Extracted

• • Target

    FileZilla_3.67.0_win64_sponsored2-setup.exe

  • Size

    12.2MB

  • MD5

    e4acf0e303e9f1371f029e013f902262

  • SHA1

    180f686f2afe1ad0ac6f3498e70af910fcbce620

  • SHA256

    9be2103d3418d266de57143c2164b31c27dfa73c22e42137f3fe63a21f793202

  • SHA512

    fcf7ae7c539b199446085337173cee8ce61cda86b8defc46b008ff487563da33adfdaf45bc78b2b75aaa9785323c5391969f93d38a3f52919dc45f38d7adf2fc

  • SSDEEP

    393216:9A0WSaIgUnOIJAqcFzXqvbyz7UWVompJJHU5ccGW2IV3:9A3JIuZbUMTHGWWJ5

  Score

  10^/10

  bootkitdiscoveryevasionpersistencespywarestealertrojan

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Checks whether UAC is enabled

    evasiontrojan

  • Downloads MZ/PE file

  • Modifies Installed Components in the registry

    persistence

  • Sets file execution options in registry

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1