e6ac9bb6fae3ef00162b9afb517d5c961b7ed1192d66a7c785f0ea88ca6a6e54

Sharing

Copy URL Twitter E-mail

General

Target
FileZilla_3.71.0_win64_sponsored2-setup.exe
Size 12.5MB
Sample260823-cnpm8sdn4w
SHA256 e6ac9bb6fae3ef00162b9afb517d5c961b7ed1192d66a7c785f0ea88ca6a6e54
MD5 0d2b3b4d623f282e0f7e101e5f4bed58
SHA1 2c1f30218c449e5218fef1dcdad25b848ddf911a
SHA512 ea8815ab7dc98a4a28ffdf95bac7ba02acf9faec5213190c3b5e30cc3eb10028cdbf9bb12a6e2cf17270cbe2d81c2bd8783f2984036d23a4887de1d449c4e437
SSDEEP 393216:tl+h/6iOX85EO0gRiOZBCO8aXh20UHhnul1d:tlu/VOUEAkOKWRaufd
TLSH
T14BD633503914409AF424123DAF4B5DD2DEA10B72B2FA444A9FC1BC17B48F6B3B789E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  FileZilla_3.71.0_win64_sponsored2-setup.exe
- Size 12.5MB
- SHA256 e6ac9bb6fae3ef00162b9afb517d5c961b7ed1192d66a7c785f0ea88ca6a6e54
- MD5 0d2b3b4d623f282e0f7e101e5f4bed58
- SHA1 2c1f30218c449e5218fef1dcdad25b848ddf911a
- SHA512 ea8815ab7dc98a4a28ffdf95bac7ba02acf9faec5213190c3b5e30cc3eb10028cdbf9bb12a6e2cf17270cbe2d81c2bd8783f2984036d23a4887de1d449c4e437
- SSDEEP 393216:tl+h/6iOX85EO0gRiOZBCO8aXh20UHhnul1d:tlu/VOUEAkOKWRaufd
- TLSH
  T14BD633503914409AF424123DAF4B5DD2DEA10B72B2FA444A9FC1BC17B48F6B3B789E5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 33a6c41f262fe4f5f5eada6c3dca5d1a6512bf09bd09e05b223882630fd24e89
- MD5 9ba64ba25b26b3964fe1ca1d331387ee
- SHA1 305e7ef9bec45556fe2de80d0ab107f12a8f4eee
- SHA512 741f72b15f6f138c0fd0ccf799dd031c731e79b54eb417a615a04d53eed72891f92196beb03795fad990c158cd358b460ecb6eefed5fc2ef53400310b2249df4
- SSDEEP 96:ZIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/O3lkCTcaqHCI:+hE+A0+sF6piUFkA6lncviI
- TLSH
  T1DFF1C776F3D20673FAAB427428232F231B2AF521576981A6490316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 0893c4d31c7d9c2106eea64f10d6b17a00b742727662a883c39990bcee6a7d15
- MD5 a189f9b1c9ef05e23e5aed0bdb2a1bf4
- SHA1 584e9461cbb901aecabe61b4c3fbed146da0035f
- SHA512 d9f34ea10b8174c031b25dace65f092dacd0e582e3b8cf1779ca9721f50a896cdd3be2cb6738a7ae487a3f8dc1b4548045ac6ca875138003903b0e6e055412ee
- TLSH
  T1EE8173BB92E00CF3D0A44BB740A71CE362B5DD201756001F4A478AA92590B67EE7E715
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  $PLUGINSDIR/nsis_appid.dll
- Size 3KB
- SHA256 e9e1ba410636698d666b328eea71346b8287248d262e44da07ce8b5fa24c5e5f
- MD5 19071761e91c43c115a16b52458869b7
- SHA1 75ddb807157f1aa31a08f87be0270f60990bcbbc
- SHA512 bc0eab51cf27f657cd3fd62a47894ee13f3f561feaa565f16ba15088be39be73c9839a3cf35b538219ec83a03d48970b89258c5f20c37bcaf76438998437786c
- TLSH
  T15E5186A38B7988B1C0190B335A8714E572FDC31B229E402EFF98090B7E4065FD9A6160
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral8
- Target
  $R0
- Size 32KB
- SHA256 dda05edd3812e64152dd677e9e7084e9b60cb78b605be0d5e7cae351bc62bc8f
- MD5 b77298bfb80e98801f6b16611393dd75
- SHA1 f9857aad3e2840e81acb05e27b789aac4a0f93c9
- SHA512 4bf9ca82d3f11b6960db2b2e4a82770aaffac17707a5c3fa8587e61eb1a6574274c69193e42e015192505a90219bf56e78763fdcd590a248efde976c127ad33b
- SSDEEP 768:4/Bod79KZGU7L5oF6vPssQnLcOA/wd9j1lDibLH:4/Wd7TkXuIOA/wdp1l2P
- TLSH
  T157E24D06FE1168F1DED34CF46DD9D77B8AB135318D164AA6FB14C3487822B63A904E1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  $R2/NSIS.Library.RegTool.v3.$_106_.exe
- Size 5KB
- SHA256 e682c229a6453fa37ce380b59b4c28b5292b9caafd13e7972cab089f10996262
- MD5 2f86235a4603b89b4ae4debc33a22a72
- SHA1 e5a48f3444d0350bc432ff292b71ebc2c6cfc861
- SHA512 1ae90b4ed74a5598028572aa10121701c297d09efcffa429982c28b1eb71f98e6736addc73a23dfad5251493b65dbba52de9bf4d08b0845ed8768734cb600524
- SSDEEP 96:UBg4ARDDMDQB4dtVfhxr+qOspqME3zpHC5:YsDDcQWd/hxaq/sMsC5
- TLSH
  T184B1A617B9100972DBCA06720D569DAE7BE54567032184EA0EF363DBAA78C2749A4352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  $_36_
- Size 932KB
- SHA256 03617ef6705ecd575f209b1023c85e9f5e3ac174e2e2de088553a4536cb930ae
- MD5 f03205b2487fbda78c05fe108b8d672e
- SHA1 1b87ca18cef9961a3653a405c8104f45f5a58042
- SHA512 795a736541e0e243dbb8179e10c0cb8ca27946db03f1cee4fceed225daf21edf795534f5d5c12240bba6da3968038cd530ece2242f9409332df66eb14fc09ff3
- SSDEEP 24576:BGnKuf3luMuieVaGCCCdEU2nUR/65vPmvVqN:BU3l/uar2nUR/65vPmdqN
- TLSH
  T12615CFA33D8480B2E69E01B01579E7760B7D75350F2189D7A7E07BADEE311C1D23AB4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  GPL.html
- Size 15KB
- SHA256 f7e89c1edbbef8bc837b47c48113a2416f1af0cfc2b2218da39085465ea1045c
- MD5 11e176c5e0120ee94e365f999084bce8
- SHA1 a612f6d40d0d2ae045d80b60bce6fb6f81a811ef
- SHA512 d0532df4fe5e995df49f3e58127f5fc9637fc4f1afbb29e92ad16897c1055f77963277f5143458b9a294d1c24559bc594e0ae5469271ece639c8e66a5555d5a3
- SSDEEP 192:tiMUzQS+LrQWJz6Z6q6pdPIK8kV6AWRzdbDaz0pmN1rMbkBJ9R8/CmBHf3KWkc:tZUz5irJq6jIuV6fRzd3c0pmbMCzRLw7
- TLSH
  T18772836E774503B309C306A16A4B28DBA32EC578727E11A43459C15D236FE35C3BFADA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  filezilla.exe
- Size 4.1MB
- SHA256 edf7122d777bc0efddd7da1e75e8b75bceb9dd3b657f1ee997f60a75e7b320f8
- MD5 f801487e139ff3b7e2a3ef79a6efc409
- SHA1 da05541851f50a0ccf4f38bc731b8284532bb180
- SHA512 bd08746ddbc6d28d58db5a69c0052307dccea754aa521e53218734c61a29f711ad1a83b7e18624d5554b9c6864cb1002260708750b02ff56642793a8ba96c280
- SSDEEP 49152:oG6+WoNjnguam8/J/P4limr9McDSP/NgSPLRPNvUWCFtwOTuaoyqtkJSTOwZsKSt:f7PNE+OWu4STvZrYNl
- TLSH
  T12A16C517E652858CC47AD178876AB6336A72BC0D4530375EAB51FF322F52F60923EB18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
behavioral13
- Target
  fzstorj.exe
- Size 9.8MB
- SHA256 85b3a68db2580661a4124e9c2f5ec2847f14804080a90444eb3fc701a54164e9
- MD5 06a07c0f46864540536affd46df370ec
- SHA1 bcf20f591737f5a92e5ccc5859007151332bec89
- SHA512 24bca00debc81888915a2fd32fc46b6a6471cb868fe3fb724eaa297cc56b2826c6ecd614bf2cbb6f28db99f74c98ff2ab9a4493c0592621c78f1016a82d2f943
- SSDEEP 98304:00jMdP9uE9l22xij8Y3G78uCAR3AYGM/dOi/:hjMdP9R722xij8Y3G7zHRGQwI
- TLSH
  T1F0A64B07F8A244E6C67FE03096559222BA71349543317BDF5E94BB9A2E22FE4B73D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  libargon2.dll
- Size 53KB
- SHA256 d952997d39cf544582197aae1d222676ef547a318a3ed5bc6e9af01e4ddfbb7e
- MD5 87c8a3f3ffc6b4f9faeefa18cc827944
- SHA1 640217d62fb249111a33fb0ddac01f552f74212e
- SHA512 ed71921fba6d978652365383b2780a6abadf70c61837df90eee52955d143fd17bc1721a5b0fe7b42aecee9174d3a7be34b24df6e906b27a48214df103b44ccbd
- SSDEEP 768:A6knff8caxdotTEYWzW9yS918h4en/g2akIE5rrRsQhQdwd9j1lDibLC:AHf0caxeMGm4l2akI8v2dwdp1l2a
- TLSH
  T1A1334B47B66370FCCA27C0789697A77BB972789156602DFF4290C7352C39E20272E61E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  libfilezilla-59.dll
- Size 1.1MB
- SHA256 6cbae5cf1a5c7bd68c8bfb2fe58f58644fc228b379a7ec521605939fac88e3db
- MD5 8e0076a29d25ed5f3b443c7d8a923ecc
- SHA1 25a66faace02122c145d8a8f87e80c95efde2d7e
- SHA512 0fd7c13d429947db68f3b3bb13bcc76a8330470637b15f34ff03e65dc931fe47d34b46124e4153016ac3e56d6bf4762e7817f8c27d9ea9d37b7066ee60dc135b
- SSDEEP 24576:Bb/mQujXmiOrXdHhe7+F7YBQbDtQIxhwr:1/mxEdHCsD9W
- TLSH
  T150453907E2A755ECC43FD5744317A676F831BC0846387E6EAA90DF312E22F60966EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  libfzclient-commonui-private-3-71-0.dll
- Size 662KB
- SHA256 828c8a45fab071de90a7982fdfbe0f425a2745aa8cb7b95b332554976f38b492
- MD5 fcedf5ac763a7a931ae832cafd7b37eb
- SHA1 61b91547ff5e733eaa3ddef5028c1ef2ca4f589f
- SHA512 ebe2efbaf71210010a27a851c937615802713957df0a66c43167f7134dddd65d333504d55644cad95c7e389a927d5cea93db61095d17ebfe13a7d39da3ae81b9
- SSDEEP 12288:g5S/5qbdDtmtJDcghboRet3cUsC3V0cMiJjoJ+C0iuqwq:g5/NPas6A70C0iuqwq
- TLSH
  T1B0E43A17D6A311ACC47FD1749367A673B932BC0846347EAE6290DF312F61E60972E728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  libfzclient-private-3-71-0.dll
- Size 1.4MB
- SHA256 508b825a4a4442f1eeb91cefa1cccdc734da3142228d69d335a3e2138ecdb660
- MD5 99029cc86c6dcedea01737685e1345dd
- SHA1 844bbafe5d57a41bd7928ab0dc152038a511d4b6
- SHA512 555b79174cb5142d6fe6068a4a3aa3996b13cc243cc3324164b3d527597abbcaace14c8bab56b97badf84819abb4d6f14a14946e8d7c803dd90d5d0a1d382e40
- SSDEEP 24576:bv/SEAnyph1zo+w+UBV0mjObwrmjI1IAgcejwM:bv/SEkyph1zo+wlomjObgmjRAi
- TLSH
  T172652917E5A3059CC07FD1359757A672B932BC084638BEAF2560EB352F60E70972E728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libfzssh-14.0.0.dll
- Size 393KB
- SHA256 2196ac7754c64aedbcd1bc7b791e6ed5eaa058818b1bf92a12284fd846f723ba
- MD5 e5d6d77dc02c4872a393ce522ce64d5f
- SHA1 d360f236afdf02ab29156e952666913207a61f2c
- SHA512 910cad35a6c22705dd69b92a77065ce6610e09c5553606495921e52c3d6cfb1c9e871bbdd08342ff37a388ce888dae3b5aaf7aee69dc2ce8633d05fc2b566ec4
- SSDEEP 6144:Jg9NnZCZJV4j1KkfQyq1JxQdZaRK0VjkBi2VSPI9QgObZj2SF5eFbzwdwo:69dZCZv4nQ9D+ZalVQBii8j7Lwo
- TLSH
  T172841717E66694DCC06BD1B88367A233B531BC4C46747A6B9BE4EF312F11E60963E318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  libfzssh-client-14.0.0.dll
- Size 191KB
- SHA256 8962cc1f87ccfc37561bd441fe1a54fe1ab1e3353b4d6deb38d899f4cc511719
- MD5 0d9ee3d228ff022cf51ae4f8f49d580e
- SHA1 11219e30c2de023e54e45c6cd5d14693a176287a
- SHA512 652a9d32ad01b5942c04ad9d4006879eca8e384c36d65ffdac95da492fbf2067bd6b156a7817e077af38a39ca7f697061fa5646ed61617dbbcfd12ee3dc5da35
- SSDEEP 3072:ZTr70iPGjOEF5qETLKJrpc84ibkrPIIprN3aTS27dK3PDxT+3/CSYw5n+IV8QC8E:T6F5qETErpz4ibkv62uFbxywdwh
- TLSH
  T130142817E16B54ECC06BC578839BF673F532BC981734796A6B94EF311E20E60922E718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  libfzssh-crypt-14.0.0.dll
- Size 46KB
- SHA256 3e8d466bf868d1e2dcab5e7aeb5d69cf3f24aa8441094fd57d6e4994e1edc6a3
- MD5 39d362f62ab0ab6ca8a31aab17b76f52
- SHA1 60b3cc9826bbe4e9c37e7326ec06ab482cc6758b
- SHA512 707a536b6e3ff6f2aeab5fb2ca9e00dd31731f53460e173246f98881dd450eb374a08a0de9adb822e15279b9aed36e0cbf71d4700d702d389867ba1b4896d14d
- SSDEEP 768:7oOvk5fcO6GlGU3JRgJmtQ9DgLa1dvTowd9j1lDibL3B3I:EOvkCO6eP34k3LaHvTowdp1l22
- TLSH
  T15D238D4FB71274ACD986C47452DA9B33F9B0B81429A1BE6DA3E4C7312D11FA15B3930E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  libgcc_s_seh-1.dll
- Size 156KB
- SHA256 67eeecd6f9b90721bea64414d93b36244e2f6400250183191eee01729a5aba3e
- MD5 2e2d46ad4c706579621cedc2b85019bd
- SHA1 fdce808704e83ca863fc71d3561d6bef08da0152
- SHA512 3333d4290dbbbee36b5341797d06ce023b95485c8c5baf5a72fcdd7c8056644760049de7cd4b700c538927d15011aac2ecc2064ecb837b748eb81d55f8eddaa4
- SSDEEP 3072:8EKtS2Olk2Bu0JJaSopGwv+9N+ZYRHvwvmLEL5alkjwdp1wA:roukEdopBFfvHwWjwdwA
- TLSH
  T18FF33A86B5E3707CC10AA5304AD3AAB9DC32FC7493608D7B12A4FE356DB2F903646765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  libgmp-10.dll
- Size 634KB
- SHA256 3229c72bf94ae701ea3d1985bd069ed1a5fe63d480cf1ebdb97aaaee28541815
- MD5 b8740d25bc8091906d94286df41eea96
- SHA1 50d156bce87201d69f331d8ca2fbfdd59d485169
- SHA512 349a1c71eb5feb9bd7583cc096b2cd412fc41bacfda043faeb1401fe1bc5e039896b1301cc28fb3117218b5ae3bb67f25c97d987501d808d9cc0dea076865ecd
- SSDEEP 12288:ncmt5OEL4lr3m0EpCiOaOKy3yQs/IoKwAG:cmtAEL8JFa+3y//FKwAG
- TLSH
  T1CAD48C37E0E378FCE267C2B1461AAA73B971B4550220BD3B06D0CB312FA6D605B5D769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  libgnutls-30.dll
- Size 2.2MB
- SHA256 dd7b1696051289592ae00e306a2796ee4e96215349ddc0879433433a931a2e67
- MD5 cb577a1a8d5f9ebdb1474e9e7ad1cb1c
- SHA1 3a5072a8a5af7864c46808d136dbb06476134793
- SHA512 bd604d7f22282dbc2496ba198fdbb91ebefe3c44b5af27d0fa6d6a1bdb6c768f654b6a2f2480ed86b79a8335ecd1d51f686ee8c0fcd1b3f069da579c84e583a7
- SSDEEP 49152:7rJ9+6MqoNwOTjCG11gqadsM3KSr5TVB0Gtlq3Tlz/wVDEArXk2XAxOjFKEO:H2NbRi0pz/zOsv
- TLSH
  T14FB54B02F5D2A9DCC937C134CA53A2737672BC246930ED7B6E94FA786E31DA0171AE14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  libhogweed-7.dll
- Size 262KB
- SHA256 f88f77a76f70b5382712087524f8d57daab7acf4270381fdf3e67c2a07debf81
- MD5 34dc4c8130acc58ed28cfe71c2ba26dd
- SHA1 174dec2d4b6a527b155c7269a800bd1ba25d07f9
- SHA512 525e7d1d2088325006ac6282d176e9a3d4d7843f8650af1358c5942f795f2045b6a65d48701e2338f54d829d37d26ffa59fb0fb31870697f23094d5e80130f04
- SSDEEP 6144:oCATA6kZOFlKSfwDSp+p5WgmHurS8lNvwdw+:yTA6ZFlffAWu5DmInNQw+
- TLSH
  T17044B013E2A568FDF77F4275465576B321B4FC500AA4AE4B6224FE743DB1EB08B0A21C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  libnettle-9.dll
- Size 331KB
- SHA256 1f83a4b3667d56009b8548f05d3eb7f7820db67893e8ea72f67e3aec100b9712
- MD5 339f652580cc01b91feacaf778657b33
- SHA1 83fae07b6a6e61796c3be41f82742eb2da928f6b
- SHA512 1a61d0e8fd9e71de838d02db774baa586d26b394ca0657d390ff482b5740f89e61aa93122e1d807a582fbed9ffeaaa2d1b565a0daa12bed4b49b7224c17506a1
- SSDEEP 6144:Y5Y8eVnzX3cGO9W7JznoTqqDpooF3wEx77KEwdwW:Y55YwGO9eoOqOoXcwW
- TLSH
  T1D2749F4BE9EA20EDF667C230866B93337431B85407487DBB5748D6343E22FD0966A96C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  wxbase32u_gcc_custom.dll
- Size 1.8MB
- SHA256 80e7d516da36290da156830ba7538d90b8732fa832f9215c953d4717d2f656a2
- MD5 bed9f0de4db63121af8a367289cb73e6
- SHA1 32c05df17032636944e188a07ca9f371dbf2ad92
- SHA512 fc6df9fa44c3b0e441331ab33bdd0475772916199bdc8579dca59e19384a0937bf3b556f0ac1fe7fd63711baad937e972597e0ec67d98616cbe5b1c03e7463da
- SSDEEP 49152:oxBu+FZjIsTV4bYrjgKZzeUuwbyKK/0QXcD0nne/9IvypSHdo/C9:oxBxcJajJZar
- TLSH
  T146951887E653859CC47AD179836A63727A70BC0D403A7B5A6794CF31AF11F61A33EB08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  wxbase32u_xml_gcc_custom.dll
- Size 240KB
- SHA256 88ba66287ce0271d8fb67bfe6e27322106855c1bb9a05b6e7c2f7db2ac87a366
- MD5 5acbec949c3920cdfdf3d50629607cb2
- SHA1 cd591539917a1ada7feea320bb56ef555b341680
- SHA512 0df09f037ed2deb8e83786564aeafefd747a707026edc511af4b1cc903e5ba2efcf580b7ba27bbd96cdb9caaa8daa3cf8b8302a4ac67b69c804c2d9fe6f9e341
- SSDEEP 3072:A/B/PgF0a/R29b+QcRQY1SqcvUv8D4jIVkGu/zsrzwML3QFacs/xLojUUOUdUqUb:nh/gIr96UjIV+/Qnng4IJmv+0jOwdwTU
- TLSH
  T113342B1BE1A394BDC45BC13483E796B2A533BC3106317E7F5294EB396E23E50662DB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  wxmsw32u_aui_gcc_custom.dll
- Size 512KB
- SHA256 8dbc3e9ecd3e9beab19278871c940c1700e9a605c91dc30ed5a5d78f3c23daf0
- MD5 e209efeb0037a13e4a4900ce5759dc6c
- SHA1 6e01e67addda7d87b7a23bed665830d7fa520293
- SHA512 d8f74c5359b77d27f2c466f00bd2ffcb6a00f9143b846876c7a5c1fa1ca1e4e25e89e539d56bb81d20e6cb17ab23919012f4d14446ff5b3f984c82445c8f3545
- SSDEEP 12288:Qw3NCasKSAWr8RTn0c3JYs1gR+QwqBFd1FpQTzXaDK1/pDjGLyyyF8wE:t3oasqWr8F/3JYs6R+QwqBFd1FpQTzXQ
- TLSH
  T1A2B42A07FAA34B9DC47AD13C4B5B9172A9303C4D21303E5A9792DB326F51EA4A73B718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  wxmsw32u_core_gcc_custom.dll
- Size 5.1MB
- SHA256 1e84d0a7fc427b1f4923130049c052db1840644f3541314f5474f60d1285df06
- MD5 229d81771f7a70d1eacbbdbfc7105cf5
- SHA1 4d219356efc121719c6c76063b66f5603e709031
- SHA512 524319065efeb03abca8d12e5cab5b45328b411f9ed407f3988c110762ff6ab492320880d9957e1687092d026d9ea810d39f6b1503e7a8d543b2cece03e02604
- SSDEEP 49152:mec1o14/1rVj6lkmIEX/Km0h3o7zrbHhNXa3Lps10cgm73BEXpRUNXz9h4S48ge9:meYtoTz3XqWTG5wJSSrg8wQrUTW
- TLSH
  T1C3363A0BEAA384ACC1EBC1389A6BA7717D31385505307A6F1654DB322F21F71673EB58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  wxmsw32u_xrc_gcc_custom.dll
- Size 796KB
- SHA256 af51b820fb46cbe4fa875ce1052d72905ed114c60d41033f319e4ef553141c20
- MD5 c569fcd41e9b86d54ac13e13833bc5a6
- SHA1 83740d26fbf1478a7846bd1b864c52239c7b09c1
- SHA512 9c9159fd1a0ad32f87600f9459c66645a3de64b3dd2af3234a9e86ad85e528ec80aa8f4bfc904cedd947e240cee0c054aeb81978d962393fc12fd341626d810d
- SSDEEP 24576:mOSUBGIgffpiec4wQZ0aSAJGXucjGsywcwv:JSKVgkec4wQZ0aSAJGXucjGsywx
- TLSH
  T1A005072BFA631E9CC57ED23856AB72737661380845747B5A6690CB323F10F71963EB08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  zlib1.dll
- Size 141KB
- SHA256 98488ccc6ce44fb1521657cccbea55bb173ad8d0a63f8ab3a927e180125a3201
- MD5 dce4e9645bb804d57cb70b78d4b3db21
- SHA1 9158a62440cb0c0ee964078d289ca47b9d8fbac3
- SHA512 2dd36ed661c22402c7ee566fa7da51fbd8fa44b8c9e3ccc2d5027fc7c3888dea2913cca8ed1b455fba0ab9ef54b146d48cdfaa9a9ce2381e7fbc4dc40cdcf672
- SSDEEP 3072:EDMD3+SQ1Vwm4Mn7/STiHpgh2khtUUFawdp1we:EoySQZ/KpphtJYwdwe
- TLSH
  T169E37E8AA6A224BDC7B7C07046E64776F932B8215B30ADEF5158DB741E12F406B187FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads data files stored by FTP clients

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32