e87b878746e62c7d16ff04723199ec0ecbbea6680a814c4508b18b8b41ddcdad

Sharing

Copy URL Twitter E-mail

General

Target
FileZilla_3.69.3_win64-setup.exe
Size 11.9MB
Sample260804-zbwmcazanc
SHA256 e87b878746e62c7d16ff04723199ec0ecbbea6680a814c4508b18b8b41ddcdad
MD5 e334f2446615c7ee295c27039d372165
SHA1 358813fd4dec78f4ed4340b2dd6e4be01d376e0d
SHA512 6527c4ac97d117e34efaeaba82ae7b79cbda866cd641d837483eb16bc08ec6deab1f6046b83dbb3665fb30c2f78ab85e9ab3eebc4c80d9f5c47fed259bf1f94a
SSDEEP 196608:XF0vOGm1JWLhkAv/56uQyqr+5eG7k8I0KbNCrYi5n74prUsg5QRoBXtzTBR:XFSFm1uhkAZ6uQydS3CP57K4LQ6B9ztR
TLSH
T167C633F7CFF981EADE43577AF0B37425DAC2238C861544502562DE0BB85EF1206AAD8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  FileZilla_3.69.3_win64-setup.exe
- Size 11.9MB
- SHA256 e87b878746e62c7d16ff04723199ec0ecbbea6680a814c4508b18b8b41ddcdad
- MD5 e334f2446615c7ee295c27039d372165
- SHA1 358813fd4dec78f4ed4340b2dd6e4be01d376e0d
- SHA512 6527c4ac97d117e34efaeaba82ae7b79cbda866cd641d837483eb16bc08ec6deab1f6046b83dbb3665fb30c2f78ab85e9ab3eebc4c80d9f5c47fed259bf1f94a
- SSDEEP 196608:XF0vOGm1JWLhkAv/56uQyqr+5eG7k8I0KbNCrYi5n74prUsg5QRoBXtzTBR:XFSFm1uhkAZ6uQydS3CP57K4LQ6B9ztR
- TLSH
  T167C633F7CFF981EADE43577AF0B37425DAC2238C861544502562DE0BB85EF1206AAD8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
- MD5 e6f30908abfc6f53b7c3c36daec4586d
- SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
- SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
- TLSH
  T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsis_appid.dll
- Size 3KB
- SHA256 e9e1ba410636698d666b328eea71346b8287248d262e44da07ce8b5fa24c5e5f
- MD5 19071761e91c43c115a16b52458869b7
- SHA1 75ddb807157f1aa31a08f87be0270f60990bcbbc
- SHA512 bc0eab51cf27f657cd3fd62a47894ee13f3f561feaa565f16ba15088be39be73c9839a3cf35b538219ec83a03d48970b89258c5f20c37bcaf76438998437786c
- TLSH
  T15E5186A38B7988B1C0190B335A8714E572FDC31B229E402EFF98090B7E4065FD9A6160
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $R0
- Size 29KB
- SHA256 4263c0d7e2451fc52e85c8119dd9f07fa50cfbc8aea438b660947214f235307c
- MD5 285336af2a078c6aa2033018fa9e3748
- SHA1 655b167d119eda84adc650646916d8a919325dc0
- SHA512 5aaf9bbc92d0c31cdf05a332627e8289889409dba43d39b68cfeabe73fe5884d7a46dc3252746f763de830ebb4a8faee50ca4f5ead0985df56ee3d0247497955
- SSDEEP 768:82/5ZWpdwrGUxnyiehH/kPjGy2tmd9j1lDibLfNPceKn:zBZWpvWaIjAtmdp1l2dUTn
- TLSH
  T149D23C05FF0558B1EEA34DF4A599DB3B96B13422CC265BA6FF44C2087833763A905E17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $R2/NSIS.Library.RegTool.v3.$_80_.exe
- Size 5KB
- SHA256 e7815a8f282e858512477f1de7ffe93b25b028a0c9456e65af00462a8841897e
- MD5 19083c7e9b4647d1391bca25c2824b54
- SHA1 8ac89c2da2d401835d41bbb38508adebc169b00d
- SHA512 0eabc87eb8b5a976668633e50a72c12251d3710b0cca545fdf5ec9cdbded7c57a5dd8b950f09179ab73e35bdb22c3856d7e15a52645a5f3570f556a5ae4e80e9
- SSDEEP 96:EBg4ARDDMDQB4dtVfhxr+qOspqME3zpHC5:osDDcQWd/hxaq/sMsC5
- TLSH
  T12EB1A617B9100972DBCA06720D569D6E7BE54567032184EB0EF363DBAA78C2749A4352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  GPL.html
- Size 15KB
- SHA256 f7e89c1edbbef8bc837b47c48113a2416f1af0cfc2b2218da39085465ea1045c
- MD5 11e176c5e0120ee94e365f999084bce8
- SHA1 a612f6d40d0d2ae045d80b60bce6fb6f81a811ef
- SHA512 d0532df4fe5e995df49f3e58127f5fc9637fc4f1afbb29e92ad16897c1055f77963277f5143458b9a294d1c24559bc594e0ae5469271ece639c8e66a5555d5a3
- SSDEEP 192:tiMUzQS+LrQWJz6Z6q6pdPIK8kV6AWRzdbDaz0pmN1rMbkBJ9R8/CmBHf3KWkc:tZUz5irJq6jIuV6fRzd3c0pmbMCzRLw7
- TLSH
  T18772836E774503B309C306A16A4B28DBA32EC578727E11A43459C15D236FE35C3BFADA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  filezilla.exe
- Size 4.0MB
- SHA256 da6b36e2e247c99e6066e402a9784ab52938cd08c35797640b5dd9733786e25e
- MD5 0909c937730b17e1b8333b025f44890c
- SHA1 63e6dafa76b3156916bcb175f6b01531a31173bf
- SHA512 49ca0aea39d517540d104ed11ab8e25f2a759b5942a6cc7009058f9f77c7f12605d4ece466349fa82330bed482997a376a526944df6b27bf15afb222615a754a
- SSDEEP 49152:mBHzRrisWUPCYtA3tLUKimwi4UvdxJ68CAHtUnUCZsw8jYSo+gIAR2D2hpgx9S+F:UVFxisKRUcrSs
- TLSH
  T12016A407E652858CC47AD179876B72336672BC0D8930375EAB54FB322F52F60927EB18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
behavioral21 behavioral22
- Target
  fzputtygen.exe
- Size 352KB
- SHA256 834f058155fb072f6750d329d27ca688b4ada9ef453295c06aee99be07642cf7
- MD5 67d239a6dfd787895cd7b69c51eb6b50
- SHA1 a423b5742280f0951fb99c9da628c95f95a007d8
- SHA512 c0fcc02daf7af7782f5d30a5c8051a2d399216595f6a99fb6e82e91e0ebf1f6c648fa2e670be082df308f6ad5f6e1890e10024a5d02341052d1c44bbe1b14201
- SSDEEP 6144:GdSNRhY3pH7OehnYmHxlCuNNZRCuFECUColZTE0MR8dwdU:gSNRC9dtRxlC8ZRiCClZwZRswdU
- TLSH
  T175745C2BE29314BCC12BC174869BE773AA70F46903B4BE6F56A4E7312D11E50A71E71C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  fzsftp.exe
- Size 644KB
- SHA256 ffa132af3788f76ddcf191e90d9aec40c8d9a2088870a59243566658206929b8
- MD5 7c46fd1158f42829359cd91dc05ce286
- SHA1 b1bc993b3ffc763adc11776db5a18bf5565c0495
- SHA512 8fab754da4e8cbbff05243f2e4ead368b6426d8ea9f8c5b83f78301ea97e80bf65727db2ec8b808c8b0978c925349d0c261d35c2ed235eb91eaaec0d628788a2
- SSDEEP 12288:A0/eJDFH7k3PeqwqS8S33DVD8y3jonN821CtBxIZgDfQ/WGG7fQwdd:AKeNFHaPeqwqmnDVX3MivIZgpGG7fQwL
- TLSH
  T126E45D2BD29324BDC12FC1348357A372B971F02516B5BE7F16A4EB316E21D90572EB28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  fzstorj.exe
- Size 9.8MB
- SHA256 7a840fbee72b5dfb71dc0f1d8015345e0aeae79435aad09813b9d523ab02b5cd
- MD5 13cbb2bed25b2b29ea1827b0f9a83d3f
- SHA1 75aecf6597182a145f01109ea13905789b6802f0
- SHA512 389346e8a8f7ca117e7a516641de140ab688d76e112e8dd8ae1b8d3fa4ea3229e031ef450e13f890f99c224145a394920401728a8b9a9ff9eaa9d5fc68dc9e03
- SSDEEP 196608:L6hUMNzNBHAoxWFSZ9DopVC/2RrHxvZuNw5EstcMqkhYpuFQk/:+UMP4l
- TLSH
  T12FA64A02FCA244A9C2BFF03096559222BB71349543317B9F5E94BB991E65FE8BB3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  libfilezilla-48.dll
- Size 965KB
- SHA256 d31816058dcc8e5f35cb359b4c9aca4fc6883fce6bc0dd9bbff45de08112fdf1
- MD5 ee988655beea3e320175f79469972f72
- SHA1 03c969b21d66ab14dcb6dcb6f73f6becff4d8389
- SHA512 5bf7910d73486735fc59e4d3cf4056791617493ed2806177ef8bad66a45ff22bd06ac3d89c4647c8163c3e418c12b5748e974c6473d233a5eabe0c1aaa20b812
- SSDEEP 12288:uiMTcLMMFIF7l1uxFD01Q1fC4XAeenNDmh31L1LvDrg8q636ixDtQi4/wdX:ubwzE7l1+a6oNUDTKixDtQi4/wdX
- TLSH
  T176253917E667589CC87FD574431BA272F431BC090A38BE6E5A90EB312F21F60976E718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  libfzclient-commonui-private-3-69-3.dll
- Size 611KB
- SHA256 2e35ed007b9308964e7e3f175a6329e3fd04e229de8d4020d2523a35b02adfed
- MD5 0f33052fe1e40d1650df95626306163d
- SHA1 f362436af02a31d0ea3dbd22ca26b3358be0baff
- SHA512 fb0f4549636b90fdb12940da51557185599d3885d82cb10400dd08793fefe6d5c5e272f8a2d7ac92f1572aa0687680aac78e466aa81b1537cc68e3471e149014
- SSDEEP 12288:l/9NuWyhKxyrJK4Jp7sgNcI7ZUtkjDEGOVMfwd5:t92xXAgNcUUtUOVMfwd5
- TLSH
  T12AD43B17D2A301ACC4BFD1755757A673BA32BC0845747EAE6290DB312F20E70A76E728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Checks installed software on the system

Reads data files stored by FTP clients

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32