9cec17682ec3097adc56380de92902d829446c05f8b1581ad75b4ecaa88ebdf8

Sharing

Copy URL Twitter E-mail

General

Target
FileZillaPortable.zip
Size 2.3MB
Sample260627-pepcbsbs6p
SHA256 9cec17682ec3097adc56380de92902d829446c05f8b1581ad75b4ecaa88ebdf8
MD5 79147dd0493ee59e75b9ff4110f61d48
SHA1 a320c67e5270e320fd558d574080ec004479e110
SHA512 251b8094baffeea06ad90e6ab7cbe96d986fce973d7fb361c6a3f6624b0b754877b3ad78e89eceaf87b202696d07bd7e94b4e6397d94c4907674931b0b3bd891
SSDEEP 49152:0aYgn70LR48lAz9EpuMVshIpWxTpG+OdUZ9Cau:2g70d48lAz9EwK9CpGzO9Cau
TLSH
T11CB533F6694355EBC4EEE033DF7A2543CB4076B90A2C4925B026102171BEAC2DDF779A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  FileZillaPortable/App/filezilla/FileZilla.chm
- Size 284KB
- SHA256 7d201181b200b78865002f054e11579a4d29657282eff45bb11b1353834b9127
- MD5 84fe0ec29cb997f97cbb803bf614845c
- SHA1 de93ab5990a56c9c0ce4dd99f64e2c289206fbb4
- SHA512 3a44756191536d3a5c3b4140b767adce029e3da20a2c587bea7fc3c23d07686cdcf38adbb4511961f807691796c8d703f57cf84ef1c0da3dbf83637e6930e27f
- SSDEEP 6144:RqAO5LedcDyEnApC6/+3HJ8uaWbepu3jhMqeXHV:Tr3Tpl+XsWSpulSV
- TLSH
  T1405423D08641A6D8E21DC838436AD7A79638EDBC09CEA58DAE135A1B74FC34DC4F7621
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  FileZillaPortable/App/filezilla/FileZilla.exe
- Size 596KB
- SHA256 cb49fd97ee60c505e77fb1e99ac5b9c80e4f5568f8142d05427e525b244659ee
- MD5 defb74446b684fc42597cfafea09ab75
- SHA1 5be016d87a5f68c51d1a84cde28e2d704c19bcee
- SHA512 c1ec98320ce35a987082f006ca1b5aea84318e13e00aeb36f15aa5f446862e133ffb95cc68865a99d48eadd1f0307129a3161eafb6de724a042e8235050268b5
- SSDEEP 12288:UCp8xI4MJ6X7r2F8mvyQXJWigSHTXLG5fp9ehrj1rp5Yukc7MM0Yiw:UCyuAryLWin+ZHehrj1YFcF7i
- TLSH
  T1F2D4231BF124DA17E6DA3A3533B7EFE58B05985DCA856B1A00A5272F7C7C70A9C32211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  FileZillaPortable/App/filezilla/FzGSS.dll
- Size 32KB
- SHA256 2ada0bc262739741f496383cea7faf3e0f1e25d3f4a7eea68267132ae7849fa7
- MD5 86737d670315c601fd2b9c1dff6f1985
- SHA1 3bdec6f57575fc07998f0be349261fc5e4787247
- SHA512 30bebb6fdd39e933d86b1d8b527ef707df805125f7644fa2566e5637acf2bd66e010e5837896f5d51a4a66439f6571ab3edea1618ab2376b73875737033bbdad
- SSDEEP 768:tmGscbagCrp57VJVUIOr5GsUog+rLqRf21H:tHdCrXwssTggLq
- TLSH
  T155E2F12AF6DA94F6D10B82341E9B7139165BE220D32E0A116F21F4D6AFF33E154CA461
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  FileZillaPortable/App/filezilla/FzResBr.dll
- Size 32KB
- SHA256 7439954abf7ac2db1976284e21cffd997eb55b38de12c4160396abb26a9c8c40
- MD5 2daa64be942cb10f580cd8d8966ee98b
- SHA1 56af8ee7711eb2d4e643fc170db50ecf464db4f2
- SHA512 70734b3db4524b0d8cef06cd7a91fa35e0666f141a3f0c2c48259a49293d06e6fcf17adfa7a28c0ba3105a846dda0a2ddbfe73b4e6a861a994ae9b8eed39f42d
- SSDEEP 384:/e0/VkXOn6YFdWSYYlGJD0P7kerKLVFmGASskIApzJjGrIylUJ7HAT3Cpa43KJ6b:1kONYccozkerQVrICGUFjR6ouxVm1L5
- TLSH
  T163E2AE4AEF698C3BD12102359623ADA16377E96112378B073ABC952D2F53F1C6F17913
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8
- Target
  FileZillaPortable/App/filezilla/FzResBu.dll
- Size 32KB
- SHA256 99e2d3a6556af71c26737cba7cfc157d0cb6a1d3b223f21967339e60a537bb72
- MD5 64e716fa0c9c055058aa2ad16192c3c3
- SHA1 46eb43af8e30da129b64fa1679c4a1aeb73e0055
- SHA512 a6fa7d094195154795f61c20ac11b11ca6f991a4d2964f7f88744e6d69574af14c80a2174892f6a88d4442def5aad90d67cce5beb2eb726b079ec00e2e89647a
- SSDEEP 768:zJk8510j2ksdSDt60YDa/SmclPpTc+V1ZeMYvk:VXvst60p/AZqcZxr
- TLSH
  T195E2BF4BFBD94529E06643346AD39E42F36AD82C3631CF0B5A08021DFD157427F13AAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10 behavioral9
- Target
  FileZillaPortable/App/filezilla/FzResCa.dll
- Size 25KB
- SHA256 99e5ba5515ab72e30deea96d610655f3e24a061d337d92736a092fc1a7c6748c
- MD5 6c175fbd21aea5b1301744fe2ce58175
- SHA1 a0e074cab9901ef044f3b629e1dbe9871703b85a
- SHA512 70a0eeaaae5dccf45b5edc51d87bbd4f8ce40776c88b3e5efb08f53e6a3a3f232fc2746d5c63e685e13a46679020f428e275b00ac5b052a86db7a4f968b36722
- SSDEEP 384:5O9eUuNh0cpgE/LT/3jdnTgIDFYosudKpE19szTfI2aG+u81gxSyWU:51UwjThgIBtdKpYyTD8okU
- TLSH
  T177C2BE9E9798D129E1A65130DBFB0E11AAA6F4037934CF530360413DEC417E36F226BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11 behavioral12
- Target
  FileZillaPortable/App/filezilla/FzResCh.dll
- Size 29KB
- SHA256 76523db8f0827d82786fa49b556bcf5e293d6a88f5dc2ff3c6487d3fbf9bb1c9
- MD5 481564bb64bfa3ba1b57bba31e9d2b56
- SHA1 5d7daf2fce2371e014227b09728a7e448fc394eb
- SHA512 18b07ba24863c8390dc9c1db2efc9d69ed6ff000389899501a992592c4cb6694225ab53cea349b01766314221c354799c69b6002f27fce4119c3a9fe200b83b6
- SSDEEP 384:RjWwp88BTBtXmFMLbwVAmRR8M0hsPM8NT40h7xLCjRA3ttNXGi7fjCb:tHp7B5ZPCQ2PM8NVh7xLCiZF7fjCb
- TLSH
  T1DDD29E9A87648C86E0E95238293F8F33A75FE5943A228B1F001B16FDEC717059E63577
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13 behavioral14
- Target
  FileZillaPortable/App/filezilla/FzResChs.dll
- Size 28KB
- SHA256 9e4988ecf8193d46b7e586cbbcd4cf723a38aac7370d52b0491d6de491c50934
- MD5 9683261bad19716879bd74ce00bb4411
- SHA1 735d30dfeccc25de9ab93b58fed121ee4572e390
- SHA512 114d473b5741cdc333e4e66682f54709d491edd98b177b20e7aa868469c14c021ea53b96694869be6ed23aaed00fe12643e9662ae750c3eff96371dd379d9f97
- SSDEEP 768:XG9oQUlL2bfEMFr4W0+1tuFnkmKeG6T+jfSXq1wv:AoQUlL2bfLtOFa6T+TWq6v
- TLSH
  T1BCD29E5EEBDA4C6EC4AC2B3034AB4F26B327E8515A238F1F451951EC4D2D7707E12AB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral15 behavioral16
- Target
  FileZillaPortable/App/filezilla/FzResCze.dll
- Size 25KB
- SHA256 bc681dc61f47c5697e12cb236391f2d01736301d5aa7f915e2aa1e0570eedfdc
- MD5 c0bafa4a261fae602f999d18b0c29af8
- SHA1 2498fbeed1eecdcfbf2e7b9cbd4d14452e768571
- SHA512 f7573912e2b7f291d0945487018cbbba85ad9082dc1a05598a8052f646f04f96aeb617e1ed48effa79f07c0104fc8972764d72990f88be3fedec96ba0178e0a1
- SSDEEP 768:AqqnvfoUiLtVQ0JPTS1vHe4u2vnO04+oF2Ng5NZ0:AnnnoUiLvd6W4J94+gf5j
- TLSH
  T1D5B2AEE3B7EDA507E2A961731E230E12F2B7E5E67326871B4452154EEC70391EE81EC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18
- Target
  FileZillaPortable/App/filezilla/FzResDe.dll
- Size 32KB
- SHA256 d83fd310ff441eb9f715e7387adf60e3904c3234ffa724ba1137e73e45576f0a
- MD5 10c888fa4a19afd6a7783d79afa8f0e9
- SHA1 574d3460a42e09ad2a8004b1cd88551e01268950
- SHA512 204406b5b5bedb3d415ffbac28a261410c34fa35426d12ce172d99acea52d136d42f07cd826079e6c3bb199deb8ad9c52736a623329cbe91a00a424790286a61
- SSDEEP 384:b8bPyu1shjcfH3wIEgHmRlCg2Ff7TdsAUKWWX9jLBiHzOQEY04U+8qylMb:ABsJCH1mRlCg2tPdsrK9LyzHmLqpb
- TLSH
  T146E2AE4DA3A4AA16C05F523402F38F123767E524BFA64B07964CB42CEE2A7306E57576
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral19 behavioral20
- Target
  FileZillaPortable/App/filezilla/FzResEs.dll
- Size 31KB
- SHA256 b763ab34bc0bd1b5251cc03b34fa6cc1cc21161379c0f2e9826a857eafb51b57
- MD5 3e63b02cffb1036cfdbff0903411d9af
- SHA1 b5996ecf1064aed841701bb9be6a42f65fbed8e1
- SHA512 73e0ce10aa1b616d8a7179d8fd3a3b9ae5cb6711b8f67908b88d00750a12d095ca3ec708fd30c43024f6b3caaa140cd9cb22b8359e584d8c923d585ca1abaa73
- SSDEEP 768:z5QQGJdmofngqUMt3E4vxP4HVCAzt67hqK1fY6:zMArMtf58OhqgT
- TLSH
  T119E2AD5BEF60495BC4AA253401C78ED16B9ED004B761DB0347DA01BEEFE0320AF96E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery upx adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral21 behavioral22
- Target
  FileZillaPortable/App/filezilla/FzResFr.dll
- Size 31KB
- SHA256 6b7fb75aca82729322e0d4ecc927dd75d0721e35adccedcb57a865e8ff3e9764
- MD5 78cb23a2ff8748f467512a988eae717f
- SHA1 5db5c6730bb81c3651ea3acedb1a2b1bd520d655
- SHA512 8c3a4339cead80c40d4c246edd0bd8bf3071e6b2469af8a8e94a8a1bf3359eecbe3e477061a3fcdfa82a7de1365b3066c544502bd3dee2c9a7527cac20ea9343
- SSDEEP 384:4/vzAu/SQPQNwXq6ClVqFVwoteuSQlqz8U39t+QhwZ7bBnQfwfZ4RY2CzfsQql3e:4/8wQ6q6xVHSQszieBS4l6fsQqV6Mdw
- TLSH
  T1F4E2AF4FAB488E45C4A25131D5E38E91D336E8537AA6931F669C4D2EFC337308E12E66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery upx adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral23 behavioral24
- Target
  FileZillaPortable/App/filezilla/FzResHu.dll
- Size 26KB
- SHA256 de46b32ec6407a9d479c566605fb23791c3ff0ab21bb6e64e504687df00684c6
- MD5 74ed9b5f60f140fbfe99cb4d85a2ecae
- SHA1 b25b8aae1101dc58f10a0c1a04f743b16e8c43b1
- SHA512 8e817bd338e1ff902c31a3e3bbb6294a138e3265cc83fe73c52a8ca5741b9c8834a2114d634630a298e64a4c9e60b09b5c1358b0b1a99fe7fd96394accf7bf86
- SSDEEP 768:Q2ed3bqq9qU+btMScgJ5HyEuxF02n+2w:vU+gQKSxJNNj2n+
- TLSH
  T11BC2AEE1AFE23056E82E1A342DE71D115AA3FD80B979470F0D98DA1DEC57750FE80672
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral25 behavioral26
- Target
  FileZillaPortable/App/filezilla/FzResIt.dll
- Size 31KB
- SHA256 229cddf1d69c6c55a2ec9eeb0ce8a5bf8c9c87ef54a8c942dfab51b50a72d50a
- MD5 3d4aab4e0cb902c50c7f338781d2657d
- SHA1 66ca050070061b71c4c68ffdafd950a285ca9bbd
- SHA512 1ffdcb1e52a829978ea549658fbd57ac30d9b7f531f53f5717797ecf876715d70ab9d7e3c48e852f1aab166765274c256ab627890b040baef9378825c38e2cbe
- SSDEEP 384:ennrRqRxRZCSf/z6YSV1b5GkpUam3uwmyJ+rU1q/cMGRmcS:enkRxj/y1bsM1m3uwmyx16aRfS
- TLSH
  T1EBE2BE8AEBA95A52D14A453922B70E312767E98933F3CB4FA54C041DEC12341FF73666
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral27 behavioral28
- Target
  FileZillaPortable/App/filezilla/FzResJp.dll
- Size 23KB
- SHA256 3e5c3046352cbc72c8b867e540e4fdacfc8120967e679fb17e1d7497d072cf83
- MD5 d1ef6d714c132e0114afce970dc670f4
- SHA1 668043a2007ec0702ed3d50719bc3e386890eb2e
- SHA512 b5c974b44b83ee1ebd4c26a3190cc523a55bd0c0ff1c04a8fd23bf9ac1a8e08f3c753c4a0751022b447cf52aa3426574d2acaa55849e8753b857104ac2854b8f
- SSDEEP 384:qA6UISaBCgewK2kO/+MhRkcSEuHwlhxO816keQQ0eIvE1EK9Pd7hswe1gJ4v5y:NaBCaf/+MvSE6816kdQ0eIvGE2ds10R
- TLSH
  T175B2CFC9F7E75906E157DBB08A5B9EA02739F4117B7413038B8D1E6DFC1E7212C22466
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral29 behavioral30
- Target
  FileZillaPortable/App/filezilla/FzResKr.dll
- Size 30KB
- SHA256 fae3ca4221a1e0e2d7ec3733c3f84cead86d78f3e4c94a2a258ab92ebabf1f84
- MD5 6a3ed0433f5bb736ef5fd2e37337e01b
- SHA1 a31f983b1e14219b609681acfc7c240764e45d13
- SHA512 ed74b0661eaf5c69c4a77ca8adb2646363ecae2d91e5efa3a78c064df53cb7188b8c840d04cece874647ad1a4fbd54b4dcfdeb3ee25cd226354af93096878763
- SSDEEP 384:fxcs5ApdzsvvAH+FPL7B5ITZpxY+8rt+4aUur00Vj2Swy3wu5rmdnegkGs:rjvvAOvTITUt+FBVj2/ipngkGs
- TLSH
  T135D2BE86D7EC690FF4AA11310853CE616A3AD891F363E7133754000DEE2E71CAF15BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

UPX packed file

UPX packed file

UPX packed file

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32