e6ac9bb6fae3ef00162b9afb517d5c961b7ed1192d66a7c785f0ea88ca6a6e54

Sharing

Copy URL Twitter E-mail

General

Target
FileZilla_3.71.0_win64_sponsored2-setup.exe
Size 12.5MB
Sample260819-wxezyagg94
SHA256 e6ac9bb6fae3ef00162b9afb517d5c961b7ed1192d66a7c785f0ea88ca6a6e54
MD5 0d2b3b4d623f282e0f7e101e5f4bed58
SHA1 2c1f30218c449e5218fef1dcdad25b848ddf911a
SHA512 ea8815ab7dc98a4a28ffdf95bac7ba02acf9faec5213190c3b5e30cc3eb10028cdbf9bb12a6e2cf17270cbe2d81c2bd8783f2984036d23a4887de1d449c4e437
SSDEEP 393216:tl+h/6iOX85EO0gRiOZBCO8aXh20UHhnul1d:tlu/VOUEAkOKWRaufd
TLSH
T14BD633503914409AF424123DAF4B5DD2DEA10B72B2FA444A9FC1BC17B48F6B3B789E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  FileZilla_3.71.0_win64_sponsored2-setup.exe
- Size 12.5MB
- SHA256 e6ac9bb6fae3ef00162b9afb517d5c961b7ed1192d66a7c785f0ea88ca6a6e54
- MD5 0d2b3b4d623f282e0f7e101e5f4bed58
- SHA1 2c1f30218c449e5218fef1dcdad25b848ddf911a
- SHA512 ea8815ab7dc98a4a28ffdf95bac7ba02acf9faec5213190c3b5e30cc3eb10028cdbf9bb12a6e2cf17270cbe2d81c2bd8783f2984036d23a4887de1d449c4e437
- SSDEEP 393216:tl+h/6iOX85EO0gRiOZBCO8aXh20UHhnul1d:tlu/VOUEAkOKWRaufd
- TLSH
  T14BD633503914409AF424123DAF4B5DD2DEA10B72B2FA444A9FC1BC17B48F6B3B789E5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 33a6c41f262fe4f5f5eada6c3dca5d1a6512bf09bd09e05b223882630fd24e89
- MD5 9ba64ba25b26b3964fe1ca1d331387ee
- SHA1 305e7ef9bec45556fe2de80d0ab107f12a8f4eee
- SHA512 741f72b15f6f138c0fd0ccf799dd031c731e79b54eb417a615a04d53eed72891f92196beb03795fad990c158cd358b460ecb6eefed5fc2ef53400310b2249df4
- SSDEEP 96:ZIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/O3lkCTcaqHCI:+hE+A0+sF6piUFkA6lncviI
- TLSH
  T1DFF1C776F3D20673FAAB427428232F231B2AF521576981A6490316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 0893c4d31c7d9c2106eea64f10d6b17a00b742727662a883c39990bcee6a7d15
- MD5 a189f9b1c9ef05e23e5aed0bdb2a1bf4
- SHA1 584e9461cbb901aecabe61b4c3fbed146da0035f
- SHA512 d9f34ea10b8174c031b25dace65f092dacd0e582e3b8cf1779ca9721f50a896cdd3be2cb6738a7ae487a3f8dc1b4548045ac6ca875138003903b0e6e055412ee
- TLSH
  T1EE8173BB92E00CF3D0A44BB740A71CE362B5DD201756001F4A478AA92590B67EE7E715
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsis_appid.dll
- Size 3KB
- SHA256 e9e1ba410636698d666b328eea71346b8287248d262e44da07ce8b5fa24c5e5f
- MD5 19071761e91c43c115a16b52458869b7
- SHA1 75ddb807157f1aa31a08f87be0270f60990bcbbc
- SHA512 bc0eab51cf27f657cd3fd62a47894ee13f3f561feaa565f16ba15088be39be73c9839a3cf35b538219ec83a03d48970b89258c5f20c37bcaf76438998437786c
- TLSH
  T15E5186A38B7988B1C0190B335A8714E572FDC31B229E402EFF98090B7E4065FD9A6160
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $R0
- Size 32KB
- SHA256 dda05edd3812e64152dd677e9e7084e9b60cb78b605be0d5e7cae351bc62bc8f
- MD5 b77298bfb80e98801f6b16611393dd75
- SHA1 f9857aad3e2840e81acb05e27b789aac4a0f93c9
- SHA512 4bf9ca82d3f11b6960db2b2e4a82770aaffac17707a5c3fa8587e61eb1a6574274c69193e42e015192505a90219bf56e78763fdcd590a248efde976c127ad33b
- SSDEEP 768:4/Bod79KZGU7L5oF6vPssQnLcOA/wd9j1lDibLH:4/Wd7TkXuIOA/wdp1l2P
- TLSH
  T157E24D06FE1168F1DED34CF46DD9D77B8AB135318D164AA6FB14C3487822B63A904E1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $R2/NSIS.Library.RegTool.v3.$_106_.exe
- Size 5KB
- SHA256 e682c229a6453fa37ce380b59b4c28b5292b9caafd13e7972cab089f10996262
- MD5 2f86235a4603b89b4ae4debc33a22a72
- SHA1 e5a48f3444d0350bc432ff292b71ebc2c6cfc861
- SHA512 1ae90b4ed74a5598028572aa10121701c297d09efcffa429982c28b1eb71f98e6736addc73a23dfad5251493b65dbba52de9bf4d08b0845ed8768734cb600524
- SSDEEP 96:UBg4ARDDMDQB4dtVfhxr+qOspqME3zpHC5:YsDDcQWd/hxaq/sMsC5
- TLSH
  T184B1A617B9100972DBCA06720D569DAE7BE54567032184EA0EF363DBAA78C2749A4352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $_36_
- Size 932KB
- SHA256 03617ef6705ecd575f209b1023c85e9f5e3ac174e2e2de088553a4536cb930ae
- MD5 f03205b2487fbda78c05fe108b8d672e
- SHA1 1b87ca18cef9961a3653a405c8104f45f5a58042
- SHA512 795a736541e0e243dbb8179e10c0cb8ca27946db03f1cee4fceed225daf21edf795534f5d5c12240bba6da3968038cd530ece2242f9409332df66eb14fc09ff3
- SSDEEP 24576:BGnKuf3luMuieVaGCCCdEU2nUR/65vPmvVqN:BU3l/uar2nUR/65vPmdqN
- TLSH
  T12615CFA33D8480B2E69E01B01579E7760B7D75350F2189D7A7E07BADEE311C1D23AB4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  GPL.html
- Size 15KB
- SHA256 f7e89c1edbbef8bc837b47c48113a2416f1af0cfc2b2218da39085465ea1045c
- MD5 11e176c5e0120ee94e365f999084bce8
- SHA1 a612f6d40d0d2ae045d80b60bce6fb6f81a811ef
- SHA512 d0532df4fe5e995df49f3e58127f5fc9637fc4f1afbb29e92ad16897c1055f77963277f5143458b9a294d1c24559bc594e0ae5469271ece639c8e66a5555d5a3
- SSDEEP 192:tiMUzQS+LrQWJz6Z6q6pdPIK8kV6AWRzdbDaz0pmN1rMbkBJ9R8/CmBHf3KWkc:tZUz5irJq6jIuV6fRzd3c0pmbMCzRLw7
- TLSH
  T18772836E774503B309C306A16A4B28DBA32EC578727E11A43459C15D236FE35C3BFADA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  filezilla.exe
- Size 4.1MB
- SHA256 edf7122d777bc0efddd7da1e75e8b75bceb9dd3b657f1ee997f60a75e7b320f8
- MD5 f801487e139ff3b7e2a3ef79a6efc409
- SHA1 da05541851f50a0ccf4f38bc731b8284532bb180
- SHA512 bd08746ddbc6d28d58db5a69c0052307dccea754aa521e53218734c61a29f711ad1a83b7e18624d5554b9c6864cb1002260708750b02ff56642793a8ba96c280
- SSDEEP 49152:oG6+WoNjnguam8/J/P4limr9McDSP/NgSPLRPNvUWCFtwOTuaoyqtkJSTOwZsKSt:f7PNE+OWu4STvZrYNl
- TLSH
  T12A16C517E652858CC47AD178876AB6336A72BC0D4530375EAB51FF322F52F60923EB18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
behavioral25 behavioral26
- Target
  fzstorj.exe
- Size 9.8MB
- SHA256 85b3a68db2580661a4124e9c2f5ec2847f14804080a90444eb3fc701a54164e9
- MD5 06a07c0f46864540536affd46df370ec
- SHA1 bcf20f591737f5a92e5ccc5859007151332bec89
- SHA512 24bca00debc81888915a2fd32fc46b6a6471cb868fe3fb724eaa297cc56b2826c6ecd614bf2cbb6f28db99f74c98ff2ab9a4493c0592621c78f1016a82d2f943
- SSDEEP 98304:00jMdP9uE9l22xij8Y3G78uCAR3AYGM/dOi/:hjMdP9R722xij8Y3G7zHRGQwI
- TLSH
  T1F0A64B07F8A244E6C67FE03096559222BA71349543317BDF5E94BB9A2E22FE4B73D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  libargon2.dll
- Size 53KB
- SHA256 d952997d39cf544582197aae1d222676ef547a318a3ed5bc6e9af01e4ddfbb7e
- MD5 87c8a3f3ffc6b4f9faeefa18cc827944
- SHA1 640217d62fb249111a33fb0ddac01f552f74212e
- SHA512 ed71921fba6d978652365383b2780a6abadf70c61837df90eee52955d143fd17bc1721a5b0fe7b42aecee9174d3a7be34b24df6e906b27a48214df103b44ccbd
- SSDEEP 768:A6knff8caxdotTEYWzW9yS918h4en/g2akIE5rrRsQhQdwd9j1lDibLC:AHf0caxeMGm4l2akI8v2dwdp1l2a
- TLSH
  T1A1334B47B66370FCCA27C0789697A77BB972789156602DFF4290C7352C39E20272E61E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  libfilezilla-59.dll
- Size 1.1MB
- SHA256 6cbae5cf1a5c7bd68c8bfb2fe58f58644fc228b379a7ec521605939fac88e3db
- MD5 8e0076a29d25ed5f3b443c7d8a923ecc
- SHA1 25a66faace02122c145d8a8f87e80c95efde2d7e
- SHA512 0fd7c13d429947db68f3b3bb13bcc76a8330470637b15f34ff03e65dc931fe47d34b46124e4153016ac3e56d6bf4762e7817f8c27d9ea9d37b7066ee60dc135b
- SSDEEP 24576:Bb/mQujXmiOrXdHhe7+F7YBQbDtQIxhwr:1/mxEdHCsD9W
- TLSH
  T150453907E2A755ECC43FD5744317A676F831BC0846387E6EAA90DF312E22F60966EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads data files stored by FTP clients

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32