Resubmissions
12/04/2024, 14:14
240412-rj2vbseb3s 1012/04/2024, 14:03
240412-rcplesea5x 1012/04/2024, 14:02
240412-rcljrsea5v 1012/04/2024, 14:02
240412-rcgwksah98 1012/04/2024, 14:02
240412-rcf92sea5s 812/04/2024, 14:02
240412-rcfzaaah97 1009/04/2024, 06:51
240409-hmh2ysgg99 809/04/2024, 06:50
240409-hmbb4sgg95 809/04/2024, 06:50
240409-hl3pzagg85 1009/04/2024, 06:50
240409-hlwxesgg79 7General
-
Target
a1480e23bd2a89b188fb01138ef2f54130f2dc41ce85ff9319ab7f15471b0011
-
Size
1.9MB
-
Sample
240412-rj2vbseb3s
-
MD5
151e9ec4f0355d2f131b871671bd5e20
-
SHA1
50992f712b281db70518e6d404084e26dcd98b98
-
SHA256
a1480e23bd2a89b188fb01138ef2f54130f2dc41ce85ff9319ab7f15471b0011
-
SHA512
18a2fa6e9c97281328de819126dccb6cc8576e11ea11a8faba629da58e724040427c7d941ce0f935948195c30da6d60a6873d7e3e9613eba7df42bde1a3aba1f
-
SSDEEP
49152:v1r2g+mLqqeaVjSeluJsslFHfjeKgHEaVjsKHzG:drz+OqjXeluJxlFHf6zHj
Malware Config
Extracted
Protocol: ftp- Host:
relokator.no - Port:
21 - Username:
[email protected] - Password:
NyxeByx
Extracted
Protocol: ftp- Host:
relokator.no - Port:
21 - Username:
[email protected] - Password:
MaxMekker
Extracted
Protocol: ftp- Host:
tangeraas.com - Port:
21 - Username:
[email protected] - Password:
tangeraaS1123aadad
Extracted
Protocol: ftp- Host:
tangeraas.com - Port:
21 - Username:
[email protected] - Password:
tangeraas1!!azae2w
Extracted
Protocol: ftp- Host:
tangeraas.com - Port:
21 - Username:
[email protected] - Password:
tangeraas1!!123az19zz
Extracted
Protocol: ftp- Host:
tangeraas.com - Port:
21 - Username:
[email protected]
Extracted
Protocol: ftp- Host:
marchand-knapen.com - Port:
21 - Username:
[email protected]
Extracted
Protocol: ftp- Host:
tangeraas.com - Port:
21 - Username:
postmaster - Password:
tangeraaS1123aadad
Extracted
Protocol: ftp- Host:
tangeraas.com - Port:
21 - Username:
postmaster - Password:
tangeraas1!!azae2w
Extracted
Protocol: ftp- Host:
marchand-knapen.com - Port:
21 - Username:
webmaster
Extracted
Protocol: ftp- Host:
futuria.be - Port:
21 - Username:
[email protected]
Extracted
Protocol: ftp- Host:
futuria.be - Port:
21 - Username:
patrick
Extracted
Protocol: ftp- Host:
marchand-knapen.com - Port:
21 - Username:
admin
Extracted
Protocol: ftp- Host:
artconsultancy.be - Port:
21 - Username:
[email protected]
Extracted
Protocol: ftp- Host:
artconsultancy.be - Port:
21 - Username:
fiona
Extracted
Protocol: ftp- Host:
artconsultancy.be - Port:
21 - Username:
admin
Extracted
Protocol: ftp- Host:
ftp.artconsultancy.be - Port:
21 - Username:
artconsultancy
Extracted
Protocol: ftp- Host:
manitoba.be - Port:
21 - Username:
[email protected]
Targets
-
-
Target
a1480e23bd2a89b188fb01138ef2f54130f2dc41ce85ff9319ab7f15471b0011
-
Size
1.9MB
-
MD5
151e9ec4f0355d2f131b871671bd5e20
-
SHA1
50992f712b281db70518e6d404084e26dcd98b98
-
SHA256
a1480e23bd2a89b188fb01138ef2f54130f2dc41ce85ff9319ab7f15471b0011
-
SHA512
18a2fa6e9c97281328de819126dccb6cc8576e11ea11a8faba629da58e724040427c7d941ce0f935948195c30da6d60a6873d7e3e9613eba7df42bde1a3aba1f
-
SSDEEP
49152:v1r2g+mLqqeaVjSeluJsslFHfjeKgHEaVjsKHzG:drz+OqjXeluJxlFHf6zHj
Score10/10-
Contacts a large (666) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-