User tags
Assigned on submission by the user, not by sandbox detections.
General
- Target f335a8488cde4f6587da68b12718b6dcdb8b119ef73e18a40f431c2121f82cc6.zip
- Size 5.2MB
- Sample260822-fbqxbavyft
- SHA256 7610c627231040703922310148d0ebc8fef59e9d6f12e17ba7dc29ad870a66f6
- MD5 3606eeb88fd5feebe1ecf96c66f12b83
- SHA1 f4e93b14821e6ecb00d1239c6345f71d244b90e9
- SHA512 12dee9e7aef7ba867c933e0ddbea2bdab8a287dc2744847dc17bc76d7f75f2098af000ca602c5797520be0d4d0fe98ae8dc8da4587bd1e9019921c38f64dae4b
- SSDEEP 98304:frlpfXhKgPWRrPFOXefcs6Gnf1ps0Qc1n6wcyxqC1xg4+ZR8o:jXZkDbp6Gnf1GN+n6w1Lu4+/z
- TLSH T17246335521EEFFF36252D7BDF4E9D8CAB49C230251D600E51B4ABEC0909E2B8DDA458C
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
f335a8488cde4f6587da68b12718b6dcdb8b119ef73e18a40f431c2121f82cc6.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
f335a8488cde4f6587da68b12718b6dcdb8b119ef73e18a40f431c2121f82cc6.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6763
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8766
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6682
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8915
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9204
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5072
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1196
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6645
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7332
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7748
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7069
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1566
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5847
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6533
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7571
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5187
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6687
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8426
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6965
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9353
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2345
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9150
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5894
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5393
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1898
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7950
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8166
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8677
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4962
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3402
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9141
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2579
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9122
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2682
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6091
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3608
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2670
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8618
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6177
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5643
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1023
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2687
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2955
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1116
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7929
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4410
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4967
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7234
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4516
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3377
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4393
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8792
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4128
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9761
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6563
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4346
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7860
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1054
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6792
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8054
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8165
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2355
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9367
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1649
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1528
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5516
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8371
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3517
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8033
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5186
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3167
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4532
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5135
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2742
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8145
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8130
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4326
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6254
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9652
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4814
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9447
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6392
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6402
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3285
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9974
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7114
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4996
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6525
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4530
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8954
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6332
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7671
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8807
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1810
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9947
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4830
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5879
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7659
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4485
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4238
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3907
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7593
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2091
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8403
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4713
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7481
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1527
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7449
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5514
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3695
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8104
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8535
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8141
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5609
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7445
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6919
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9604
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2129
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2698
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1038
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1372
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7034
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9842
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9354
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2629
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2772
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3173
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3551
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4978
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3495
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7796
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7066
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7531
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9132
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7930
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8565
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9433
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3787
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5392
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3096
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4469
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9286
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6988
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9747
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8297
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6014
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7237
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6620
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6886
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4030
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3215
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8975
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8113
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7810
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2653
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2628
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5876
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7058
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8555
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9399
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4832
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9073
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2137
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4909
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6339
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5711
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9577
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2703
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9071
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4809
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3858
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4556
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9981
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8733
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5147
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7588
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8467
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6716
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2547
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7350
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9251
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7165
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7984
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2369
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3589
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2584
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8454
Targets
-
- Target f335a8488cde4f6587da68b12718b6dcdb8b119ef73e18a40f431c2121f82cc6.exe
- Size 5.4MB
- SHA256 f335a8488cde4f6587da68b12718b6dcdb8b119ef73e18a40f431c2121f82cc6
- MD5 306de1c56ec3b852a4a198cb08b8d2bc
- SHA1 40a019dd28092e0d484a446b0525c66729137234
- SHA512 8d10de934e19fc0a444f91c3966d7832331b98e8107f49983725000eb9bc9f87328302c34d4d1d244e2425bca8c57e52ac957b47071209420753d871ff7f8157
- SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRW:OrICteErownP0oTcMsABqlaOzo
- TLSH T1F2463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AE7B750
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1