2d19814d33cf0770b925104b91418bf364c78e59b1d94a45a62a5fe6a2c157c1

Analysis

max time kernel
38s
max time network
41s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
fo-wsftp605.exe
Size 1.9MB
Sample260821-wtw42sam21
SHA256 2d19814d33cf0770b925104b91418bf364c78e59b1d94a45a62a5fe6a2c157c1
MD5 2d80c1c3948f95797bbe14e8fc5e2652
SHA1 a4bdd27bb12c7428d0d16e605cc2ed5032becb02
SHA512 6586d54166cbc8a788c20ed841e010a7fa422b1d1e433885396d617ab3c3660818c93c1c88d5f69fde3866ca41c43b85852ea53266da1a1f3f4634c68f388194
SSDEEP 49152:tMCvNprR5Fovc9rZaj6BYA+lCv7GIK/b32mheB:2ClxR5FokraHlCjfKz32mc
TLSH
T17C951221FFB8C260F2B29036AD715764883BBCB0B7335443E694369EDAB368145D1B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 10 IoCs

pid	Process
2608	fo-wsftp605.exe
2608	fo-wsftp605.exe
2608	fo-wsftp605.exe
2608	fo-wsftp605.exe
2608	fo-wsftp605.exe
2608	fo-wsftp605.exe
2608	fo-wsftp605.exe
2608	fo-wsftp605.exe
2608	fo-wsftp605.exe
2608	fo-wsftp605.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 36 IoCs

description	ioc	Process
File created	C:\Program Files\WS_FTP Pro\ftpscrpt.exe	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftpfind.exe	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\connect.wav	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\games.ini	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftpsync.hlp	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\software.ini	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftp95pro.exe	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\syncdll.dll	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\antiviru.ini	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftpstub.dll	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftppro32.pdf	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\usgovern.ini	fo-wsftp605.exe
File opened for modification	C:\Program Files\WS_FTP Pro\WS_FTP.INI	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\WS_FTP.ini	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\onlinese.ini	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftppro32.hlp	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\nsftp.cnt	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftpscrpt.hlp	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\remove32.exe	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\error.wav	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\hardware.ini	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ipswitch.ini	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftppro32.dll	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftpproex.dll	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\nsftpch.dll	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\nsftp.hlp	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftpfind.hlp	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftpsync.cnt	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftplink.exe	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\WhatsNew.txt	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\FtpPro32.cnt	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftpscrpt.cnt	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftpfind.cnt	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\ftpsync.exe	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\complete.wav	fo-wsftp605.exe
File created	C:\Program Files\WS_FTP Pro\archives.ini	fo-wsftp605.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	fo-wsftp605.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fo-wsftp605.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub.20000112\ClsID	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub.20000112\DefaultIcon	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02}\VersionIndependentProgID	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\DefaultIcon	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTP.20000117	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\DefaultIcon\ = "C:\\Program Files\\WS_FTP Pro\\ftp95pro.exe,0"	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\VersionIndependentProgID\ = "Ipswitch.WSFTPStub"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\Shell\open\Command	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub\CurVer\ = "Ipswitch.WSFTPStub.20000112"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\InprocServer32	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\ProgID	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A10}	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\ProgID	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\ShellFolder	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02}\InprocServer32\ = "C:\\Program Files\\WS_FTP Pro\\nsftpch.dll"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\InprocServer32\ = "C:\\Program Files\\WS_FTP Pro\\ftpproex.dll"	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTP.20000117\ = "WS_FTP Pro Explorer"	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\Shell\Delete\Command\ = "\"C:\\Program Files\\WS_FTP Pro\\ftplink.exe\" /d exp"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub\ClsID	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH\ClsID\ = "{49707377-6974-6368-2E4A-756E6F644A02}"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH.981110\ClsID	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\CopyHookHandlers\NSFTPCH	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub\CurVer	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub.20000112	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub.20000112\ClsID\ = "{49707377-6974-6368-2E4A-756E6F644A0A}"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02}\InprocServer32	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\InprocServer32\ThreadingModel = "Apartment"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH\CurVer	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH.981110	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A10}\InProcServer32	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\InprocServer32\ = "\"C:\\Program Files\\WS_FTP Pro\\ftpstub.dll\""	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02}\ = "WS_FTP Pro Explorer CopyHookHandler"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02}\ProgID	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\NSFTPCH\ = "{49707377-6974-6368-2E4A-756E6F644A02}"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\CopyHookHandlers	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A10}\InProcServer32\ThreadingModel = "Apartment"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\DefaultIcon	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\ProgID\ = "Ipswitch.WSFTPStub.20000112"	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\Shell\Delete\Command\ = "\"C:\\Program Files\\WS_FTP Pro\\ftplink.exe\" /d classic"	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub\ClsID\ = "{49707377-6974-6368-2E4A-756E6F644A0A}"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\CopyHookHandlers\NSFTPCH\ = "{49707377-6974-6368-2E4A-756E6F644A02}"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\Shell\Delete\Command	fo-wsftp605.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\ShellFolder\Attributes = 00000008	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub.20000112\ = "WS_FTP Pro"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02}	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\ = "WS_FTP Pro Explorer"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTP\CurVer	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\VersionIndependentProgID	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A02}\ProgID\ = "Ipswitch.NSFTPCH.981110"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTP\DefaultIcon\ = "C:\\Program Files\\WS_FTP Pro\\ftpproex.dll,0"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\Shell	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\Shell\open\Command\ = "\"C:\\Program Files\\WS_FTP Pro\\ftp95pro.exe\""	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A0A}\Shell\Delete\Command	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH\ClsID	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A01}\VersionIndependentProgID\ = "Ipswitch.NSFTP"	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTP\ = "WS_FTP Pro Explorer"	fo-wsftp605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49707377-6974-6368-2E4A-756E6F644A10}\InProcServer32\ = "C:\\Program Files\\WS_FTP Pro\\ftp95pro.exe"	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.WSFTPStub\ = "WS_FTP Pro"	fo-wsftp605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ipswitch.NSFTPCH.981110\ClsID\ = "{49707377-6974-6368-2E4A-756E6F644A02}"	fo-wsftp605.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2608	fo-wsftp605.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3460	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\fo-wsftp605.exe
"C:\Users\Admin\AppData\Local\Temp\fo-wsftp605.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:252

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a21855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ftppro32.dll

Path C:\Program Files\WS_FTP Pro\ftppro32.dll
Size 300KB
SHA256 a7ee486f49f7145f7171c210955b710bd2944f0a2adf4448c51e1817e129c90e
MD5 5e07a770dd0093ca8bd05b50214ee7b6
SHA1 91dbd854ae4f9e6be08c01308902cf8522810847
SHA512 6078eafa0e9cba4d54ac572504b774ffffdd6af66a0f8ce13a447c982c8e2f0494e75268935b1428a1513ef809f812fa5fdae7336f9e6d69c18781889933b236
SSDEEP 6144:D+z+Tnv8JRDU+PcqYWPth5VM6ZVNMVRR9iEtUC:D+zEv8nDiW1h5VMCVNc9i
TLSH
T19564F922A5D0C07AE1B64638D51243F219363FBA5BF0B4DBEAD43E1D7F76582962130B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ftpproex.dll

Path C:\Program Files\WS_FTP Pro\ftpproex.dll
Size 560KB
SHA256 240bc27914f0df384df691ef271e41a9741f65584f86b8d60a74c25a4e2d5696
MD5 79df2c92b70ee1f58f17d1dbb47821d2
SHA1 9263bd162fb61a1dd8fa3e5ceb3f2ae57c87a7b0
SHA512 3ba669f5b99c5a68e478ceb22a6e6b1e174a69ba8b5d70e07e0e31818af061313d011e8177c9c7121eb43b4989964bf9ada69e8b709fa16a13ed7e4c16cbccfb
SSDEEP 12288:7tb9bnhGHS78yTZJnwXS7/aU97Sz2ROck:DlwE7SqRw
TLSH
T1ADC4086261D5C07AE0BA4A30A9DA43F32A34AF710F1068DBE7907D797FB15D2993131B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ftpstub.dll

Path C:\Program Files\WS_FTP Pro\ftpstub.dll
Size 36KB
SHA256 2d0d3f47407f1d7f81f5b3b9a8c5c35e6b3d1ff840edc21b8b6b62827d5647e2
MD5 4ae223d22e596e76bdd826df60656479
SHA1 fd5826c479a0a0b4dffe90e24d34ae281c602de8
SHA512 b0340a9222cdc5bad4798a32ee51c85a7ff116d1762985505ac64302fe7209618e65d27be10fd5a3ad5c2d2bb8115560b28c61b716ade8057532b9c63b668df9
SSDEEP 768:gvYPsyo/YcAQwcTr7AmikTM3SDLTDoOb+NDG:gQPsLGcT3ACZjDoLD
TLSH
T137F25C2030CA85B7F75A993534D52F1737BEB9302AE150C3DF65669A2D312E0B53A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsftpch.dll

Path C:\Program Files\WS_FTP Pro\nsftpch.dll
Size 40KB
SHA256 7983c8a2c04dd2b141b1970cc47a380edffbd1dc4ba2028cb1cac65b3c9e4917
MD5 a3acd258ecf26a8fb84f91a69d2cbaad
SHA1 fd9052de695abd79b657980d47ad19ed140fea40
SHA512 0fc5bb942ef414c04044ef853067eed55034d487e190b12300c510f828ca095f0facdaf0f034fc00d42e318ef818c6d28ce18acab5b48add1f554f49400b4778
SSDEEP 768:g4/JOyw33X7mktDTEdU1UwjSaBnI65lGJdob7VN6666666ZC:I9DTEdU1UwZnp2HofVA
TLSH
T1CE035C21798541B3D35F123A28956F3AA63F6D101FF44883AF659EEE1D325E0E23A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install.ini

Path C:\Users\Admin\AppData\Local\Temp\Install.ini
Size 967B
SHA256 aa1a183349c7fcd0aee6308571f1b46f127006bdf53ee8999a484383e797db77
MD5 2463398b8d5584ad7b3baffd63b9bf93
SHA1 973d7da774ec11431e6191214b71325a7148f54f
SHA512 efbd0c394eca8c328638b007e367e4e0e90b61d8296c53d156e8c3fb7cc506af6451bfde327555b9b8fb38b5e7e9b22ec4989ae30c3178f1acae31829750706b
TLSH
T14C1102AE1705D3717487C227122DA182A133E19CB172327531EAC0115B75EB61AF75EB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2608-10-0x0000000000419000-0x000000000041A000-memory.dmp

Download

memory/2608-142-0x00000000024D0000-0x00000000024DB000-memory.dmp

Download

memory/2608-148-0x0000000005310000-0x00000000053A2000-memory.dmp

Download

memory/2608-154-0x00000000054B0000-0x0000000005501000-memory.dmp

Download

memory/2608-164-0x0000000002530000-0x000000000253B000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads