2c6a4420a662622746fe2d9c21a532ccfac30a5e11cd990a362a8cff91dd44ed

User tags

Assigned on submission by the user, not by sandbox detections.

source:malwarebazaar sha256:9972877a77e54a9f35b4f7a693069b4ee7a67eb220b1b6ae8603ee6a9e2dab67

Sharing

Copy URL Twitter E-mail

General

Target
9972877a77e54a9f35b4f7a693069b4ee7a67eb220b1b6ae8603ee6a9e2dab67.zip
Size 5.2MB
Sample260821-snmfwasdrh
SHA256 2c6a4420a662622746fe2d9c21a532ccfac30a5e11cd990a362a8cff91dd44ed
MD5 3091c843f1d28466d8bd8f5b0990bf51
SHA1 b9edabac01d826741b389c48ccaf39d735bc4e84
SHA512 911a3fa6e960d69e8e6a3d869497e994c3148331e183bf30f7c5f8a89c221c6d676b9076e865beb1623942409101c0f6b3ecbcfedd3b790b5abbf4a568a6af8e
SSDEEP 98304:fQLBQAnNek8XxAsJ2dMfGhfMBZnRg7I0lHz0biLuEL6QAgAfJT2FrWTYLwnlomP:ydn8kqeswSFBZn2U0lQbiLuEL6hfq0Yu
TLSH
T1ED463364CA2FC00FBA0D336968564754B73A3B3A80FA51A7C999DBDD1053BFBA404DD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2023
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9123
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4253
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3689
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5771
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1210
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4633
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5683
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8357
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2332
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5754
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5888
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8430
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6799
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4126
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3780
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1272
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9244
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6655
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2732
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6663
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4871
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4005
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9897
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2490
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2992
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7512
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5514
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6530
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8991
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1182
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4703
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8641
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6544
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9985
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5830
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1160
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7865
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6662
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5782
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6377
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7821
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9316
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1162

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3558

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1598
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7966
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2803
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5030
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6697
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8408
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4829
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3796
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6042
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3721
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7267
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8572
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5339
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4810
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3051
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9312
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4011
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3398
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4779
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3162
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8028
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3317
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2033
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7518
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4795
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5305
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3143
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6826
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3935
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7619
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1122
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5393
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2208
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2309
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8195
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9510
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2460
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6605
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1135
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8585
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6706
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5430
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4284
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4535
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9173
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2260
Password
password123

Targets

- Target
  9972877a77e54a9f35b4f7a693069b4ee7a67eb220b1b6ae8603ee6a9e2dab67.exe
- Size 5.4MB
- SHA256 9972877a77e54a9f35b4f7a693069b4ee7a67eb220b1b6ae8603ee6a9e2dab67
- MD5 76b813e64fefa5ba0d2e5963029c28d4
- SHA1 48235c25afe526ab68e61a3128367332270bdf3c
- SHA512 a7b3e56cc6a17894052e2faeda4750a4c20eedd4bc366202d8063566f90215106c5d0f14a27d386bf6f4cf2e93fc40518e225b427b3b15de65451cd19eb501f1
- SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRu:OrICteErownP0oTcMsABqlaOzI
- TLSH
  T1A9463308B3E808E2FAB3D53D81565221D472B4254BB0D5CF43AC9B762F676E0AE7B750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery persistence privilege_escalation
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2