32	`688FEBE4`
ssdeep	`12288:UMrBy90x0JXlL5WfrqZTXloMd2yWap9rr5MGdFw9T//+erYusG3ZW4KlFisAMcdN:NyO0XjTXl3dt3tNLF8epuzpYlMs6dBT`
Yara	UPX_Zero - UPX packed file Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet Malicious_Library_Zero - Malicious_Library CAB_file_format - CAB archive file PE_Header_Zero - PE File Signature IsPE32 - (no description) Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
VirusTotal	Search for analysis

Name	562bcb9561e8c2cd_foto148.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\1000006051\foto148.exe
Size	752.0KB
Processes	2916 (metado.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d43c4f5d811dc5a2be3acb6b918d39b9`
SHA1	`766a496d45d4331c81518a59a86ad1c6f341fe61`
SHA256	`562bcb9561e8c2cdaff2ac3abfca8b5b6e0190f208f73d3e7ec56f66645027e3`
CRC32	`5310C6AE`
ssdeep	`12288:hMrjy90WK5LbSzYkISBfVV/NaZ2vV23nJAYbgHxCr81Dj/4Vp9wAIKl7g/gwnjwV:6yC28krw2vIJABHxaY3w1a+`
Yara	UPX_Zero - UPX packed file Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet Malicious_Library_Zero - Malicious_Library CAB_file_format - CAB archive file PE_Header_Zero - PE File Signature IsPE32 - (no description) Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
VirusTotal	Search for analysis

Name	8c825a5e4cb39770_metado.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\a9e2a16078\metado.exe
Size	210.4KB
Processes	2800 (m1472194.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`7b52e2daf9422dd3f5920fadd8bc5104`
SHA1	`e15cb875b60360db7e957a38588c34041fc7060f`
SHA256	`8c825a5e4cb39770da80ef4df6d882ca33f06e95512b15edcaa63f34cd864099`
CRC32	`8438F234`
ssdeep	`3072:meTRJ0kHbnpN23kQKp5XzutZXKGrpeN84LuZAIybiy3xEfbi:FTR2AnpN2wDurXBeBuZAIMEj`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer
VirusTotal	Search for analysis