Cuckoo Sandbox

Name	b15224e967ea7d61_mhfzxrpjhc.exe Download Submit file
Filepath	C:\Temp\mhfzxrpjhc.exe
Size	361.0KB
Processes	2912 (ljdbvtnlgdywqoig.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`4c1f28c898950d1866b95ed43e1b3237`
SHA1	`03b966d82e33b852875f889ab0c8cda04b68b8a1`
SHA256	`b15224e967ea7d61cd637fc03a4f3f35133de950ddaf90b5b2850d1c0ad96c81`
CRC32	`91A1885D`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger
VirusTotal	Search for analysis

Name	6be81914ca749ba4_i_mhfzxrpjhc.exe Download Submit file
Filepath	C:\Temp\i_mhfzxrpjhc.exe
Size	361.0KB
Processes	2912 (ljdbvtnlgdywqoig.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`1d914404dad0cd0de2f318883da44454`
SHA1	`ed53fe778add688971aa9f2fc9b275f7d973b638`
SHA256	`6be81914ca749ba497c5acddb68a87cfdb4365c71196e7d41b9e58696ab97ca3`
CRC32	`1776A401`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger
VirusTotal	Search for analysis

Dropped Files