Dropped Files | ZeroBOX

Name	869705fd4dd777d4_kimsuky_xls.lnk Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\kimsuky_xls.lnk
Size	31.3KB
Type	MS Windows shortcut, Has Description string, Has command line arguments, Icon number=0, ctime=Sun Dec 31 15:32:08 1600, mtime=Sun Dec 31 15:32:08 1600, atime=Sun Dec 31 15:32:08 1600, length=0, window=hidenormalshowminimized
MD5	`a9b1c04438930c0c7cff3fe8e8520317`
SHA1	`6f5259f7087cc501d776f28bede938e6134e4615`
SHA256	`869705fd4dd777d4ab5c662806b42fe43bff6b58e085a64804486326b35fee47`
CRC32	`AA39D45D`
ssdeep	`384:doJ9X+vCziJp41cxdT+BAJvnkOddyQ7gCJ3t1rXG/I+1A:d8uK1MQAJbA6/lXT+1A`
Yara	Antivirus - Contains references to security software lnk_file_format - Microsoft Windows Shortcut File Format Lnk_Format_Zero - LNK Format Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	a9b1dc8eaa5fcd00_d93f411851d7c929.customdestinations-ms Submit file
Filepath	c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size	7.8KB
Processes	2420 (powershell.exe)
Type	data
MD5	`c1d8708bab1e838a2deda26d58bb8d42`
SHA1	`95d39e75a804752961c139bb6c0b67f84f685035`
SHA256	`a9b1dc8eaa5fcd0034694cf9742ae915a5932142a1477c3ab6fada45d98750b2`
CRC32	`E71AF2A2`
ssdeep	`96:QtuC6GCPDXBqvsqvJCwoFtuC6GCPDXBqvsEHyqvJCworFS7HwxWlUVul:QtbXoFtbbHnor/xo`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis