0ea407f423fbca24de531b491d853647ee2165ff48caa1ad2e1bdcc9a9be0e05

General

Target
ftxberlin.zip
Size 145KB
Sample260707-pfk2ashv7y
SHA256 0ea407f423fbca24de531b491d853647ee2165ff48caa1ad2e1bdcc9a9be0e05
MD5 7e527d19c3105e61eef9c5a16c3893fb
SHA1 21db24b3ead95f4b8c5b14af09593934ab45161f
SHA512 2f02ce1fb866da3e225787f14c65af1db8c95aa3b0b92b8e69af5b68bff24f7be9f445602f9bff551fd87bc5d83a044bc7d5e8db9248d73d0a799d17b0000e7b
SSDEEP 3072:Zjqx8x9kyFq3yd6SHrpKaMEU+FcjP4UqZNhW9f6cENYzLFhwW:kx8x9kyyyd6SEaHURjTcPqf6cwQN
TLSH
T10CE31273C272CDFAFF333AB9A875661DA1911728003975866E0C006BDD291FCB6A1967
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Targets

- Target
  ftx/error.html
- Size 1KB
- SHA256 f17376b0b7ade8c24d17405d6c2d2a8ed5d8aacf1ca16efff18e96bd2fbe0220
- MD5 ee48901d9c8fd41b99ca875d7c6b0df9
- SHA1 c2b548bba5e2a9215b80375f019bebbc02953220
- SHA512 e3bdd12d8924ba9d11cb7d36ab4fc1aa0710fc992e2024f46be2cf9a47fb631af22cf766d43b729600e8b0d29e82ac0764c8b020c0a0af435c8e541000d217c5
- TLSH
  T1F531B19B56E310027923A0A41FB667412B80C027C24FCEA93E9CB348CF955D6ECD378C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  ftx/index.php
- Size 6KB
- SHA256 f4c6704d521654ae62cfc0dc24bcfdec0e4c2ceb3bdb8f2ed13dd4583b54c955
- MD5 3a17461b50ba517be83cf81c6297e50c
- SHA1 d73dce4aaf8db8263aeedc8b49c18fbf954f6752
- SHA512 4be86bee93aece4f07d0d1d1263891670b3fa05f68887542bf04685922bcaa03544bbf9693bc35a5334d07faad57584e49f4f4e4f9cdf9b43ec58cac2c2a6a56
- SSDEEP 192:f51EHXstivR7t/2kMKAYXiyBhCCIHCq2BFbB4uFlOGJg:gHR92kuyruSFmuFdg
- TLSH
  T150D18526B5B741244B67D898ABEBB195597A522B260CD100BC9D03CC6FC832CD3F67CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  ftx/page.html
- Size 6KB
- SHA256 4b1928bec09e9fbed67bed5c2e5c6d7d9c0bcc60bbf7b3a7d10217cc090f868f
- MD5 d153cd5dd1718f7c224d32b86e5e450b
- SHA1 e2f8a1b8e3131cc514806dfdbe76cdcb1ff10e7b
- SHA512 36273e37d2c33ea736eca16e007029caa7a9343eff591bbbaeb129a5bb420aa2dbe686ad14b96d1de5cb39dec8a58db4ba9da3d03b6d383736e2035fdd1d055a
- SSDEEP 192:BrRS2fsVcOgyExA9vzp9wRp6kU+RvVa2HMpePmXI:BrdU4vVa2ZPmY
- TLSH
  T18BE1B50783A743795C0A82AC5BB62944306AC807E178F9F43FDF5445EF4E5E0689A7DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  ftx/pdf.html
- Size 3KB
- SHA256 0881f9a5c0ec171e4edeef800421e4926bd33a12aadcbd33a5e902949e1e2d7b
- MD5 c366b6b51ba7fda989626d2423544a27
- SHA1 baa955077b6e427c566c97ba70ad6f590a08f86f
- SHA512 22f95b13b2af854a927c4e15a0674a0d8c4b14916e0f4b84cb1dc2eb5523696acba7dc52cbbcc74054843568665b630d14bc89b05c4302e3501c208524298736
- TLSH
  T10C71B86B7E160005A302D0D1BE83A745650B7517BF4BCCB6B4DF9279AF459B892623CC
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral7 behavioral8