Dropped Files | ZeroBOX
Name 899a421c56c18058_app
Submit file
Filepath C:\Users\test22\AppData\Roaming\app
Size 5.0B
Processes 1648 (newest.exe) 2224 (server.exe)
Type UTF-8 Unicode (with BOM) text, with no line terminators
MD5 b66e20886f9675fe4dbf430ea2d0bf8d
SHA1 2e676da72201e6e4482e00b300511900c6aee5a0
SHA256 899a421c56c18058cbdd16dd7fb313a57d36c1189ca0f442070ed01d17241414
CRC32 BA658239
ssdeep 3:Zn:Z
Yara None matched
VirusTotal Search for analysis
Name 984c7149b8a948d4_Microsoft.exe
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe
Size 93.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 173883b31d172e5140f98fd0e927ff10
SHA1 1e477ebc749e1ef65c820cfb959d96ffc058b587
SHA256 984c7149b8a948d4fb3b5c50f8f006206a985841203f647d66b0880e56a55e08
CRC32 96F2AF8B
ssdeep 1536:XFJGER1tMnnwlOU5oTRKwjEwzGi1dDsKngS:XFJMnnwlOUWT0hi1dzg
Yara
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 711a6108ba2ce6ca_fransescopast.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\FransescoPast.txt
Size 6.0B
Processes 1648 (newest.exe) 2224 (server.exe)
Type ASCII text, with no line terminators
MD5 3905d7917f2b3429490b01cfb60d8f5b
SHA1 f78a71af8bbf8cc2f6f313549d4da14bd3771359
SHA256 711a6108ba2ce6ca93dd47d6817f2361db10d8ab6eec89460b2dfc2c325efabe
CRC32 873586F3
ssdeep 3:IA:9
Yara None matched
VirusTotal Search for analysis
Name f87e55f1a423b65f_autorun.inf
Submit file
Filepath C:\autorun.inf
Size 55.0B
Processes 2224 (server.exe)
Type Microsoft Windows Autorun file, ASCII text, with CRLF line terminators
MD5 40b1630be21f39cb17bd1963cae5a207
SHA1 63c14bd151d42820dd45c033363fa5b9e1d34124
SHA256 f87e55f1a423b65fd639146f71f6027dbd4d6e69b65d9a17f1744774aa6589e1
CRC32 903049B1
ssdeep 3:It1KV2PHQCyK0x:e1KAwCyD
Yara None matched
VirusTotal Search for analysis