8d63aa52aeff1f93a3706779959bc557d1cd2528e126ba00c8e121f56ed134af

User tags

Assigned on submission by the user, not by sandbox detections.

source:malwarebazaar sha256:1b4e93a616c395b655bed6a329bd7e9bf33282fd253e2e1f967791149ec56036

Sharing

Copy URL Twitter E-mail

General

Target
1b4e93a616c395b655bed6a329bd7e9bf33282fd253e2e1f967791149ec56036.zip
Size 5.2MB
Sample260831-p68kaasdkc
SHA256 8d63aa52aeff1f93a3706779959bc557d1cd2528e126ba00c8e121f56ed134af
MD5 b494e06835ba82d2e6a2be2a59dde06f
SHA1 9a38f00fb1f9d8a94c2a82e8e558be55ea5d3a43
SHA512 9dab5baeb863d9cba6be9f365eeb0e202ddea30fa723c5b822ae7c0dfea8e82e28cf301b4103fba75120b7c3f8d9950c0335e83a64f94eaa17dc4b0d7ff3ec44
SSDEEP 98304:X5Gknn2hxoTOjmxOeSjdZzpg1KyRNxdP3dlAdlc/05nXcJT5Mi:t2hxoyjyOeS/zCDNxd/HgS05nsJ3
TLSH
T1324633DF50AD9CEE392D3CAF0966C3040A2681775346B24FCC7066E975EA4D0F9187AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1338
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7138
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9217
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2568
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7995
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8958
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3130
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1577
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2387

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4984

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1242
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1911
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4292

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6909

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1549
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7769
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6250
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8172
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1996
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3224
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7722
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6361
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6106
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8795
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5864

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8500
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6999
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1166

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5188

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3037

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7262

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9174

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6532

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3991

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7124

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6337

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7796

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5866

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1958
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7832

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9379
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6319
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2101
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6139

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2872

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1982

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3243
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4096
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9530
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7697
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3074
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6274
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7091
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8321
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3789
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3092
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2239
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4189
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8713
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4716
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8642
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6753
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2242
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4634
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8731
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5924
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2984
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4576
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4876
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4594
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2368
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6771
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3704
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6710
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7925
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3675
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7975
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2740
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3609
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6189
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9079
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7222
Password
password123

Targets

- Target
  1b4e93a616c395b655bed6a329bd7e9bf33282fd253e2e1f967791149ec56036.exe
- Size 5.4MB
- SHA256 1b4e93a616c395b655bed6a329bd7e9bf33282fd253e2e1f967791149ec56036
- MD5 fe3603f7b191a0d8e379004f7f90b802
- SHA1 535d02c5cd0286868678bd6ef389ab44f8b2712a
- SHA512 754383cfb8cda748ceabef215c63227a7fe17fc707469a9cf4f1710fb5a1b5bebf74a31bb6c53b2f0c0558eb0c8773155b6a63419b14271504023464f73d6431
- SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRB:OrICteErownP0oTcMsABqlaOzv
- TLSH
  T18A463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AF7A750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery persistence privilege_escalation
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2