Cuckoo Sandbox

Name	af0f3ae48316850a_hbztrmjecw.exe Download Submit file
Filepath	C:\Temp\hbztrmjecw.exe
Size	361.0KB
Processes	1992 (gaysqlidbvtnlfdy.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`18faf8d2f3ca077389ebc86952c36dbd`
SHA1	`0e053d870f63ac5b05ef867f9bddddd27ad4623a`
SHA256	`af0f3ae48316850a10258161d9ded6899178b6e43bc53eaf5fe5431b7e0e731d`
CRC32	`41F7A195`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger
VirusTotal	Search for analysis

Name	07f0cc57aa77cca7_i_hbztrmjecw.exe Download Submit file
Filepath	C:\Temp\i_hbztrmjecw.exe
Size	361.0KB
Processes	1992 (gaysqlidbvtnlfdy.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`0fb7fda76581a906459c5ca2656ec0ec`
SHA1	`15520cbcd700ebb7175c5bc2804b94517e88430f`
SHA256	`07f0cc57aa77cca7c5a6da3bcfc172de90fec97d34f8b01acf577149e6b4d0c9`
CRC32	`D4110E3B`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger
VirusTotal	Search for analysis

Dropped Files