Cuckoo Sandbox

Name	a60ee64c3044b411_ywqojgbztr.exe Download Submit file
Filepath	C:\Temp\ywqojgbztr.exe
Size	361.0KB
Processes	2352 (cavsnlfdxvpnifay.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`7328be1326b81975c1632bc662792760`
SHA1	`cafbd5fe02c97dc42e5b09794eff4aec6aa5c819`
SHA256	`a60ee64c3044b411a1109208d51667b25464ae56786843b47188039f62b2eb56`
CRC32	`4DF030BF`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger
VirusTotal	Search for analysis

Name	62b93879619b1318_i_ywqojgbztr.exe Download Submit file
Filepath	C:\Temp\i_ywqojgbztr.exe
Size	361.0KB
Processes	2352 (cavsnlfdxvpnifay.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ce031f5c4f235bd217351ec0b18d2c1a`
SHA1	`f544a1b26ace690f2b8017f05db176a940cd289b`
SHA256	`62b93879619b131801d37b1a1a7bcfb32e9a313987193eead93127634eaebd0f`
CRC32	`EE004E23`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger
VirusTotal	Search for analysis

Dropped Files