popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name ebf4f2d5bbda2186_cred64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\0560249ade67ec\cred64.dll
Size 1.2MB
Processes 2204 (Gxtuum.exe)
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 1b32cdb682dc2b89bab7263aa4f1f08b
SHA1 5cdcc6b59cd71aa379b14792a546e229efa4dd12
SHA256 ebf4f2d5bbda21860684dfeb6f0fa0704c87013096d59cefd89ee48c27ee7ab8
CRC32 AE6FC4E9
ssdeep 24576:ujm1sk9lP6nWZJaIOo/QHtH9YZ0yNJW+6Jslb:Z96nWerAQHB9yjWzi
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name a7a307c332573b2b_clip64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\0560249ade67ec\clip64.dll
Size 127.5KB
Processes 2204 (Gxtuum.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 9730e0bcf27e4265d1be56b8a7767759
SHA1 11af04e5c73de95a2fb4231970a9f145b39cf381
SHA256 a7a307c332573b2bf76edcf53d37e5a91c1fa3a8ce36f720cb10c8c22928f388
CRC32 EDA83938
ssdeep 3072:XeCHM7q++uIwqUjW0uVP0rHv/09aNmw62xm4+5L:O6M7lL5jLuVPaFA5L
Yara
  • Win_Amadey_Zero - Amadey bot
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 9e6e4772050998a5_readme.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\_Files_\readme.txt
Size 10.0B
Type ASCII text, with no line terminators
MD5 eb6b6c90251ab33cee784713c451e6d8
SHA1 451685e9efac4a6dc1fee73ec53ffb6b2c4c38b5
SHA256 9e6e4772050998a5c0dc3c61acf3dab0a7e594566171fa5746d6b62f9598efb6
CRC32 22598B08
ssdeep 3:IS:7
Yara None matched
VirusTotal Search for analysis
Name 3a255c0024916f19_590aee7bdd69b59b.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size 7.8KB
Processes 2864 (powershell.exe)
Type data
MD5 6fd29def73b2779e0ae71c4eecd304f7
SHA1 4ba660e4db856e04eb93a01c59ee764259ec55e7
SHA256 3a255c0024916f19c5b3f5d4aa5cde453cc5d90b0784a15f0456e57e71a764b6
CRC32 1F966CD8
ssdeep 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworDPtDHXyf2lUVul:ctvXo5tvbHnorxTyQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name f2ebbd96f7cf19aa_gxtuum.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\76c5995d57\Gxtuum.exe
Size 549.0KB
Processes 1708 (madey.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 689ff816fc3db38894e81abbdf63c02b
SHA1 aceb8ce81d4724d77a1b3031015f6e60d1139352
SHA256 f2ebbd96f7cf19aa8cc8b1273d1f80169de93ac4dde951ff4547177a11010945
CRC32 4E09271A
ssdeep 12288:MzW5JeQqp6xEWEoiH5KlCrX4FZg40rvM1BCpkLDapAGEhoCXOfNw9lu+eqQoEzwz:MzWCKlCroFWHr6BCCXau7X3pP7
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name ffd56bacf1538c85_gxtuum.job
Submit file
Filepath C:\Windows\Tasks\Gxtuum.job
Size 270.0B
Processes 1708 (madey.exe)
Type VAX-order 68k Blit mpx/mux executable
MD5 7ead222696adbaa737af18ff429a98aa
SHA1 ad40387fdc4c68ff1b54754e49bf80ebd089ec90
SHA256 ffd56bacf1538c856034a34534f0e4885a05ab2fde06bcb19597fd52188d4cf1
CRC32 7B34F025
ssdeep 3:YCQjbytRt//u2sl/nEIduhOEjlpQlyEXlxlXVl5ayQyJBwaKL+rHttCRdk2z0nl+:qeXE/E/UEZ+lX1MDyJJbtI4y0lKut0
Yara None matched
VirusTotal Search for analysis