General
-
Target
e6df60c235ce89a2d376b3708f8565e0c045020d08e0883ab726bebcd09086ba
-
Size
1.9MB
-
Sample
240416-rebgksde3x
-
MD5
7fd0e978ae68613a96a07194d82ff058
-
SHA1
25347be4f94a784cb261229109261aba61853308
-
SHA256
e6df60c235ce89a2d376b3708f8565e0c045020d08e0883ab726bebcd09086ba
-
SHA512
d8e17eb7737eb4469e19442769c74a4f25d44c75e53c1ff9483b3e76cd93ebb0dc530b3c6e6eed6753186bdff2c1c7af3d170ac69d1a8ca21f949fcdda7daa5e
-
SSDEEP
24576:8aptmBr8CsPIejX7NsxexfMOSUH2XydxRY18S55ysdCG7QQdhph8BwvyM86:JmBr8JPxDH2XydxRY/5bdN7QQ8BWyX6
Malware Config
Extracted
Protocol: ftp- Host:
uploadcloud.pro - Port:
21 - Username:
[email protected] - Password:
4002300
Extracted
Protocol: ftp- Host:
uploadcloud.pro - Port:
21 - Username:
dodoyo - Password:
4002300
Extracted
Protocol: ftp- Host:
kimzongyool.com - Port:
21 - Username:
[email protected] - Password:
dkxmzla1244!
Extracted
Protocol: ftp- Host:
www.kimzongyool.com - Port:
21 - Username:
artkim0725 - Password:
dkxmzla1244!
Targets
-
-
Target
e6df60c235ce89a2d376b3708f8565e0c045020d08e0883ab726bebcd09086ba
-
Size
1.9MB
-
MD5
7fd0e978ae68613a96a07194d82ff058
-
SHA1
25347be4f94a784cb261229109261aba61853308
-
SHA256
e6df60c235ce89a2d376b3708f8565e0c045020d08e0883ab726bebcd09086ba
-
SHA512
d8e17eb7737eb4469e19442769c74a4f25d44c75e53c1ff9483b3e76cd93ebb0dc530b3c6e6eed6753186bdff2c1c7af3d170ac69d1a8ca21f949fcdda7daa5e
-
SSDEEP
24576:8aptmBr8CsPIejX7NsxexfMOSUH2XydxRY18S55ysdCG7QQdhph8BwvyM86:JmBr8JPxDH2XydxRY/5bdN7QQ8BWyX6
Score10/10-
Contacts a large (796) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-