17ffaafa6ef1ab8c1cde09587d5f06d488af62e6a0dec1afc8d61e9d7889b84f

Sharing

Copy URL Twitter E-mail

General

Target
FileZilla_Client_(64bit)_v3.43.0.exe
Size 8.5MB
Sample260709-221ebsaw5k
SHA256 17ffaafa6ef1ab8c1cde09587d5f06d488af62e6a0dec1afc8d61e9d7889b84f
MD5 02c5bf5f3ff4d6e0fc7eedb6b1be0b07
SHA1 e33388c013bc413f809bcc665e8a2226efc1ff2b
SHA512 f7d688a3bb16386856169a96f77122311cd4803fbafb9d810c569a578fb3eeaf843f7be0843eddd5666787450f86f700e566fecfa7e645228eb8fdf2b7a3621a
SSDEEP 196608:Wxri0Z4zudXJ8k3CL4iaJGykKW77uxFiJGj/+c7qmXB:Wxri0dXJ8kSc1lk2qkr7qmXB
TLSH
T14A9633271C2A27A2E03343B7B2ED8F037F95F153149BA80E1D965F17F69F266840E625
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  FileZilla_Client_(64bit)_v3.43.0.exe
- Size 8.5MB
- SHA256 17ffaafa6ef1ab8c1cde09587d5f06d488af62e6a0dec1afc8d61e9d7889b84f
- MD5 02c5bf5f3ff4d6e0fc7eedb6b1be0b07
- SHA1 e33388c013bc413f809bcc665e8a2226efc1ff2b
- SHA512 f7d688a3bb16386856169a96f77122311cd4803fbafb9d810c569a578fb3eeaf843f7be0843eddd5666787450f86f700e566fecfa7e645228eb8fdf2b7a3621a
- SSDEEP 196608:Wxri0Z4zudXJ8k3CL4iaJGykKW77uxFiJGj/+c7qmXB:Wxri0dXJ8kSc1lk2qkr7qmXB
- TLSH
  T14A9633271C2A27A2E03343B7B2ED8F037F95F153149BA80E1D965F17F69F266840E625
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/Math.dll
- Size 67KB
- SHA256 39b1bf4c55db3872c7c6f08e5764bac2def6faed0fbcc68d6cce5aab61243ec8
- MD5 73bc9c462c0c577d7e5646e8f3c123fc
- SHA1 1e5a5962d2c7b56eb178dbcf0fa0103861674daf
- SHA512 1b6b5de5c7ded93f964a324cb9a36177eb982e565a5323fdd603826a712a44e69715ab823ab2418000d4be378d93fe9aea24e6b67e6b907bd4fd1e813a11ca1e
- SSDEEP 1536:TUZ9QC7V7IGMp2ZmtSX5p9IeJXlSM2t1:I97WSth5lwt
- TLSH
  T1C0639D2276E480F2D09E81B125955F1B9B7CA63087A64DD35F622CC6AE30EE1F237707
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/OgTGjezPD.dll
- Size 1009KB
- SHA256 1298bbf2e928e183ce16c49a6e0af7919217e3699593b281b92ccbbb57ed5a6a
- MD5 053eb9330db9c63867a20234a43e8cc8
- SHA1 c4ec36a40cf989f50148906ebd2dd3b98adbc699
- SHA512 f2f442576cbc53c825a1ffdfd18eacaf95c1e0f00374e0c0b3e7f017bcd231ea563090950b989971a40764f2e08008f8b08a5ae5b36031a4aa67b314db053452
- SSDEEP 24576:oniie6uKVixfqkdYOtxmM5yahaN3gTJEZi:xSExSFgYMo7OTuA
- TLSH
  T11E2523AAB99454B3F9591FF9A83863818C7EBDB81F1403D36FD884CC05B174229A9F53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 948998c5c1f9bf5cebff627bc397a4641acc23fb9a3d32650df4ea3d87f68ebb
- MD5 87dde5538ccc83d54d1fef0abc91998d
- SHA1 61809d0b54b8cb91918ea2656bf43cfdbe4cd648
- SHA512 37887af3f4a1f44a9970f662dd90f30009d2ad2b89fc5811074f0d76f9e178f416b0770827431bf1b4159a65b358598ee7d062692ca810fa601f81fe940fac85
- SSDEEP 96:g8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/I3lkCTcaqHCI:tZIKXgk+cx6QYFkAglncviI
- TLSH
  T1F0F1C776F3D20673FAAB427428232F231B1AF521576581AB450356CE76A1CE3FD34B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 9aa388c7de8e96885adcb4325af871b470ac50edb60d4b0d876ad43f5332ffd1
- MD5 9eb662f3b5fbda28bffe020e0ab40519
- SHA1 0bd28183a9d8dbb98afbcf100fb1f4f6c5fc6c41
- SHA512 6c36f7b45efe792c21d8a87d03e63a4b641169fad6d014db1e7d15badd0e283144d746d888232d6123b551612173b2bb42bf05f16e3129b625f5ddba4134b5b8
- TLSH
  T1948171FB93E80DF2E05443BB41A318E36AB5CE705B1B001F49474A9A24D1A6BED7EF05
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/nsis_appid.dll
- Size 3KB
- SHA256 e9e1ba410636698d666b328eea71346b8287248d262e44da07ce8b5fa24c5e5f
- MD5 19071761e91c43c115a16b52458869b7
- SHA1 75ddb807157f1aa31a08f87be0270f60990bcbbc
- SHA512 bc0eab51cf27f657cd3fd62a47894ee13f3f561feaa565f16ba15088be39be73c9839a3cf35b538219ec83a03d48970b89258c5f20c37bcaf76438998437786c
- TLSH
  T15E5186A38B7988B1C0190B335A8714E572FDC31B229E402EFF98090B7E4065FD9A6160
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $R0
- Size 45KB
- SHA256 9eee564333c6b4539c9a9fae37f13a8da0ce49e2d0de0e9cffab49f1b2116cc4
- MD5 073ea17930e93d7c046de22029745775
- SHA1 d274d633804cde898556358a6923b010571ba3b7
- SHA512 b4825b449d6c1190201b669e6f0f5a3b3f355a0cac5d88b21e93b054b4721b49a7afe31c14d8bada3119018f61b6314850dae02a987023b919b54be024ecfd00
- SSDEEP 768:16xx/KNaWRQBeFXsCbSLmtUmIUjJT+sLuN69y0KgJ:1a1GRdsVmIUjJSs6Non
- TLSH
  T12E236D05AB472CE5E8A31FF0ACD5E7394E313D1398B09DA5C3648177EE71BA1E90670A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $R2/NSIS.Library.RegTool.v3.$_91_.exe
- Size 5KB
- SHA256 ad234f11e58590d68fff0fa6b83e8f150b6ed8e2c432f1c3aca527593dea7fe7
- MD5 45c370f14d93b5ec17ddbdd6e4459e82
- SHA1 388d3d46a2a951ad683a7d24043078755e1dded6
- SHA512 27e964421c6d591c0f35283ce5ac9a36cafd0fc858dd52c0d21717b226838045554e9f03fe87c0104b3885938018da77a3923a145bff4fbcf5a85083020df34e
- SSDEEP 96:8i4sRPDMDIv+dtdhyOJ3H8OpspqME3zpUqWC5:/PDcI2dzh93dysM3qWC5
- TLSH
  T17DB1C74BB5100973EACF0A710D9B9C1E6BE04567033089EB0EF353CF9679D235DA8292
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  GPL.html
- Size 15KB
- SHA256 f7e89c1edbbef8bc837b47c48113a2416f1af0cfc2b2218da39085465ea1045c
- MD5 11e176c5e0120ee94e365f999084bce8
- SHA1 a612f6d40d0d2ae045d80b60bce6fb6f81a811ef
- SHA512 d0532df4fe5e995df49f3e58127f5fc9637fc4f1afbb29e92ad16897c1055f77963277f5143458b9a294d1c24559bc594e0ae5469271ece639c8e66a5555d5a3
- SSDEEP 192:tiMUzQS+LrQWJz6Z6q6pdPIK8kV6AWRzdbDaz0pmN1rMbkBJ9R8/CmBHf3KWkc:tZUz5irJq6jIuV6fRzd3c0pmbMCzRLw7
- TLSH
  T18772836E774503B309C306A16A4B28DBA32EC578727E11A43459C15D236FE35C3BFADA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  filezilla.exe
- Size 8.8MB
- SHA256 ad71bfacb2992a1c31b3291a65a9c43d7159cd28af6855c04066f00037a4e1f0
- MD5 a432ca3b6b6049278ce27e7cc592b423
- SHA1 e1b924cae692851afff13a71e72319134f9fb5d9
- SHA512 b2ea6c58f4a6cb98fc678f8a95e9dac833a8efc205198ebf4c0e448014d107de9b2791798c0ee62d23a23ef2ec08644ca825f7761b17bd177ec7caf7a55187b2
- SSDEEP 98304:xyPQhPWCfGNNDlpEni/7hML/pzwcd2a2hNAMjZIsin:EPREAvEiizl2aiNbjzin
- TLSH
  T1EF963A17F29311DCC1ABC234576BA772B5B1B82D00347A6EA694D7361F60F60873EB68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
behavioral27 behavioral28
- Target
  fzputtygen.exe
- Size 212KB
- SHA256 f2fa6ae29306ed7171f2e9563ced9bbd6e337ed8c389b319df3c6b46eeb050f0
- MD5 8c57f3ee8e8eca9e4a09f115fc2122ce
- SHA1 322ae9946110efc36fa69ceb774ba32dabd5d885
- SHA512 686874d64b27c0315006d1f9488028e9e792d478b5c0e1efccd45f8d21e45bc632fbcb44a0e7e0718986ad576327da7af18bdfc8f4475c2693577c96de0a0d62
- SSDEEP 3072:080b0vKcOJHZSHPTXHcPNK2rfW6qrf2S3n5tIzAIX/+8Nw60m9qNhle6u07Gi:n0YvKKPFOwuHGm9shlR3yi
- TLSH
  T1AD247D27F3922CBDC96BC17186D68332B971F8551271FD6F1694DB313E21E602B2EA48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  fzsftp.exe
- Size 503KB
- SHA256 ffa31c16382e0999f7556a6771cfaa04ce58daa7449eefc2ee5c5d41c113bad2
- MD5 94c674fda762b1c2c377e3fef210fcab
- SHA1 0dd8193360db0f910ccc8a960b0b0f5cb162c3db
- SHA512 3f5a514a4ab32c715a0b2d4367d2e0644bb7d5c3977014baa91435655807b9b6795418c9f3f09180bc9096f8a29aa0b2ffbc85c2cd784828ffae96cecf64aec6
- SSDEEP 6144:zCJnR4f5gRzdQGvH4+Ot7BphNP9MJmSsh9npTAPGjrtX2sJGEyYhbnVqp5vH2m:Gy+RaUHApkYnp6G1EnH2m
- TLSH
  T14EB46C27E3A22ABCC52BC1348797D332B971F46412717DAF1664DB316E20D60276EE6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks BIOS information in registry

UPX packed file

UPX packed file

Reads data files stored by FTP clients

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32