popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name c8a0a32a87b9ac69_mta1.exe
Submit file
Filepath C:\ProgramData\sY2NsQjNsETOsATOsIDOsUWOsIWOsMDOsU2NsUWO\MTA1.exe
Size 128.0MB
Processes 940 (None) 2700 (powershell.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c2fc837b4441a4a8e3aa24a0737cc766
SHA1 25383d01284c57ef590fe0673a4e081e24bc1e19
SHA256 6ccff26b9dd047b765a5883ec85332051ab9a09696b91ccefb6c843e6f5179c7
CRC32 72B46A59
ssdeep 3145728:khbcf9/ov5bp/038hM/wGWiIsKMe4JpHx/HHo:kZc1/ov6WjGX0mXno
Yara
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 883aba64e70832be_mta1.exe
Submit file
Filepath C:\ProgramData\sY2NsQjNsETOsATOsIDOsUWOsIWOsMDOsU2NsUWO\MTA1.exe
Size 128.0MB
Processes 940 (None)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c2fc837b4441a4a8e3aa24a0737cc766
SHA1 25383d01284c57ef590fe0673a4e081e24bc1e19
SHA256 6ccff26b9dd047b765a5883ec85332051ab9a09696b91ccefb6c843e6f5179c7
CRC32 72B46A59
ssdeep 3145728:khbcf9/ov5bp/038hM/wGWiIsKMe4JpHx/HHo:kZc1/ov6WjGX0mXno
Yara
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 8f5126f963c6904c_mta1.exe
Submit file
Filepath C:\ProgramData\sY2NsQjNsETOsATOsIDOsUWOsIWOsMDOsU2NsUWO\MTA1.exe
Size 128.0MB
Processes 940 (None)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c2fc837b4441a4a8e3aa24a0737cc766
SHA1 25383d01284c57ef590fe0673a4e081e24bc1e19
SHA256 6ccff26b9dd047b765a5883ec85332051ab9a09696b91ccefb6c843e6f5179c7
CRC32 72B46A59
ssdeep 3145728:khbcf9/ov5bp/038hM/wGWiIsKMe4JpHx/HHo:kZc1/ov6WjGX0mXno
Yara
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF15e1c7a.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF15e1c7a.TMP
Size 7.8KB
Type data
MD5 b0c9ff441742f3847ea27da9dee7f2cd
SHA1 c42a1eb32ba953a0ce5d8635caabf71b5b281495
SHA256 a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4
CRC32 0BBCAB1A
ssdeep 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 456b19ba141bbb57_017bd04fb3bf45b681679e8f41ff87bf.json
Submit file
Filepath C:\Users\Public\Documents\017BD04FB3BF45B681679E8F41FF87BF.json
Size 2.2KB
Processes 940 (None)
Type ASCII text, with very long lines, with no line terminators
MD5 1f3abbac864008ff7a183360b0dffb7e
SHA1 66adab0d1ddf8fc50c7b76e88fbe9e0f811f921f
SHA256 456b19ba141bbb57d2ccc988fa6baa70317fe499445f09b1d1ae5c8bd325d7a8
CRC32 644F8466
ssdeep 48:YZvuq6Zuff84WtjIq8HiKC2vH/BWOwv0ssShngotVSflFnyDJnkuXsBI:6mq6cVWJIvCdg0sflyX8u
Yara None matched
VirusTotal Search for analysis
Name 85ead49a91229409_d93f411851d7c929.customDestinations-ms~RF15e2d43.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF15e2d43.TMP
Size 7.8KB
Processes 2572 (powershell.exe) 2700 (powershell.exe)
Type data
MD5 05fa31b983b19f6a347734594a60ae11
SHA1 f43994533b66047e6779529c30e2105de316850d
SHA256 85ead49a91229409e79cdd1a8c2557ef62d94e4233c4b6e06d2814ddc56cdfce
CRC32 97447EEC
ssdeep 96:bAtuCeGCPDXBqvsqvJCwoeAtuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXoRtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis