Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	e3b0c44298fc1c14___tmp_rar_sfx_access_check_19262140 Empty file or file not found
Filepath	C:\Users\test22\AppData\Local\Temp\__tmp_rar_sfx_access_check_19262140
Size	0.0B
Type	empty
MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
CRC32	`00000000`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis

Name	24cf7c83bd2d9b80_590aee7bdd69b59b.customDestinations-ms~RF126b02f.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF126b02f.TMP
Size	7.8KB
Processes	2932 (powershell.exe) 2984 (powershell.exe)
Type	data
MD5	`30dcf866699403a177ecb312dd45bc1a`
SHA1	`e6820fcb1b1d84bde636a93666619ca02214d162`
SHA256	`24cf7c83bd2d9b80b2158df690c0e1fb5e2fd0a0b74274120e18018f5bd0ccfe`
CRC32	`3B7E3B7A`
ssdeep	`96:ktuCcBGCPDXBqvsqvJCwoJtuCcBGCPDXBqvsEHyqvJCworu4tDHXyGlUVul:ktCgXoJtCgbHnorBTyY`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	b0c85b0198a6b20b_update.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\Update.exe
Size	972.0KB
Processes	2552 (100.exe)
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`ae81454e28b8e64e697a1bf8fdf88f2d`
SHA1	`b3b1be0348326a416db6b09eee14eebee3c5a45d`
SHA256	`b0c85b0198a6b20b04ba4f20fd49d2543114dfe2e2e2914f08c88c8c0e0c0afa`
CRC32	`5D097E1E`
ssdeep	`12288:+X5MZTtvHp+drXZymDL7U+VcQZvcxDQuW:+JMdfmrD5covcWu`
Yara	IsPE64 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer
VirusTotal	Search for analysis

Name	7f40a155df908e2f_auijol.exe Submit file
Filepath	C:\ProgramData\ProgramFiles\AUIJOL.exe
Size	26.6MB
Processes	2744 (Update.exe) 2932 (powershell.exe) 2984 (powershell.exe)
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`cf312fdbf1bf4772bb4e9c42ff676d8a`
SHA1	`a63cfa284ff7c26cd3f8c0ae2ae806814d4eee3f`
SHA256	`7f40a155df908e2fcb740b52faa73cab0d8aad7fee31369bb4557d318150094a`
CRC32	`5DD05610`
ssdeep	`12288:+X5MZTtvHp+drXZymDL7U+VcQZvcxDQuW:+JMdfmrD5covcWu`
Yara	IsPE64 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer
VirusTotal	Search for analysis

Name	a3f715dc3e81e7a8_start.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\Start.exe
Size	128.0MB
Processes	2552 (100.exe)
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`0622d5dd5a2da3be4f54ef473708dbbc`
SHA1	`7ca09fd5baba11830450157f699b79861c32b60e`
SHA256	`de6233647c23e4233c4127dd6ec879c42419317a26caf555ff3ed7ba11bb2cce`
CRC32	`686971C0`
ssdeep	`6144:MASV91gR8MGPvwlDe0A5/8DCRJQnYdjoEtOfGAPPHB6s95M87+i5qVdI:SV91gOMkvwlPYSRPBH5MXiknI`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis