Dropped Files | ZeroBOX

Name	c0338942c380a826_tmp18D6.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp18D6.tmp
Size	1.6KB
Processes	3972 (v0uR2VUI3T3AEij.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`029ece45f6a61b8fa7e1c1750de547fd`
SHA1	`91f8ab8343e708618b4960c15d31a42517cdd6e8`
SHA256	`c0338942c380a826b3fb238644762ca41d8f6f104daa3dbecb9282ca2028367a`
CRC32	`2432DB2A`
ssdeep	`24:2dH4+SEqCH/7IlNMFQ/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBnBtn:cbhf7IlNQQ/rydbz9I3YODOLNdq3d`
Yara	None matched
VirusTotal	Search for analysis

Name	e4b740df6391b7b2_efwtabt.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\eFwTAbT.exe
Size	691.5KB
Processes	3972 (v0uR2VUI3T3AEij.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`cbd3e685f8d7f06aa0ee0f3e184d7523`
SHA1	`4d1823b04314f821359dcacc9c1f212cebc7c717`
SHA256	`e4b740df6391b7b2dc306fc5c05c9416878bba3d6e5fc85017db4c88520c46d5`
CRC32	`71DC57DD`
ssdeep	`12288:eKStVLoMOhM3/qA9zfheKjD9Ylh1Zq99jHWXNP8tIgu7z0SmKJk8thZQMIHr6I:HOXCC9empfjHWdEmx3s+k8nZgt`
Yara	PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check Win32_Trojan_PWS_Azorult_Net_1_Zero - Win32 Trojan PWS .NET Azorult Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
VirusTotal	Search for analysis