dbde8a4bd71bb1fbc0511cdb657dfeffdaedc513aa425f856043532a7cba6fce

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Win32.Application.Agent.61JFNV.12324.16148.exe
Size 12.2MB
Sample240604-qsc2wshb61
SHA256 dbde8a4bd71bb1fbc0511cdb657dfeffdaedc513aa425f856043532a7cba6fce
MD5 861c54a22491b35880f4ec629cfd699f
SHA1 71a32e0d99f6d6a36770bf60686c4ac04eb9d70c
SHA512 e34d2a9769bc03f87851b81a88bdb1edbff17725170f6b50bde12a3eb092b221b685160b3b979ca77d249172d2137e7ac9463f2fd8b86296bdd1fa0841a9783c
SSDEEP 393216:TAJ8PZ1g/3inKFsdoSpsK1RVryLx9FPeN:TAJ8P8/yKF+oSpsKPtux9teN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  SecuriteInfo.com.Win32.Application.Agent.61JFNV.12324.16148.exe
- Size 12.2MB
- SHA256 dbde8a4bd71bb1fbc0511cdb657dfeffdaedc513aa425f856043532a7cba6fce
- MD5 861c54a22491b35880f4ec629cfd699f
- SHA1 71a32e0d99f6d6a36770bf60686c4ac04eb9d70c
- SHA512 e34d2a9769bc03f87851b81a88bdb1edbff17725170f6b50bde12a3eb092b221b685160b3b979ca77d249172d2137e7ac9463f2fd8b86296bdd1fa0841a9783c
- SSDEEP 393216:TAJ8PZ1g/3inKFsdoSpsK1RVryLx9FPeN:TAJ8P8/yKF+oSpsKPtux9teN
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 110545415a59402635e1c9439acba15b44bab268ed02ad2a262ce12604a47855
- MD5 a8c86996c4230c2209f5927f21321377
- SHA1 45ce0ab93cb6a3a594e54878cce05df724024393
- SHA512 69ee73496b916777936b0dddd2cc4a4f916e393f7d0b167cba77a4a239ee1e3f645d9b90dee1627c42a23eb6c3403e4d086546b9f78b3a2e4999c8f92f6a3bc3
- SSDEEP 96:mIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/23lkCTcaqHCI:bhE+A0+sF6piUFkAylncviI
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 4913d4cccf84cd0534069107cff3e8e2f427160cad841547db9019310ac86cc7
- MD5 d458b8251443536e4a334147e0170e95
- SHA1 ba8d4d580f1bc0bb2eaa8b9b02ee9e91b8b50fc3
- SHA512 6ff523a74c3670b8b5cd92f62dcc6ea50b65a5d0d6e67ee1079bdb8a623b27dd10b9036a41aa8ec928200c85323c1a1f3b5c0948b59c0671de183617b65a96b1
- MD5 SHA1 SHA512
Score

3^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
- MD5 1d8f01a83ddd259bc339902c1d33c8f1
- SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
- SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
- SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsis_appid.dll
- Size 3KB
- SHA256 e9e1ba410636698d666b328eea71346b8287248d262e44da07ce8b5fa24c5e5f
- MD5 19071761e91c43c115a16b52458869b7
- SHA1 75ddb807157f1aa31a08f87be0270f60990bcbbc
- SHA512 bc0eab51cf27f657cd3fd62a47894ee13f3f561feaa565f16ba15088be39be73c9839a3cf35b538219ec83a03d48970b89258c5f20c37bcaf76438998437786c
- MD5 SHA1 SHA512
Score

3^/10
behavioral15 behavioral16
- Target
  $R0
- Size 33KB
- SHA256 b425a8e076dfccf9245d724d3a228500bf128aea9fb24795ee3c6020d2e9df6a
- MD5 d02454e5e342d3f825b57137aa92a345
- SHA1 6dbbf9164a54963198affcbf4c5928fdd29afd99
- SHA512 625ab607ce7c5e56a29ce9a8eef9dae0d92fc8ac947bb074ea8ad14bb40a6bb79d72c53f4c99a13e6dcd8054fdb95f0b93abcc246442bcccdf82168938e6d63a
- SSDEEP 768:82/5ZWpdwrGUxnyiehH/kZjGyxUUyg8GENAMx49:zBZWpvWaGj7UjNXxM
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  $R2/NSIS.Library.RegTool.v3.$_106_.exe
- Size 5KB
- SHA256 fc6f7befdd834ccf59aa660497f197d85776f3d95736337d1b9f4417e1db8d6e
- MD5 48b4f7d95dbff3dfc74fe3d9e41524b8
- SHA1 7bfc27a6eac4796029e841f9d5a61d37de6b34be
- SHA512 c51d21f3d76d915086324ecaf54f6da7b4fcd2aec9161812fde63e70f6aa1b30709cc6ae5d30abfcfe9141edd6e9e44d49de83a06753cbc5d37ad0d658cc740d
- SSDEEP 96:qBg4ARDDMDQB4dtVfhxr+qOspqME3zpHC5:isDDcQWd/hxaq/sMsC5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  $_36_
- Size 947KB
- SHA256 6872cf401483b46c9b0456f676cc6f7e810fe11b7831567b187c6228ec4c0857
- MD5 610f4eb991ae0db08785dc4a6c1b1fb2
- SHA1 0b28c35f1569eec2dd1cd6c8cfdabb349f6e0866
- SHA512 327647555d35f4dcf567579c4750299d8fe8ead866bfc304efd7f2b855bfd659da407c344c8077041310e214d0395d2f0c85c7d504ecf0403b970aca72496f7a
- SSDEEP 24576:Wo6hPUFdvQDqO6gNuSzRsK9WPIOg3Gm39ZJ4N9RMe:WNPUfYDqkWPIOg3Gm39ZJMRMe
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  GPL.html
- Size 15KB
- SHA256 f7e89c1edbbef8bc837b47c48113a2416f1af0cfc2b2218da39085465ea1045c
- MD5 11e176c5e0120ee94e365f999084bce8
- SHA1 a612f6d40d0d2ae045d80b60bce6fb6f81a811ef
- SHA512 d0532df4fe5e995df49f3e58127f5fc9637fc4f1afbb29e92ad16897c1055f77963277f5143458b9a294d1c24559bc594e0ae5469271ece639c8e66a5555d5a3
- SSDEEP 192:tiMUzQS+LrQWJz6Z6q6pdPIK8kV6AWRzdbDaz0pmN1rMbkBJ9R8/CmBHf3KWkc:tZUz5irJq6jIuV6fRzd3c0pmbMCzRLw7
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  filezilla.exe
- Size 4.0MB
- SHA256 f23586077288f615dbc1bacf7b1ebbe4ae266d2e0e1e2b4bc2961762102719f7
- MD5 4851a345bfe906884e0aa95eaefd2a99
- SHA1 3ee4d00880c523a8de9aa2919c45ca36e45a5788
- SHA512 437443490c76ae0dfcd3654e43fd86bd037e261ab4e1457a4eab8dfd0dd80173dfb11536ca2af6fa4d75fb0413793b97158f347778b7d79e2796416ec2bf1499
- SSDEEP 49152:pukt9OFd6BI2qQkt1B5LP8/QJBt9wyuaG7QI7UhQ0es5DIWhyR8VtS6JSIF+bcLY:oqQ2qdzRLS6JSC5U
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
behavioral25 behavioral26
- Target
  fzputtygen.exe
- Size 355KB
- SHA256 e71cf3010e46db0922f0c25251885d1317f2e695e3f7e4fecc035f0d3d987fe5
- MD5 f202d64a47456e50acba6dffef26c65c
- SHA1 edad917fb2e07fbdcc77ddd46b85cf268546bf0c
- SHA512 3eccc1aa9bdedff9c066409c0dccb4479af50afb3a9e0739b187ff5f930d17b92821f45bb31902c25146a1f301faf40fd7f0e02e512cf3449ee89c4a9a7cf57b
- SSDEEP 6144:Ltc5log92nfS9SNNRhyw6Hnsu69H8BoRZWszcMd4NN:pc5exn68fRhyw6HcH1RZxhd4b
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  fzsftp.exe
- Size 647KB
- SHA256 311488e3c21f1b3573bbe049f94d82135bb049a97128c26f2edded9ec6892adf
- MD5 f0814b8ed97027f251cf76403e1a12ce
- SHA1 4db14cc3f41c9ef5f72aa975626a037b03dbfe9c
- SHA512 ea48e848748258182c1a8787697eadf8725906463ac78fdd7b2f9d111b7df1446ee54b7ac817e8b634cb8bd5022f98b5860aad11b407a7fd65fe22775ef56c83
- SSDEEP 12288:v0i9L2KhouhU7MhrxuJwfe4qKDVQn/d4aBrVA6ZwCOUQZbBz7G6lN:v0QL2KzhU7Mhr4mrqZ14apgUQZbBz7GA
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  fzstorj.exe
- Size 9.8MB
- SHA256 35cc8b5548b8b5de0f1a55afc515214df9dd109cc5133df686445d82b3ea31db
- MD5 04edcdcdbae273e19e04ad0ab1116834
- SHA1 7ccf4f4652fd71a35ecffdcf8f45d1942dead43d
- SHA512 4a0a2bc84193f42f579fd58040bb4a598d6bffb5bb1ec61c2705fc080eae605938bd2aa0f5281ad5cb3deb46c69313c5bd06b0757cdc5cf4fa9f42fa99e8734d
- SSDEEP 196608:E474PITB45BLtG9sCkvf2C/2RrHxvZuNw5EstcMqkhYpuFQkce:R4PerWe
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads data files stored by FTP clients

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32