Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	0176db39f9f94491_mta1.exe Submit file
Filepath	C:\ProgramData\sY2NsQjNsETOsATOsIDOsUWOsIWOsMDOsU2NsUWO\MTA1.exe
Size	128.0MB
Processes	2192 (None)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`e898068824d9bfbc9db1fba7e69428ef`
SHA1	`816570c5ed60f2a284ef20d9186437985b6db9d5`
SHA256	`858e76e6ea9c6e00e7194a95a89f489cb2416db950b6794f1eba2ae8e6bb38d6`
CRC32	`03FDC2C4`
ssdeep	`3145728:BCKSv2Uw3dBtMNbBxkd493QnZLr9UzcpeVgA:4eUxBxkdyAnZLr+E0`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check anti_vm_detect - Possibly employs anti-virtualization techniques Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	456b19ba141bbb57_017bd04fb3bf45b681679e8f41ff87bf.json Submit file
Filepath	C:\Users\Public\Documents\017BD04FB3BF45B681679E8F41FF87BF.json
Size	2.2KB
Processes	2192 (None)
Type	ASCII text, with very long lines, with no line terminators
MD5	`1f3abbac864008ff7a183360b0dffb7e`
SHA1	`66adab0d1ddf8fc50c7b76e88fbe9e0f811f921f`
SHA256	`456b19ba141bbb57d2ccc988fa6baa70317fe499445f09b1d1ae5c8bd325d7a8`
CRC32	`644F8466`
ssdeep	`48:YZvuq6Zuff84WtjIq8HiKC2vH/BWOwv0ssShngotVSflFnyDJnkuXsBI:6mq6cVWJIvCdg0sflyX8u`
Yara	None matched
VirusTotal	Search for analysis

Name	f35a3ab4249ed0fc_d93f411851d7c929.customDestinations-ms~RF15e6ee0.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF15e6ee0.TMP
Size	7.8KB
Processes	2800 (powershell.exe) 2928 (powershell.exe)
Type	data
MD5	`80b686136fc02b058ba27bf96435a1f9`
SHA1	`896c28151d80c6b4c9f611cf7cfb77e07076d8fb`
SHA256	`f35a3ab4249ed0fca4182ea63cffb9341cbf645eee23df30b8e2234ba3d5bfb7`
CRC32	`33BB9AA3`
ssdeep	`96:MtuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:MtvXo5tvbHnorrxQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	1eb53c8e5e015549_mta1.exe Submit file
Filepath	C:\ProgramData\sY2NsQjNsETOsATOsIDOsUWOsIWOsMDOsU2NsUWO\MTA1.exe
Size	128.0MB
Processes	2192 (None) 2800 (powershell.exe) 2928 (powershell.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`e898068824d9bfbc9db1fba7e69428ef`
SHA1	`816570c5ed60f2a284ef20d9186437985b6db9d5`
SHA256	`858e76e6ea9c6e00e7194a95a89f489cb2416db950b6794f1eba2ae8e6bb38d6`
CRC32	`03FDC2C4`
ssdeep	`3145728:BCKSv2Uw3dBtMNbBxkd493QnZLr9UzcpeVgA:4eUxBxkdyAnZLr+E0`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check anti_vm_detect - Possibly employs anti-virtualization techniques Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF15e6589.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF15e6589.TMP
Size	7.8KB
Type	data
MD5	`b0c9ff441742f3847ea27da9dee7f2cd`
SHA1	`c42a1eb32ba953a0ce5d8635caabf71b5b281495`
SHA256	`a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4`
CRC32	`0BBCAB1A`
ssdeep	`96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis