Cuckoo Sandbox

Name	ac33ea9ad9388571_backup.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
Size	172.5KB
Processes	1352 (3c0400247d6bf95850aba0dfad6e2b8bca65afafa0c33547466913007e8d4c36.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`f5245b23cf537f4be7bf9d823098e429`
SHA1	`3b40cea5734a1be4f5cc18d218fe1b05f0a22144`
SHA256	`ac33ea9ad9388571111b1202c0dad9cb1e11a1dfa68f4dace2ad03ef08cb2111`
CRC32	`5677F046`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Name	645028c193bd4908_backup.exe Download Submit file
Filepath	C:\backup.exe
Size	172.5KB
Processes	544 (backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`f3137bf18f9404bcf77e0dd2bb549843`
SHA1	`27c0350372f76a988deb57cf55848b65869f4223`
SHA256	`645028c193bd4908e17045d50de81db0ff9e059682d09332a564d2b43a107c15`
CRC32	`394132CE`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Dropped Files