General
- Target 0d64d1ee6cac7d724dabef0f3efc4c0e0d896ac1eff42fa47135fdbbc7081d4f.zip
- Size 5.2MB
- Sample260822-t2w3xaaj2w
- SHA256 0abea84b83f52aa16895edbd7d0f86f61fb8c4f32300bd295136ec1efb4761ba
Malware Config
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4650
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6011
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2189
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3231
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3878
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9226
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4469
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4364
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8450
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9895
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8929
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1865
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8343
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9214
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9460
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9975
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1723
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1806
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7419
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1466
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6348
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5440
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1600
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7211
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8566
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3271
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4682
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4060
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1448
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5776
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3601
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7440
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3287
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3921
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8833
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7558
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5578
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2119
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7259
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7583
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7311
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7043
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6451
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7491
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5785
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4285
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7886
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9107
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5094
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3070
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9916
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3429
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8608
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9061
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3075
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6596
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3865
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1570
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3837
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7593
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6593
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6240
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7899
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6341
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4550
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6055
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9647
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1982
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4251
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3922
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8733
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2338
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7256
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4855
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1029
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1040
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6461
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4003
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8919
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7809
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9659
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3033
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4707
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9072
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4068
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3571
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4983
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3542
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8542
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4223
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3696
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6203
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4385
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3034
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3792
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7161
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8653
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3646
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5750
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3617
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4639
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1105
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3022
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6403
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9493
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5095
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7571
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6386
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9485
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6745
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8550
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2624
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3885
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8644
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1129
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9887
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7423
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1855
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2585
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8940
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7855
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8743
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4593
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3126
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9671
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7111
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5116
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9187
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1234
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6672
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1268
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7017
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3547
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5894
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1279
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5124
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3185
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7413
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7580
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1071
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2515
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2553
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4278
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7331
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9974
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2491
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2405
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1877
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4865
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9678
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1309
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1099
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6902
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3548
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7450
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8808
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3660
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8514
-
Password
password123
Targets
-
- Target 0d64d1ee6cac7d724dabef0f3efc4c0e0d896ac1eff42fa47135fdbbc7081d4f.exe
- Size 5.4MB
- SHA256 0d64d1ee6cac7d724dabef0f3efc4c0e0d896ac1eff42fa47135fdbbc7081d4f
Score10/10-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1