Dropped Files | ZeroBOX

Name	00f972eb3d4d2fac_n5368789.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\n5368789.exe
Size	205.0KB
Processes	884 (fotod95.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`835f1373b125353f2b0615a2f105d3dd`
SHA1	`1aae6edfedcfe6d6828b98b114c581d9f15db807`
SHA256	`00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4`
CRC32	`B342F64B`
ssdeep	`3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description) PE_Header_Zero - PE File Signature
VirusTotal	Search for analysis

Name	6adc35a0b5248bd0_y5541094.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\y5541094.exe
Size	258.0KB
Processes	884 (fotod95.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`57cce3287950fe96dc7a658b91ed190e`
SHA1	`fe90dd1b785b770ec9b20f93d71e7e8aa49ed527`
SHA256	`6adc35a0b5248bd018ff356a01b87d822967ff10ebc678e5a087b50e591b93c7`
CRC32	`C8C58D76`
ssdeep	`6144:Key+bnr+Sp0yN90QEYHtf8O7K4F7iaEffOFht:iMrKy90w1BiaEfYP`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file IsPE32 - (no description) PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
VirusTotal	Search for analysis

Name	08dabdd0b0fb13d5_clip64.dll Submit file
Filepath	C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
Size	89.0KB
Processes	3056 (rugen.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`83fc14fb36516facb19e0e96286f7f48`
SHA1	`40082ca06de4c377585cd164fb521bacadb673da`
SHA256	`08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e`
CRC32	`7E54004B`
ssdeep	`1536:Uo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUGNaB89p:UoUCWbBNpplToUs1uNhj25LJU6aB89p`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE32 - (no description) PE_Header_Zero - PE File Signature
VirusTotal	Search for analysis

Name	587c2fb0cf025a25_cred64.dll Submit file
Filepath	C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
Size	273.0B
Processes	3056 (rugen.exe)
Type	HTML document, ASCII text
MD5	`04a943771990ab49147e63e8c2fbbed0`
SHA1	`a2bde564bef4f63749716621693a3cfb7bd4d55e`
SHA256	`587c2fb0cf025a255a077b24fe6433fd67bdfac451d74d321d86db96c369841e`
CRC32	`2C11B08C`
ssdeep	`6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIR+knacCFEcXaoD:J0+oxBeRmR9etdzRxGezH0qasma+`
Yara	None matched
VirusTotal	Search for analysis