Cuckoo Sandbox

Name	4678bb2d7a765b70_backup.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
Size	92.3KB
Processes	2292 (8babfc01353771b7a3400de78649bc2e8a1d809cfea80bf63cd9d46a49c3f56b.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`a8c2d370d6b3be78de176732c1aa8bcf`
SHA1	`5365bca7a8fa10554c63f2102afe684c894ad738`
SHA256	`4678bb2d7a765b70171345d004df073bc6014187f18394d4603ea2d305bd2bf7`
CRC32	`026DC45A`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Name	b5152728d0ad47d0_backup.exe Download Submit file
Filepath	C:\backup.exe
Size	92.3KB
Processes	1852 (backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`453a4941b06424729dda0917700a0673`
SHA1	`903c509acb513edf2d778c6b0405b71768302bdd`
SHA256	`b5152728d0ad47d0589b11812a1be9244d3c0093f5c4c2f277a532c93caf30d5`
CRC32	`36559EBC`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Dropped Files