Cuckoo Sandbox

Name	a0f14e25e6c0828b_backup.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
Size	172.5KB
Processes	1368 (e0422dc09f2d8d03_backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`c2e1738c5251ff8252039e5a34256415`
SHA1	`25a34281ac282664607ebbbfe32ed469ed55a1d4`
SHA256	`a0f14e25e6c0828bd5968f9590721959ae28bf893d965369e5deaae33227cca5`
CRC32	`49DC17ED`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Name	9b33a431a17a90b0_backup.exe Download Submit file
Filepath	C:\backup.exe
Size	172.5KB
Processes	2020 (backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`7963b2da69afe7dcb8e5f1894129cce1`
SHA1	`cbeea16f6aee3cd33357c4565ba852f6c342ba0c`
SHA256	`9b33a431a17a90b0b587c790f98d63c32f9e648ce38f7bcdbe0bc39b79016133`
CRC32	`960A3253`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Dropped Files