Overview

overview

10

Static

static

3

7236bb718d...fd.exe

windows10-2004-x64

10

7236bb718d...fd.exe

windows7-x64

7

7236bb718d...fd.exe

windows10-1703-x64

10

7236bb718d...fd.exe

windows10-2004-x64

8

7236bb718d...fd.exe

windows11-21h2-x64

8

Resubmissions

07/05/2024, 08:33

240507-kfwqksgf3w 10

07/05/2024, 08:32

240507-kfe3tsbe24 7

07/05/2024, 08:32

240507-kfegasge9w 10

07/05/2024, 08:32

240507-kfc88sge9v 10

07/05/2024, 08:32

240507-kfcygage9t 10

25/04/2024, 13:04

240425-qa283aba79 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7236bb718d297a7a2c78632a5266e52328ca3bff74a0c752a6bac5dd878d61fd

  • Size

    1.9MB

  • Sample

    240507-kfwqksgf3w

  • MD5

    835a3277aff20c1249960ee0951f0cd6

  • SHA1

    8814d4127a016de51bdfd65fa873d2738012dc52

  • SHA256

    7236bb718d297a7a2c78632a5266e52328ca3bff74a0c752a6bac5dd878d61fd

  • SHA512

    369118dfb79c60878acdd7a0412cccb47158aa5e568741d1533e0bfd3f87fa3a0c1f6f3cf99ab8b66e9746f004c7af6ce3e442ec93de00cdf68022d2ad788d7b

  • SSDEEP

    49152:H9+v9qBhn3hRk9XkSxV4QFTNXopKJe8FtU+0:dwqBZTk9X7bFTSphIK

Score
10/10
discoverypersistenceupx

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ffsolucoes.net.br
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    ffacesso2018**

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.rosskopf-simon.de
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    Ludacris93

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.rosskopf-simon.de
  • Port:
    21
  • Username:
    admin
  • Password:
    Ludacris93

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    szucsiskola.hu
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    Augusztus16

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    szucsiskola.hu
  • Port:
    21
  • Username:
    biro.barnabas.1992
  • Password:
    Augusztus16

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    szucsiskola.hu
  • Port:
    21
  • Username:
    admin
  • Password:
    Augusztus16

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    szucsiskola.hu
  • Port:
    21
  • Username:
    szucsiskola
  • Password:
    Augusztus16

Extracted

Credentials

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    huepfburgverleih-leipzig.de
  • Port:
    21
  • Username:
    buchhaltung

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    huepfburgverleih-leipzig.de
  • Port:
    21
  • Username:
    admin

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    huepfburgverleih-leipzig.de
  • Port:
    21
  • Username:
    huepfburgverleih-leipzig

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.hitsro.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    xxNarnia087

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.hitsro.com
  • Port:
    21
  • Username:
    yasuka
  • Password:
    xxNarnia087

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.hitsro.com
  • Port:
    21
  • Username:
    admin
  • Password:
    xxNarnia087

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.hitsro.com
  • Port:
    21
  • Username:
    hitsro
  • Password:
    xxNarnia087

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    grupovertical.cl
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    Gvchile7299

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    www.grupovertical.cl
  • Port:
    21
  • Username:
    igonzalez
  • Password:
    Gvchile7299

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    www.grupovertical.cl
  • Port:
    21
  • Username:
    admin
  • Password:
    Gvchile7299

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    www.grupovertical.cl
  • Port:
    21
  • Username:
    grupovertical
  • Password:
    Gvchile7299

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.karmaelektronik.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    3593

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.karmaelektronik.com
  • Port:
    21
  • Username:
    info
  • Password:
    3593

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.karmaelektronik.com
  • Port:
    21
  • Username:
    admin
  • Password:
    3593

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.karmaelektronik.com
  • Port:
    21
  • Username:
    karmaelektronik
  • Password:
    3593

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    sisilispecialized.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    8qgBg5a5uH76ZvT

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    sisilispecialized.com
  • Port:
    21
  • Username:
    shirantha
  • Password:
    8qgBg5a5uH76ZvT

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    sisilispecialized.com
  • Port:
    21
  • Username:
    admin
  • Password:
    8qgBg5a5uH76ZvT

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    sisilispecialized.com
  • Port:
    21
  • Username:
    sisilispecialized
  • Password:
    8qgBg5a5uH76ZvT

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    arcfood.fr
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    25fev3029

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    arcfood.fr
  • Port:
    21
  • Username:
    gwendoline.marsy
  • Password:
    25fev3029

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    arcfood.fr
  • Port:
    21
  • Username:
    admin
  • Password:
    25fev3029

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    arcfood.fr
  • Port:
    21
  • Username:
    arcfood
  • Password:
    25fev3029

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.arcfood.fr
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    25fev3029

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.arcfood.fr
  • Port:
    21
  • Username:
    gwendoline.marsy
  • Password:
    25fev3029

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.arcfood.fr
  • Port:
    21
  • Username:
    admin
  • Password:
    25fev3029

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.arcfood.fr
  • Port:
    21
  • Username:
    arcfood
  • Password:
    25fev3029

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.cfd.nu.edu.pk
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    Vlxx

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.cfd.nu.edu.pk
  • Port:
    21
  • Username:
    f899090
  • Password:
    Vlxx

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.cfd.nu.edu.pk
  • Port:
    21
  • Username:
    admin
  • Password:
    Vlxx

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.cfd.nu.edu.pk
  • Port:
    21
  • Username:
    cfd
  • Password:
    Vlxx

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ilhancaylak.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    897917

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ilhancaylak.com
  • Port:
    21
  • Username:
    msn
  • Password:
    897917

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ilhancaylak.com
  • Port:
    21
  • Username:
    admin
  • Password:
    897917

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ilhancaylak.com
  • Port:
    21
  • Username:
    ilhancaylak
  • Password:
    897917

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.ilhancaylak.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    897917

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.ilhancaylak.com
  • Port:
    21
  • Username:
    msn
  • Password:
    897917

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.ilhancaylak.com
  • Port:
    21
  • Username:
    admin
  • Password:
    897917

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.ilhancaylak.com
  • Port:
    21
  • Username:
    ilhancaylak
  • Password:
    897917

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    sonycapitals.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    sONY

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.geometralissana.it
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    Lissana0922

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.geometralissana.it
  • Port:
    21
  • Username:
    lissana
  • Password:
    Lissana0922

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.geometralissana.it
  • Port:
    21
  • Username:
    admin
  • Password:
    Lissana0922

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.geometralissana.it
  • Port:
    21
  • Username:
    geometralissana
  • Password:
    Lissana0922

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    jhc-informatica.es
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    87X772f1YLVT3

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    jhc-informatica.es
  • Port:
    21
  • Username:
    info
  • Password:
    87X772f1YLVT3

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    jhc-informatica.es
  • Port:
    21
  • Username:
    admin
  • Password:
    87X772f1YLVT3

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    jhc-informatica.es
  • Port:
    21
  • Username:
    jhc-informatica
  • Password:
    87X772f1YLVT3

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.sonycapitals.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    sONY

Extracted

Credentials

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    punjabeducation.gov.in
  • Port:
    21
  • Username:
    deose.fazilka

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    punjabeducation.gov.in
  • Port:
    21
  • Username:
    admin

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    punjabeducation.gov.in
  • Port:
    21
  • Username:
    punjabeducation

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.srmist.edu.in
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    ccc

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.srmist.edu.in
  • Port:
    21
  • Username:
    np9987
  • Password:
    ccc

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.srmist.edu.in
  • Port:
    21
  • Username:
    admin
  • Password:
    ccc

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.srmist.edu.in
  • Port:
    21
  • Username:
    srmist
  • Password:
    ccc

Extracted

Credentials

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.qsa.ca
  • Port:
    21
  • Username:
    don
  • Password:
    QSA

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.qsa.ca
  • Port:
    21
  • Username:
    admin
  • Password:
    QSA

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.qsa.ca
  • Port:
    21
  • Username:
    qsa
  • Password:
    QSA

Extracted

Credentials

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    28as.com
  • Port:
    21
  • Username:
    yitikol377
  • Password:
    Yr7

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    28as.com
  • Port:
    21
  • Username:
    admin
  • Password:
    Yr7

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    28as.com
  • Port:
    21
  • Username:
    28as
  • Password:
    Yr7

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    studiolevaservizi.it
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    Jacopo8908

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    studiolevaservizi.it
  • Port:
    21
  • Username:
    info
  • Password:
    Jacopo8908

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    studiolevaservizi.it
  • Port:
    21
  • Username:
    admin
  • Password:
    Jacopo8908

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    studiolevaservizi.it
  • Port:
    21
  • Username:
    studiolevaservizi
  • Password:
    Jacopo8908

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.studiolevaservizi.it
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    Jacopo8908

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.studiolevaservizi.it
  • Port:
    21
  • Username:
    info
  • Password:
    Jacopo8908

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.studiolevaservizi.it
  • Port:
    21
  • Username:
    admin
  • Password:
    Jacopo8908

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.studiolevaservizi.it
  • Port:
    21
  • Username:
    studiolevaservizi
  • Password:
    Jacopo8908

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    marsrobotic.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    Amerz89

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    marsrobotic.com
  • Port:
    21
  • Username:
    amerz
  • Password:
    Amerz89

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    marsrobotic.com
  • Port:
    21
  • Username:
    admin
  • Password:
    Amerz89

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    marsrobotic.com
  • Port:
    21
  • Username:
    marsrobotic
  • Password:
    Amerz89

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.marsrobotic.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    Amerz89

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.marsrobotic.com
  • Port:
    21
  • Username:
    amerz
  • Password:
    Amerz89

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.marsrobotic.com
  • Port:
    21
  • Username:
    admin
  • Password:
    Amerz89

Targets

    • Target

      7236bb718d297a7a2c78632a5266e52328ca3bff74a0c752a6bac5dd878d61fd

    • Size

      1.9MB

    • MD5

      835a3277aff20c1249960ee0951f0cd6

    • SHA1

      8814d4127a016de51bdfd65fa873d2738012dc52

    • SHA256

      7236bb718d297a7a2c78632a5266e52328ca3bff74a0c752a6bac5dd878d61fd

    • SHA512

      369118dfb79c60878acdd7a0412cccb47158aa5e568741d1533e0bfd3f87fa3a0c1f6f3cf99ab8b66e9746f004c7af6ce3e442ec93de00cdf68022d2ad788d7b

    • SSDEEP

      49152:H9+v9qBhn3hRk9XkSxV4QFTNXopKJe8FtU+0:dwqBZTk9X7bFTSphIK

    Score
    10/10
    discoverypersistenceupx

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Contacts a large (1272) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3behavioral4behavioral5

MITRE ATT&CK Enterprise v15

Tasks