Dropped Files | ZeroBOX

Name	7d8f216ba04419aa_clip64.dll Submit file
Filepath	C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
Size	89.0KB
Processes	2712 (danke.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`dc587d08b8ca3cd62e5dc057d41a966b`
SHA1	`0ba6a88377c74a0c53b956d405ad17dd5f8c4164`
SHA256	`7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426`
CRC32	`3DE69A89`
ssdeep	`1536:eo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUiOfaB89p:eoUCWbBNpplToUs1uNhj25LJUpaB89p`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Admin_Tool_IN_Zero - Admin Tool Sysinternals Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	4e1377f9874f333d_danke.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe
Size	224.0KB
Processes	2600 (l1645977.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`8c6b79ec436d7cf6950a804c1ec7d3e9`
SHA1	`4a589d5605d8ef785fdc78b0bf64e769e3a21ad6`
SHA256	`4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d`
CRC32	`4B6E1BAE`
ssdeep	`3072:oTzC4usLP+wOULUFAB3i9nyRA4/Prk3huiPFSbuZRuNcZVKOUm8LHIMbffWtsm3:oTzYsLdf/Rity237PFHRuNcPKOK3+`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description)
VirusTotal	Search for analysis

Name	38c69e3f9f3927f8_cred64.dll Submit file
Filepath	C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
Size	272.0B
Processes	2712 (danke.exe)
Type	HTML document, ASCII text
MD5	`d867eabb1be5b45bc77bb06814e23640`
SHA1	`3139a51ce7e8462c31070363b9532c13cc52c82d`
SHA256	`38c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349`
CRC32	`EAC0AFAB`
ssdeep	`6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIR+knaoyjEcXaoD:J0+oxBeRmR9etdzRxGezH0qaQma+`
Yara	None matched
VirusTotal	Search for analysis