Dropped Files | ZeroBOX

Name	ce760b71f1edd584_832866432405 Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\832866432405
Size	85.0KB
Processes	2112 (npsvga64.exe)
Type	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1024x768, frames 3
MD5	`f1ad704412dc4f5aa38fa78a901360f0`
SHA1	`f40a280651f6ce47a264fc824efbcea721d35c76`
SHA256	`ce760b71f1edd5845157896ebd6b8264137c3a64878bd43660767d0315fc2eb8`
CRC32	`345DD4C9`
ssdeep	`1536:08qQRlKOtginlqeQf4gq7W9r8Wa8+3vMqHILIIsw/jUrBtdb:NRlk8lqjQg/N8WA0qoLhd/jUFtdb`
Yara	JPEG_Format_Zero - JPEG Format
VirusTotal	Search for analysis

Name	dafd690a09034991_npsvga64.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\6bb5824ec4\npsvga64.exe
Size	4.8MB
Processes	1984 (jjjj.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`7338191364d7eb9a6f697f08833b7fe4`
SHA1	`2b3523f11515636eb296f1b5c4d10027fb238aee`
SHA256	`dafd690a0903499113b0f9c6e96f48fe5516dda430c2ba7cb3a0ca0527fae204`
CRC32	`CDEEED15`
ssdeep	`98304:PSUHKFydXk7ydjWRfHEvTvG23jJJ77DzlThQM5Yd1wWjQM8fATPsaZlxrdVyZ:PEFydXk+JWRv4zG4jJJ7zlThQgu4fyBY`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer
VirusTotal	Search for analysis

Name	171c875a544e96c8_tcpupdate.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\1000223050\tcpupdate.exe
Size	1.9MB
Processes	2112 (npsvga64.exe)
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`fc370061296aefef63818d1a9069f21e`
SHA1	`687e8003d3d147868d7c6d08aea5223df93eee09`
SHA256	`171c875a544e96c823170d1df870587300965ee069bc7dc35845b1bfccf17465`
CRC32	`E6CE5A75`
ssdeep	`49152:3ewjTwlUzZ5YJOBaVixx56Fu8Q2+Xbb5rZi1ylQ:UKZ4OkVixx56c8Q1X1Zi+Q`
Yara	UPX_Zero - UPX packed file IsPE64 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature
VirusTotal	Search for analysis

Name	55194a6530652599_unsecapp.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\1000219050\unsecapp.exe
Size	830.4KB
Processes	2112 (npsvga64.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`1955e7fe3c25216101d012eb0b33f527`
SHA1	`f8a184b3b5a5cfa0f3c7d46e519fee24fd91d5c7`
SHA256	`55194a6530652599dfc4af96f87f39575ddd9f7f30c912cd59240dd26373940b`
CRC32	`CBAAA5FF`
ssdeep	`12288:O0otz0xpk0Um022227UxUX2Uj2K2000U2U2UU2+Ujk2UjfUUzUUUUU0SU2UUUUUg:dolciA17ZguqUzxw931gCM3TH`
Yara	UPX_Zero - UPX packed file Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen OS_Processor_Check_Zero - OS Processor Check Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet Malicious_Library_Zero - Malicious_Library Is_DotNET_EXE - (no description) anti_vm_detect - Possibly employs anti-virtualization techniques Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer Antivirus - Contains references to security software PhysicalDrive_20181001 - (no description) Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis