93d2c264b58d3880e469330f8d2b122199172b640da20dc3447ad01787e628d9

User tags

Assigned on submission by the user, not by sandbox detections.

source:malwarebazaar sha256:61835d382ef64f3c890dc37a385a63fbf8b7c0af51b67cf32a50c2bdb22c088a

Sharing

Copy URL Twitter E-mail

General

Target
61835d382ef64f3c890dc37a385a63fbf8b7c0af51b67cf32a50c2bdb22c088a.zip
Size 5.2MB
Sample260826-wmvmmstdpf
SHA256 93d2c264b58d3880e469330f8d2b122199172b640da20dc3447ad01787e628d9
MD5 ce1deb464b1285b4a5161d56f337d1d0
SHA1 9ac8160b13a0439f2c535238e90b83455c5889dc
SHA512 61fc7eef0f30b26bd3642b4dbdd16f0b5120cfc9e2eaf2279f472754172c3e718e87a457ad989bba55ce067d6b6ef8c816c586e74d9983fb63842a6a79ceeb6b
SSDEEP 98304:R5NsBeBnVaPVmQzlwGCdGi3kMz4MhpC7vDufHXPRg3gDWhTbblHxiV3Pb1:RXsBoaPV01dr3kMzBk7CPW3gubhHItb1
TLSH
T1EA463321AD0C05C1D60D5FE0FBA73AAD11D080297542FDE65B21AB3F9A9107AEC3D6B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3751
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8774
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5948
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2446
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8436
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2581
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5552
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1488
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6492
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1943
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5378
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8970
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6481
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2590
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8490
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1851
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8513
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3793
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5498
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8699
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5101
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1202
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8933
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1413
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7658
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8907
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3675
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4917
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1998
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4554
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9063
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5957
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1924
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5885
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3595
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3845
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2135
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4133
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2779
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2428
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8632
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5564
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5117
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6102
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4951
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7451
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8341
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4842
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9490
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3846
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3240
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7191
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8993
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2783
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6632
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5176
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3734
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4656
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2611
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8388
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3123
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9656
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1545
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7180
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9533
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6262
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8447
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4493
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7250
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1458
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4431
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3146
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7888
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9994
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1107
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3245
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7150
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5864
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2386
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1318
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4584
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9990
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3888
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3705
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9998
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2885
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1501
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6491
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3454
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4800
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2604
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8981
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9884
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8692
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8305
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2907
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3964
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6863
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5469
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2345
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9918
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5014
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1846
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7626
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8555
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7435
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2706
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6305
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2047
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2911
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4876
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4813
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3043
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7266
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6691
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5114
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7662
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9233
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9151
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3409
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9652
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7505
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9855
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2292
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9029
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9413
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1494
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5846
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8034
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1210
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6816
Password
password123

Targets

- Target
  61835d382ef64f3c890dc37a385a63fbf8b7c0af51b67cf32a50c2bdb22c088a.exe
- Size 5.4MB
- SHA256 61835d382ef64f3c890dc37a385a63fbf8b7c0af51b67cf32a50c2bdb22c088a
- MD5 ae7048a05555f55bd8fc2adf226810ba
- SHA1 81d288057adebb84004bf2234bba68bb9b807737
- SHA512 7104cbd211d1ae7de8b9e7af936103b8cb678007e8a8fc82a6069955f6eafd38d4cd838017e16b5b1d27a1e0ec1c50f000c6b71fa845ac3c6eea22b77cd2990f
- SSDEEP 98304:yJgtdx2ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllKH+ZMqr6n1d:Hdx2ICteErownP0oTcMsABqlqBnH
- TLSH
  T19D463308B3E809E1E9B3D13D85665221D473B4254BB0D5CF03AC9B662F777E0AE3AB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery persistence privilege_escalation
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2