popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 00f972eb3d4d2fac_rugen.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\200f691d32\rugen.exe
Size 205.0KB
Processes 2996 (g6966214.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 835f1373b125353f2b0615a2f105d3dd
SHA1 1aae6edfedcfe6d6828b98b114c581d9f15db807
SHA256 00f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
CRC32 B342F64B
ssdeep 3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
VirusTotal Search for analysis
Name 850cd190aaeebcf1_i9428616.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP000.TMP\i9428616.exe
Size 11.0KB
Processes 2556 (foto175.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
CRC32 C025CC12
ssdeep 96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
Yara
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 08dabdd0b0fb13d5_clip64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
Size 89.0KB
Processes 1964 (rugen.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 83fc14fb36516facb19e0e96286f7f48
SHA1 40082ca06de4c377585cd164fb521bacadb673da
SHA256 08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
CRC32 7E54004B
ssdeep 1536:Uo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUGNaB89p:UoUCWbBNpplToUs1uNhj25LJU6aB89p
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 674d429471335ea8_x7814631.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP000.TMP\x7814631.exe
Size 321.5KB
Processes 2556 (foto175.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4b6effc7be26751e74e3ed110cacf88f
SHA1 6966c64738172de1fa98ba8758b89a5299f6ea84
SHA256 674d429471335ea8d1f20afa1e04289ff4eb935c0335f0056a7cc2b08746d9d3
CRC32 D4898D74
ssdeep 6144:Kiy+bnr+4p0yN90QEwhDpE7X9vYQs0qTITSpPsQrLJ:yMrUy90WhDpKX9vu0qXpUQrLJ
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 587c2fb0cf025a25_cred64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
Size 273.0B
Processes 1964 (rugen.exe)
Type HTML document, ASCII text
MD5 04a943771990ab49147e63e8c2fbbed0
SHA1 a2bde564bef4f63749716621693a3cfb7bd4d55e
SHA256 587c2fb0cf025a255a077b24fe6433fd67bdfac451d74d321d86db96c369841e
CRC32 2C11B08C
ssdeep 6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIR+knacCFEcXaoD:J0+oxBeRmR9etdzRxGezH0qasma+
Yara None matched
VirusTotal Search for analysis