popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 0e5cf3ae4da77a64_n8171002.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP004.TMP\n8171002.exe
Size 173.1KB
Processes 2976 (fotod25.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 caa366f8ed39d15d87a1c0dd7fa62b26
SHA1 ae2aa35d68899a8c03ab389bfa1f0b9384d27118
SHA256 0e5cf3ae4da77a64e2496ece4068fd01faa156bec602ba6bdff67cc4566896ff
CRC32 CFF1D0E9
ssdeep 3072:cMC/Huw6uatUGpExN8aOqcJ9Fw/8e8h9:cK1Uef9DFw/
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • MALWARE_Win_VT_RedLine - Detects RedLine infostealer
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • RedLine_Stealer_b_Zero - RedLine stealer
  • PE_Header_Zero - PE File Signature
  • ConfuserEx_Zero - Confuser .NET
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 7d8f216ba04419aa_clip64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
Size 89.0KB
Processes 2788 (danke.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 dc587d08b8ca3cd62e5dc057d41a966b
SHA1 0ba6a88377c74a0c53b956d405ad17dd5f8c4164
SHA256 7d8f216ba04419aae32d5902449a0c5271ed577c722e582fb42e7d43b3b08426
CRC32 3DE69A89
ssdeep 1536:eo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUiOfaB89p:eoUCWbBNpplToUs1uNhj25LJUpaB89p
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 1f345a1671523926_an.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000032051\an.exe
Size 456.0KB
Processes 2788 (danke.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 10e841b7d0bff1a7aa989ebdf7f35976
SHA1 0aef47167e8202c6a2fe2863cf493f3e798b9676
SHA256 1f345a1671523926cf7c62e3f4a85b19a2559a6117519eab5f44aad967072357
CRC32 57DAF96A
ssdeep 6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+E:2uWP/BZUyoLu8Agsmxwrvejkd2
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 65aec89160d3b5fb_fotod25.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000031051\fotod25.exe
Size 390.5KB
Processes 2788 (danke.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 35ee20deda8aa895f1608ebafc14f564
SHA1 86af675636a0bd6d5dacae77ae52a70db69e63fa
SHA256 65aec89160d3b5fb66dcbf68a30b9036d8e5a286e62c9814126d56646217fadd
CRC32 8069DED7
ssdeep 6144:Key+bnr+qp0yN90QEg4WtXJ0gGTlp2qQOw/5H0CcHnlRHitwGi0W9VH/U:qMr2y90OEBTmTOwhHlcHnl9uW9Zs
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 7717b5f9eb7e9015_foto135.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000030051\foto135.exe
Size 389.5KB
Processes 2788 (danke.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 da62c14c61da785a72fccc6938d29828
SHA1 bb7817dc4d59037d9aa942987b7a7c0f5e194545
SHA256 7717b5f9eb7e90158829187d4638c22ab972fa0338e253e849344a3be7ad7081
CRC32 3ED81E09
ssdeep 6144:KKy+bnr+Ip0yN90QE03tQ3dNyVO12awYaH3tL/8bQ925r6buUY6ZT:GMrYy90W3tQVo9dLUs25r6kKT
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 7c1158a7cb049071_j2330856.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP002.TMP\j2330856.exe
Size 173.1KB
Processes 2524 (foto135.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 a2b8538531ebdba481e179728c32feb5
SHA1 9f9e01457e8a75529d68c8f2b50bd9596f4acba9
SHA256 7c1158a7cb049071507966684f34ac02f28f13a248b1bd38a423a52449551d1b
CRC32 442F0010
ssdeep 3072:cMC/Huw6uatUGpExN8aOqcJ9Fw/8e8h9:cK1Uef9DFw/
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • MALWARE_Win_VT_RedLine - Detects RedLine infostealer
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • RedLine_Stealer_b_Zero - RedLine stealer
  • PE_Header_Zero - PE File Signature
  • ConfuserEx_Zero - Confuser .NET
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 4e1377f9874f333d_danke.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe
Size 224.0KB
Processes 2660 (g9947983.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8c6b79ec436d7cf6950a804c1ec7d3e9
SHA1 4a589d5605d8ef785fdc78b0bf64e769e3a21ad6
SHA256 4e1377f9874f333dcb0b1b758e3131949e667fc39aadf3091e4e3b7cdbaeef1d
CRC32 4B6E1BAE
ssdeep 3072:oTzC4usLP+wOULUFAB3i9nyRA4/Prk3huiPFSbuZRuNcZVKOUm8LHIMbffWtsm3:oTzYsLdf/Rity237PFHRuNcPKOK3+
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 276d0340e425ca82_x4582761.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP002.TMP\x4582761.exe
Size 234.5KB
Processes 2524 (foto135.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 16df0dbdc2f32edc646c829c6429401d
SHA1 08d899486b69db3cb84f883bf939b8f2323cd371
SHA256 276d0340e425ca826f4ffdec275a5644eb042a7aa568ed00bb53e1265ef69500
CRC32 BC730C5F
ssdeep 3072:KKy+bnr+O105GWp1icKAArDZz4N9GhbkrNEk1XcobU3btQutRCIuN75Xo4A+e2oD:KKy+bnr+np0yN90QEhbiPX2
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 38c69e3f9f3927f8_cred64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
Size 272.0B
Processes 2788 (danke.exe)
Type HTML document, ASCII text
MD5 d867eabb1be5b45bc77bb06814e23640
SHA1 3139a51ce7e8462c31070363b9532c13cc52c82d
SHA256 38c69e3f9f3927f8178d55cde9774a2b170c057b349b73932b87b76499d03349
CRC32 EAC0AFAB
ssdeep 6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIR+knaoyjEcXaoD:J0+oxBeRmR9etdzRxGezH0qaQma+
Yara None matched
VirusTotal Search for analysis
Name 7b1ab53b1707c25e_y3722656.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP004.TMP\y3722656.exe
Size 235.0KB
Processes 2976 (fotod25.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 199709ce1684016751be718577e511b2
SHA1 0f1893d7cd5fea2957efc666fa0733275ce72ada
SHA256 7b1ab53b1707c25e97659d8393894d665ccca2db356f8e2fa856800bdff63b6e
CRC32 B3D50275
ssdeep 6144:KOy+bnr+Rp0yN90QEchQmyJXNcrGFySYCcHnlRHw5:KMrFy902C+rGYYcHnl9G
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
VirusTotal Search for analysis