Dropped Files | ZeroBOX

Name	02ff75101c0d1ceb_VixenLoader.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\VixenLoader.exe
Size	226.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`9e02078809cf34479e5108fca383862c`
SHA1	`d82926214ea6cc5f1f162eb526a0a54a5b4068b3`
SHA256	`02ff75101c0d1cebbc3b45196cb87634af88447fbd7fca2ffe76a21f1d2be703`
CRC32	`E5E91829`
ssdeep	`3072:mB1CpVNo50OBkVeHv/dxEHBAnpK37nX88d00sQ7C6PsM74tyJhnGKeXIorPPIDmS:bNk0ekA3d18/Y6P9GXZXD+Kyh`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Antivirus - Contains references to security software NorthKorea_Zero - Maybe it's North Korea File Is_DotNET_EXE - (no description) IsPE32 - (no description)
VirusTotal	Search for analysis

Name	3a255c0024916f19_590aee7bdd69b59b.customDestinations-ms~RF1f0e39d.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1f0e39d.TMP
Size	7.8KB
Processes	2600 (powershell.exe) 2792 (powershell.exe)
Type	data
MD5	`6fd29def73b2779e0ae71c4eecd304f7`
SHA1	`4ba660e4db856e04eb93a01c59ee764259ec55e7`
SHA256	`3a255c0024916f19c5b3f5d4aa5cde453cc5d90b0784a15f0456e57e71a764b6`
CRC32	`1F966CD8`
ssdeep	`96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworDPtDHXyf2lUVul:ctvXo5tvbHnorxTyQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	025bbf02325ee28b_tmpE248.tmp.bat Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmpE248.tmp.bat
Size	165.0B
Processes	884 (VixenLoader.exe) 3024 (cmd.exe)
Type	DOS batch file, ASCII text, with CRLF line terminators
MD5	`15224e38e6f6b75e7511c9d64b2f4219`
SHA1	`3260967c31b1f4ab32fe9be432ce4e01c5c402d9`
SHA256	`025bbf02325ee28b217968e8e2c273a30cf2d6ae8d0f872f34f329b42f943c51`
CRC32	`D48CC4B4`
ssdeep	`3:mKDDCMNqTtv3DmWxpcL4E2J5xAIJzxLN/rDwU1hGDmWxpcL4E2J5xAInTRIKX78+:hWKqTtLmQpcLJ23fJtVrDNemQpcLJ23F`
Yara	None matched
VirusTotal	Search for analysis