2ba6413e2fbab748fe9de7226645f680e11b72e62e0f3f2b1b770d947040f421

Sharing

Copy URL Twitter E-mail

General

Target
FileZilla_3.70.6_win32_sponsored2-setup.exe
Size 12.8MB
Sample260722-w77spsag85
SHA256 2ba6413e2fbab748fe9de7226645f680e11b72e62e0f3f2b1b770d947040f421
MD5 e140ac97f7634c7263c192e7d05f4967
SHA1 9de2ac5bb162f599bc0073d5f5288d8da6d4d6ec
SHA512 ffade51ee028856d3a2247f4cc856d3c051dd0f044f0aad235bcc5113dc2d3758209332c79f175b35712d9d296f659316ff4bd84c456395814a0cc7ed6d65469
SSDEEP 393216:kluTdNfoYiWAGoB4s274AqBPWvzaYmfIFV9T1Aw:kluwYiD4VkBsvmGT9B
TLSH
T1AAD633E8EDC7AA7DDEE34BF97318AC3A12356B90B070D21E14106F47B6CD0A055AB197
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  FileZilla_3.70.6_win32_sponsored2-setup.exe
- Size 12.8MB
- SHA256 2ba6413e2fbab748fe9de7226645f680e11b72e62e0f3f2b1b770d947040f421
- MD5 e140ac97f7634c7263c192e7d05f4967
- SHA1 9de2ac5bb162f599bc0073d5f5288d8da6d4d6ec
- SHA512 ffade51ee028856d3a2247f4cc856d3c051dd0f044f0aad235bcc5113dc2d3758209332c79f175b35712d9d296f659316ff4bd84c456395814a0cc7ed6d65469
- SSDEEP 393216:kluTdNfoYiWAGoB4s274AqBPWvzaYmfIFV9T1Aw:kluwYiD4VkBsvmGT9B
- TLSH
  T1AAD633E8EDC7AA7DDEE34BF97318AC3A12356B90B070D21E14106F47B6CD0A055AB197
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 33a6c41f262fe4f5f5eada6c3dca5d1a6512bf09bd09e05b223882630fd24e89
- MD5 9ba64ba25b26b3964fe1ca1d331387ee
- SHA1 305e7ef9bec45556fe2de80d0ab107f12a8f4eee
- SHA512 741f72b15f6f138c0fd0ccf799dd031c731e79b54eb417a615a04d53eed72891f92196beb03795fad990c158cd358b460ecb6eefed5fc2ef53400310b2249df4
- SSDEEP 96:ZIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/O3lkCTcaqHCI:+hE+A0+sF6piUFkA6lncviI
- TLSH
  T1DFF1C776F3D20673FAAB427428232F231B2AF521576981A6490316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 0893c4d31c7d9c2106eea64f10d6b17a00b742727662a883c39990bcee6a7d15
- MD5 a189f9b1c9ef05e23e5aed0bdb2a1bf4
- SHA1 584e9461cbb901aecabe61b4c3fbed146da0035f
- SHA512 d9f34ea10b8174c031b25dace65f092dacd0e582e3b8cf1779ca9721f50a896cdd3be2cb6738a7ae487a3f8dc1b4548045ac6ca875138003903b0e6e055412ee
- TLSH
  T1EE8173BB92E00CF3D0A44BB740A71CE362B5DD201756001F4A478AA92590B67EE7E715
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsis_appid.dll
- Size 3KB
- SHA256 e9e1ba410636698d666b328eea71346b8287248d262e44da07ce8b5fa24c5e5f
- MD5 19071761e91c43c115a16b52458869b7
- SHA1 75ddb807157f1aa31a08f87be0270f60990bcbbc
- SHA512 bc0eab51cf27f657cd3fd62a47894ee13f3f561feaa565f16ba15088be39be73c9839a3cf35b538219ec83a03d48970b89258c5f20c37bcaf76438998437786c
- TLSH
  T15E5186A38B7988B1C0190B335A8714E572FDC31B229E402EFF98090B7E4065FD9A6160
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $R0
- Size 32KB
- SHA256 f8992907c0407eff24ab285e68a7588bd373c045591f087200e99b29109fd9b5
- MD5 fed12e6519a1b19e18354477c17a5dba
- SHA1 c681ba3d44b7c5d57b0e9f8c903f94745f17566f
- SHA512 4cf7fba053924b76bd44e6e862dfb0bf6c272ed570927e3d2469f378ed8610dad8290f824ce8f24c563d556d16a6bff0bcf5a0bf00684b2e84460fe55eb89204
- SSDEEP 768:w/Bod79KZGU7L5oF6vPsWQnLsNAgiwd9j1lDibLfN99w:w/Wd7TkhuYNAgiwdp1l2d99w
- TLSH
  T1DAE24C06BF1168B1DE934DF4ADD9D77B86B03532CD261AA6FB14C2487822B636904E1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $R2/NSIS.Library.RegTool.v3.$_106_.exe
- Size 5KB
- SHA256 e682c229a6453fa37ce380b59b4c28b5292b9caafd13e7972cab089f10996262
- MD5 2f86235a4603b89b4ae4debc33a22a72
- SHA1 e5a48f3444d0350bc432ff292b71ebc2c6cfc861
- SHA512 1ae90b4ed74a5598028572aa10121701c297d09efcffa429982c28b1eb71f98e6736addc73a23dfad5251493b65dbba52de9bf4d08b0845ed8768734cb600524
- SSDEEP 96:UBg4ARDDMDQB4dtVfhxr+qOspqME3zpHC5:YsDDcQWd/hxaq/sMsC5
- TLSH
  T184B1A617B9100972DBCA06720D569DAE7BE54567032184EA0EF363DBAA78C2749A4352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $_36_
- Size 932KB
- SHA256 03617ef6705ecd575f209b1023c85e9f5e3ac174e2e2de088553a4536cb930ae
- MD5 f03205b2487fbda78c05fe108b8d672e
- SHA1 1b87ca18cef9961a3653a405c8104f45f5a58042
- SHA512 795a736541e0e243dbb8179e10c0cb8ca27946db03f1cee4fceed225daf21edf795534f5d5c12240bba6da3968038cd530ece2242f9409332df66eb14fc09ff3
- SSDEEP 24576:BGnKuf3luMuieVaGCCCdEU2nUR/65vPmvVqN:BU3l/uar2nUR/65vPmdqN
- TLSH
  T12615CFA33D8480B2E69E01B01579E7760B7D75350F2189D7A7E07BADEE311C1D23AB4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  GPL.html
- Size 15KB
- SHA256 f7e89c1edbbef8bc837b47c48113a2416f1af0cfc2b2218da39085465ea1045c
- MD5 11e176c5e0120ee94e365f999084bce8
- SHA1 a612f6d40d0d2ae045d80b60bce6fb6f81a811ef
- SHA512 d0532df4fe5e995df49f3e58127f5fc9637fc4f1afbb29e92ad16897c1055f77963277f5143458b9a294d1c24559bc594e0ae5469271ece639c8e66a5555d5a3
- SSDEEP 192:tiMUzQS+LrQWJz6Z6q6pdPIK8kV6AWRzdbDaz0pmN1rMbkBJ9R8/CmBHf3KWkc:tZUz5irJq6jIuV6fRzd3c0pmbMCzRLw7
- TLSH
  T18772836E774503B309C306A16A4B28DBA32EC578727E11A43459C15D236FE35C3BFADA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  filezilla.exe
- Size 4.3MB
- SHA256 ccc0f9e404e9600a850c4d51d88e4e49470219e39099bcfc65c7baee1a8ca4db
- MD5 300bc87edb7d18cddd493eaaf0ccdf42
- SHA1 f75c8d34f44abc7ad9670686e6dbd4616086bb66
- SHA512 c9d01705ef61401ec610493e068fd8edc486b23901b755a83d980b6a513f988cce665f1f1a96ac222dac5000c098cde876cb97bd4c8b691223e6c5556c105f36
- SSDEEP 98304:5ASuPz95IsjotUuiq63nlyEzizSumkCijVlIBxiFUpzmBsCDjTa/SaNp+qgLInHH:5fuPz95IsjoGuiq63nlyEzizSumkCij4
- TLSH
  T157263A08EB069AB1E59380F0134FE77B4A786A30447AD887F7C98E566573DE79109F83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
behavioral25 behavioral26
- Target
  fzstorj.exe
- Size 8.6MB
- SHA256 d53e77a8f0a21247b53d13e2631ba008a2c84529f788a90a3cbe6b523d514611
- MD5 15e921c9a5a9917c803977c22101d56c
- SHA1 93d3d6a126f0852af08c286ad9d5b4eb1827d076
- SHA512 a79524b5b411b39eaba0a37a14cead348d8fa018595af10894adf4db8a1f54881fb9d62c80f63ec2c410cfd2fbae78b287fe6ad3e9cee2c7deb869b75a62abae
- SSDEEP 98304:WYDVoKiEwHt+6KMhTCWTOTz4wt0AIFVwf3ACweagq:WYDVoLEJ4FTgzjt0A9bvq
- TLSH
  T111966C90FDEF94F9EA031530596B633F273466099725CEC3C6408FAAEC57AD11A7312A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  libfilezilla-58.dll
- Size 1.1MB
- SHA256 fec1090ffda8449ae54a7c62f68d47f4e20e6be4f4a86c761a9947b4ec6f9bba
- MD5 a8d87e9c24cb7c9e6a5899af21e93553
- SHA1 9c7a3f6ef5005590cd11c6e58ecb7c47f92a4ffb
- SHA512 702089998e9d8fa91d9b3d3b1ade602468a34afb21ab3c039bc443ac70f6f0e5decb21980d63d8574a21d7eb9ebe5e57dd267f545f654b58de6e4266f7ccf98f
- SSDEEP 24576:kR/RAfA0E6DmGr6YBTc7Iunf5Ke5py5chxzAPeXDBDtQrSZwdK:m8JjBTETnfz5HDuw
- TLSH
  T17E35490DEB0269F0E95755B0068BF7BE8124AB318465DCEBFB8CDE59F4339D26409B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  libfzclient-commonui-private-3-70-6.dll
- Size 676KB
- SHA256 e9181321eea93e19584e20ba15cd35363466c8f0c7959e30e61f8b5b602e88ac
- MD5 1052d46205dd0975688311281c623691
- SHA1 62c6886e0cbb94c84ed2ba1bbb31aacb8f191e51
- SHA512 f5182a6e3dd54e31a3e43218804cf31fa31be7b2337749025a187f80a81e412dcef22fa99222a46b790be72897dd876a175c27e72e19a1a658012dd94db892d2
- SSDEEP 12288:sIc6abZ+jk9OrnHq9O1QSaovKG/T0Vc7eCm5L4HRG1v3Zd95M2lL9wd/:sIxs+jkQoBGvKiT0EmgRG1vpd95MQL9A
- TLSH
  T11EE46B0DEE4649B1DA9711F0569BE7BE8625AB308072DCEBFB8CC858F4336E16409353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads data files stored by FTP clients

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32