Cuckoo Sandbox

Name	0b606791b6ee44a0_backup.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
Size	172.5KB
Processes	1792 (ac33ea9ad9388571_backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`4af9ed96c309484ae5e3aa479cda1958`
SHA1	`841a388fcad3804e044918d71d8dc469bdea3c86`
SHA256	`0b606791b6ee44a0f19b3236394987845627c3531b0da3dd58a26b8679dbe552`
CRC32	`162E4E49`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Name	cdeabf81628ff855_backup.exe Download Submit file
Filepath	C:\backup.exe
Size	172.5KB
Processes	896 (backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`795399791d995592a97318afbcef8db1`
SHA1	`db639d2e8aa9fba0a2678f6cd33ef974fa06256b`
SHA256	`cdeabf81628ff855e7714fa37c603710ade6fb0452737ca3dc1eeab9424be8f3`
CRC32	`2466DDEE`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Dropped Files