96fc25412a8d3ed43889cc07ebb1559308408021fc8ac6c4907b0bd4478fdf10

Sharing

Copy URL Twitter E-mail

General

Target
FileZilla_3.70.6_win64_sponsored2-setup.exe
Size 12.5MB
Sample260804-wy3gmaxbra
SHA256 96fc25412a8d3ed43889cc07ebb1559308408021fc8ac6c4907b0bd4478fdf10
MD5 d9918f70c0eb6289a3657be00ef4b6cf
SHA1 31c1bd1e75a8f41c8c0efc9a0a1b6979620b4f8f
SHA512 7b2f4c8f7e59bf603544f7d044c0aeaa5016398c0490a3886577f5a2ec20e3bd887773829ee76f4811fdd67208ed435aceb47a11260fc3c1bd2ef216b014ebc6
SSDEEP 393216:HlDdJWE+uSFVOU15zLySsoSpwvr4RG31b:HlR1+AU1QSipwvr4w1b
TLSH
T1CBD633E192D89209D86CE9331CE89E71EB69D37170B4FD4FB5CC4E6B32CC11A688D856
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  FileZilla_3.70.6_win64_sponsored2-setup.exe
- Size 12.5MB
- SHA256 96fc25412a8d3ed43889cc07ebb1559308408021fc8ac6c4907b0bd4478fdf10
- MD5 d9918f70c0eb6289a3657be00ef4b6cf
- SHA1 31c1bd1e75a8f41c8c0efc9a0a1b6979620b4f8f
- SHA512 7b2f4c8f7e59bf603544f7d044c0aeaa5016398c0490a3886577f5a2ec20e3bd887773829ee76f4811fdd67208ed435aceb47a11260fc3c1bd2ef216b014ebc6
- SSDEEP 393216:HlDdJWE+uSFVOU15zLySsoSpwvr4RG31b:HlR1+AU1QSipwvr4w1b
- TLSH
  T1CBD633E192D89209D86CE9331CE89E71EB69D37170B4FD4FB5CC4E6B32CC11A688D856
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 33a6c41f262fe4f5f5eada6c3dca5d1a6512bf09bd09e05b223882630fd24e89
- MD5 9ba64ba25b26b3964fe1ca1d331387ee
- SHA1 305e7ef9bec45556fe2de80d0ab107f12a8f4eee
- SHA512 741f72b15f6f138c0fd0ccf799dd031c731e79b54eb417a615a04d53eed72891f92196beb03795fad990c158cd358b460ecb6eefed5fc2ef53400310b2249df4
- SSDEEP 96:ZIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/O3lkCTcaqHCI:+hE+A0+sF6piUFkA6lncviI
- TLSH
  T1DFF1C776F3D20673FAAB427428232F231B2AF521576981A6490316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 0893c4d31c7d9c2106eea64f10d6b17a00b742727662a883c39990bcee6a7d15
- MD5 a189f9b1c9ef05e23e5aed0bdb2a1bf4
- SHA1 584e9461cbb901aecabe61b4c3fbed146da0035f
- SHA512 d9f34ea10b8174c031b25dace65f092dacd0e582e3b8cf1779ca9721f50a896cdd3be2cb6738a7ae487a3f8dc1b4548045ac6ca875138003903b0e6e055412ee
- TLSH
  T1EE8173BB92E00CF3D0A44BB740A71CE362B5DD201756001F4A478AA92590B67EE7E715
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsis_appid.dll
- Size 3KB
- SHA256 e9e1ba410636698d666b328eea71346b8287248d262e44da07ce8b5fa24c5e5f
- MD5 19071761e91c43c115a16b52458869b7
- SHA1 75ddb807157f1aa31a08f87be0270f60990bcbbc
- SHA512 bc0eab51cf27f657cd3fd62a47894ee13f3f561feaa565f16ba15088be39be73c9839a3cf35b538219ec83a03d48970b89258c5f20c37bcaf76438998437786c
- TLSH
  T15E5186A38B7988B1C0190B335A8714E572FDC31B229E402EFF98090B7E4065FD9A6160
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $R0
- Size 32KB
- SHA256 fe79816404f334cfa2e721ab9fc5c34d5114c83371721f5c38b6059b3f8b6030
- MD5 3c5dd643f0449e60c48d1daa91a0259e
- SHA1 54e973447b0f33e885f713fa0bab493a8f7c35bf
- SHA512 09f03339b563973b6d4f4dbd9837e720835e12de858086dfb2e39812f10c31d842aaf76cdeaf8cc2f669077790f621a89fa1b416700f6b62cec5ac62cf12904f
- SSDEEP 768:8/Bod79KZGU7L5oF6vPsCQnLsNAgowd9j1lDibLfNYn:8/Wd7Tk1uYNAgowdp1l2dS
- TLSH
  T18FE25D06FF1168B1DE934DF46DDDD77B867035328D264AA6FB58C2487832B636900E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $R2/NSIS.Library.RegTool.v3.$_106_.exe
- Size 5KB
- SHA256 e682c229a6453fa37ce380b59b4c28b5292b9caafd13e7972cab089f10996262
- MD5 2f86235a4603b89b4ae4debc33a22a72
- SHA1 e5a48f3444d0350bc432ff292b71ebc2c6cfc861
- SHA512 1ae90b4ed74a5598028572aa10121701c297d09efcffa429982c28b1eb71f98e6736addc73a23dfad5251493b65dbba52de9bf4d08b0845ed8768734cb600524
- SSDEEP 96:UBg4ARDDMDQB4dtVfhxr+qOspqME3zpHC5:YsDDcQWd/hxaq/sMsC5
- TLSH
  T184B1A617B9100972DBCA06720D569DAE7BE54567032184EA0EF363DBAA78C2749A4352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $_36_
- Size 932KB
- SHA256 03617ef6705ecd575f209b1023c85e9f5e3ac174e2e2de088553a4536cb930ae
- MD5 f03205b2487fbda78c05fe108b8d672e
- SHA1 1b87ca18cef9961a3653a405c8104f45f5a58042
- SHA512 795a736541e0e243dbb8179e10c0cb8ca27946db03f1cee4fceed225daf21edf795534f5d5c12240bba6da3968038cd530ece2242f9409332df66eb14fc09ff3
- SSDEEP 24576:BGnKuf3luMuieVaGCCCdEU2nUR/65vPmvVqN:BU3l/uar2nUR/65vPmdqN
- TLSH
  T12615CFA33D8480B2E69E01B01579E7760B7D75350F2189D7A7E07BADEE311C1D23AB4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  GPL.html
- Size 15KB
- SHA256 f7e89c1edbbef8bc837b47c48113a2416f1af0cfc2b2218da39085465ea1045c
- MD5 11e176c5e0120ee94e365f999084bce8
- SHA1 a612f6d40d0d2ae045d80b60bce6fb6f81a811ef
- SHA512 d0532df4fe5e995df49f3e58127f5fc9637fc4f1afbb29e92ad16897c1055f77963277f5143458b9a294d1c24559bc594e0ae5469271ece639c8e66a5555d5a3
- SSDEEP 192:tiMUzQS+LrQWJz6Z6q6pdPIK8kV6AWRzdbDaz0pmN1rMbkBJ9R8/CmBHf3KWkc:tZUz5irJq6jIuV6fRzd3c0pmbMCzRLw7
- TLSH
  T18772836E774503B309C306A16A4B28DBA32EC578727E11A43459C15D236FE35C3BFADA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  filezilla.exe
- Size 4.1MB
- SHA256 ff5ee21e81a38b959d2f4cd275dbf7a778dc72fd0becfdde80ef3f619d0f8b8b
- MD5 88be34cc35aa794a1443515c356d6bc4
- SHA1 cf1f211c479ad63b7e623cfb4587cc19f9478e37
- SHA512 d1463d54bf68ca251d6e4f64948fd019a4850e3916a2835efe9b5e393334eac6c674f9c004b83c4ecfd4d37e92e3a321be60dc7089037b5b601fd32751022c98
- SSDEEP 49152:9mKL9mEtx4GcVZaoBaWK5uO7Uv3mRRjDi8vLNV2xlGWrb1gCErYwj/6tdxWSRoah:k8ftxILMRRLexrpRe3zsUY
- TLSH
  T1FC16D507E652858CC47AD178876AB6336A72BC0D45343B5EAB50FF322F12F60967EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
behavioral25 behavioral26
- Target
  fzstorj.exe
- Size 9.8MB
- SHA256 413c2ad38b627073dc9ca70f75358836c47db22630f9df639046fa8f874f5f8a
- MD5 4119c1bda781e0df2df4199f3d27cb53
- SHA1 0a00b37a30724ae837b6e54b49894044351cb661
- SHA512 745eb8587784d7f667c15b6fa1c7b1e47bc74886efe1ab87d99225f61fd00cf83e3f4636883382e625a97ac8c1c29f7a0ddaec1357b100e5bc62e898c6ab23f6
- SSDEEP 98304:C0jMdP9uE9l22xij8Y3G78uCAR3AYGM/dOie:HjMdP9R722xij8Y3G7zHRGQwV
- TLSH
  T153A64B07F8A244E6C67FE03096559222BA71349543317BDF5E94BB9A2E22FE4B73D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  libargon2.dll
- Size 53KB
- SHA256 dc60ecb6b769795efbe4ba376886a5afea2f2c9e7086aff9545544659e142580
- MD5 2e6e8486850f0d4aedc59f926e938396
- SHA1 daa601d025beecf0fd13e0fcc4290abc5e614c14
- SHA512 eba45b5c7bcba0a22253e3a53b25e947ca6633d1ec5e2d1763fb5b9c1d2602e7c2b73b81d4ff5b9c008f8e6fa44c5498b5fc7d6230bc02114e0cfad1e3ee067d
- SSDEEP 768:m6knff8caxdotTEYWzW9yS918h4en/g2akIE5rrRsQhQTOwd9j1lDibLfNGgV:mHf0caxeMGm4l2akI8v2TOwdp1l2dGgV
- TLSH
  T11B334A57B653B1FCCA27C0789697A77BB832789156602CFF4290D7362C35E20272E61E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  libfilezilla-58.dll
- Size 1.0MB
- SHA256 769126a12af5f92753be23bb58a7de4af23bb6894016131fbd2abd1f4a40e8eb
- MD5 a23573b5567c32d372bbeb9d2b97cb00
- SHA1 85efa3a5ed30fb3c87c6e12ec890142e83924261
- SHA512 0fa447af58fca1fc50a816226ffd1401de45832e097d6c9fc83a472ae3b708711bd852a40c7fc3cb0ee65ae14d6b36bb8647c39d61ee8c26d023b545ce529545
- SSDEEP 12288:ea6RlJjak56oQUVsYdGnJkqQZrxZWA2kdNqYD8gLfgMrQTgp/GF2DLgrejt2vCaw:eBH6ozsTx6ZgQ0GG+T2vlnDtQxf8wdT
- TLSH
  T17A352907E6A7549CC43FD574436BA672F831BC084638BE6E9A90DB312F21F60976EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads data files stored by FTP clients

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32