General
- Target 18a02dcb77a8283415a840f21ba7d2fd6f918662e6f92cb98a17fcd10ba725ea.zip
- Size 5.2MB
- Sample260831-t7fccawfma
- SHA256 8d24afd0b7eb2e55c8e5e2eb8c32e69f7b1c8954dbecf6d5f2beddc629b23a15
Malware Config
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3635
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9595
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9472
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8729
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9030
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3330
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9600
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6636
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7610
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4298
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2488
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7631
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4000
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8378
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7235
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5636
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6490
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7381
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9590
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6374
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9772
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5296
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5476
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6827
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3442
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2606
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7432
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8423
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5574
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6169
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8636
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8374
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5538
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5780
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8788
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7444
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7659
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2311
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4823
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2134
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3835
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6066
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4227
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9751
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2985
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7320
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7763
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9974
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3285
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4524
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8066
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7237
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2170
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7148
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2859
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8225
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3559
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2661
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1098
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6840
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1391
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6810
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1706
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5650
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5943
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5324
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7191
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5514
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5004
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5763
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5254
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9608
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4974
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4914
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2013
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6865
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2963
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6590
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5437
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3468
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4991
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4716
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7405
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5507
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7261
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6219
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2822
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1040
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5154
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6493
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5073
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2537
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4021
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4431
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5000
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6884
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3465
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2862
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5941
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3674
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5139
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5397
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7028
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4257
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5441
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9942
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5991
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6756
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3857
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7784
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2577
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3281
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8677
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3350
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6983
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8960
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1624
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3618
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1612
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4758
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1533
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5157
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7033
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9753
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9650
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4989
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7585
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7517
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8971
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1279
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6699
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5682
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5693
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1580
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9449
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6675
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5969
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4063
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9385
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6012
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6633
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6877
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1324
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2950
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1249
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9631
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9605
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4109
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9648
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4292
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3560
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2960
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2980
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4309
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5172
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3151
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9419
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6807
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1587
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5790
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9835
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4817
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7331
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2928
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6335
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4083
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6964
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7100
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2771
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9501
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2776
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8389
-
Password
password123
Extracted
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8145
-
Password
password123
Targets
-
- Target 18a02dcb77a8283415a840f21ba7d2fd6f918662e6f92cb98a17fcd10ba725ea.exe
- Size 5.4MB
- SHA256 18a02dcb77a8283415a840f21ba7d2fd6f918662e6f92cb98a17fcd10ba725ea
Score10/10-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1