Cuckoo Sandbox

Name	37e2ccd1b5ced8b2_zxrpkhcaus.exe Download Submit file
Filepath	C:\Temp\zxrpkhcaus.exe
Size	361.0KB
Processes	1440 (gbytrljdbvtolgey.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`b4ab4df9179017c806c797c87397ae07`
SHA1	`a296498561bec8b6ec5b2559855ccc74d3a34901`
SHA256	`37e2ccd1b5ced8b2355f8e9662ed90bad9c2ebc38c8e919a52153550790c7efc`
CRC32	`FE57348E`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger
VirusTotal	Search for analysis

Name	ec08a7de98f01100_i_zxrpkhcaus.exe Download Submit file
Filepath	C:\Temp\i_zxrpkhcaus.exe
Size	361.0KB
Processes	1440 (gbytrljdbvtolgey.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d154aaa526a579271fa220ac1ee46fba`
SHA1	`427c284ef6a2f2926424b31043466f4a19508360`
SHA256	`ec08a7de98f01100484b532ebda70b0ecc679b178704a19ad59b7ff16b37d768`
CRC32	`56E00C45`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger
VirusTotal	Search for analysis

Dropped Files