053e925e4647b0b405b61fb87c97fd4f4105c9ea7f4e3164cb1c49dad4175bc2

Resubmissions

05/09/2026, 20:11

260905-yx89wshp2t7

05/09/2026, 20:10

260905-yxtjfafg3910

Sharing

Copy URL Twitter E-mail

General

Target
20260904_065630_ftp_212.112.118.108_info.zip.zip
Size 3.4MB
Sample260905-yxtjfafg39
SHA256 053e925e4647b0b405b61fb87c97fd4f4105c9ea7f4e3164cb1c49dad4175bc2
MD5 4ba31264d27c759c4acfbc34feed67c4
SHA1 9ab055cf886c4dfc9b5a71186ed30a97c3266711
SHA512 7e692dd07e77e714d599fa0a60fc98881efd9766966a158603598f4a6f85979df27f4192cfa3f8fdcbd2869f1d505599a43bd1e6a8534e4526e2f5a4e8b15696
SSDEEP 98304:7dakvH2lm6SUjtbc7CafA4g7SYZkmO4XXSWdi1gALFlg:7dfH2k6vbcffVUZLXDdi19Flg
TLSH
T17BF5332F3748F56967C9D14F2431E57E1105339A3A400AFA3C9D84E4489EB2BBDAFB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
ftp
Host
182.92.102.5
Port
21
Username
root
Password
lol123

Extracted

Credentials

Protocol
ftp
Host
66.117.14.6
Port
21
Username
user
Password
12345678

Extracted

Credentials

Protocol
ftp
Host
154.213.127.9
Port
21
Username
server
Password
lol123

Targets

- Target
  IMG001.scr
- Size 3.4MB
- SHA256 d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c
- MD5 fbbcf1e9501234d6661a0c9ae6dc01c9
- SHA1 1ca9759a324159f331e79ea6871ad62040521b41
- SHA512 027e5ea6d92955b87439f61704de5b3e21c7a8e0a95327868951968e4f5cbed59cf1e803ac9adb2c9cf577db7a2f6fd4383b7384d57a78596cfb2ff020907140
- SSDEEP 98304:M5VPnq1y5tQOM33ZNqCtBixHl54Oyjes1Ro6:2VPq1yLanrqTr43eON
- TLSH
  T1E8F533259387902DC0498230788B2B66D37ACC173D0A17225F4277ADFE375EB7E8E656
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution installer persistence privilege_escalation
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral1
- Target
  $PLUGINSDIR/ExecDos.dll
- Size 6KB
- SHA256 42422d912b9c626ad93eb8c036ad82ee67cfa48cf75259c20c327eddd4cc376f
- MD5 d7b975049ec3aba50e4b7cc654a28214
- SHA1 25f2578945ebc9ac037fef7b7f94c5d48e42388b
- SHA512 f95f7875aeab586d42ee48029f7feed6e2fd8a7d106671e225ff5cf9ad83375f0ec3b8b288177c5d48b4c51eeddde687d67e7b07ad324e24059cff0a6516c270
- SSDEEP 96:31pNOe2w5QbJHsBiyw4uM4jEFVliuOtac32FOeSMV7WhWD:dj5Qb1sBPuijiu6avTyhW
- TLSH
  T18DD1B5797BE040B3D2B647303D72526793BDFC200B25E2AA4B571ACD2C90D54FD21BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/inetc.dll
- Size 21KB
- SHA256 67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
- MD5 d7a3fa6a6c738b4a3c40d5602af20b08
- SHA1 34fc75d97f640609cb6cadb001da2cb2c0b3538a
- SHA512 75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
- SSDEEP 384:oW4gLK82JvtosNCPhXKJ18hcEP1+f+pvMPbkdTg1Zahzs60Ac9khYLMkIX0+Gbyk:oW4i/2JloB5IQ9AhkwZaKRu
- TLSH
  T12DA207425B414AF3D3B60634707A33630769FE72246655DB86F32AC97878393EE36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $R9/NsCpuCNMiner32.exe
- Size 1.4MB
- SHA256 a0eba3fda0d7b22a5d694105ec700df7c7012ddc4ae611c3071ef858e2c69f08
- MD5 3afeb8e9af02a33ff71bf2f6751cae3a
- SHA1 fd358cfe41c7aa3aa9e4cf62f832d8ae6baa8107
- SHA512 11a2c12d7384d2743d25b9e28fc4ea0c3e2771aca92875fd3350f457df66c66827d175f67108f1a56d958f3b1163f3a89eedb8919bf7973d037241a1e59231d5
- SSDEEP 24576:gWKqa4hnzP3w7L3rmZmpk7FSQFW2iJ+N07/TwYV1CdZdQ+4lT+iFgiGTtswAtdz:gSrwf3aZmpOFU2iQNIUc1LxGTtswgd
- TLSH
  T1C66523D22F67A174D08A073C732DF3BD117D60988A935EB0A68157EAF41F841399B36B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery vmprotect
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral4
- Target
  $R9/NsCpuCNMiner64.exe
- Size 1.5MB
- SHA256 d0326f0ddce4c00f93682e3a6f55a3125f6387e959e9ed6c5e5584e78e737078
- MD5 eedb9d86ae8abc65fa7ac7c6323d4e8f
- SHA1 ce1fbf382e89146ea5a22ae551b68198c45f40e4
- SHA512 9de3390197a02965feed6acdc77a292c0ef160e466fbfc9500fa7de17b0225a935127da71029cb8006bc7a5f4b5457319362b7a7caf4c0bf92174d139ed52ab5
- SSDEEP 24576:Mf79KQimeoyEgM8dSGDeCAQ4GYwEkYEDI3BiiVzKJo23bvH5xh8wtDzgClYAdC51:b3EciPG9E/LBVeJo2Vsw57lYAA51
- TLSH
  T12C7533DB854E31CBC243C770A5FF1E641022274AD1209349E37A279E8A9F2E5B7D9E74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

vmprotect
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5
- Target
  $R9/Plugins/ExecDos.dll
- Size 6KB
- SHA256 42422d912b9c626ad93eb8c036ad82ee67cfa48cf75259c20c327eddd4cc376f
- MD5 d7b975049ec3aba50e4b7cc654a28214
- SHA1 25f2578945ebc9ac037fef7b7f94c5d48e42388b
- SHA512 f95f7875aeab586d42ee48029f7feed6e2fd8a7d106671e225ff5cf9ad83375f0ec3b8b288177c5d48b4c51eeddde687d67e7b07ad324e24059cff0a6516c270
- SSDEEP 96:31pNOe2w5QbJHsBiyw4uM4jEFVliuOtac32FOeSMV7WhWD:dj5Qb1sBPuijiu6avTyhW
- TLSH
  T18DD1B5797BE040B3D2B647303D72526793BDFC200B25E2AA4B571ACD2C90D54FD21BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  $R9/Plugins/inetc.dll
- Size 21KB
- SHA256 67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
- MD5 d7a3fa6a6c738b4a3c40d5602af20b08
- SHA1 34fc75d97f640609cb6cadb001da2cb2c0b3538a
- SHA512 75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
- SSDEEP 384:oW4gLK82JvtosNCPhXKJ18hcEP1+f+pvMPbkdTg1Zahzs60Ac9khYLMkIX0+Gbyk:oW4i/2JloB5IQ9AhkwZaKRu
- TLSH
  T12DA207425B414AF3D3B60634707A33630769FE72246655DB86F32AC97878393EE36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  $R9/Plugins/tftp.exe
- Size 95KB
- SHA256 73ddf0df4e9e3866511ef9eae421b11615b81491d0db1d4a7ed19441e368ecef
- MD5 21e42b4fdb800644335dd8cc95826c7b
- SHA1 23ec304fab33af1cacf0a167aeb7465631286128
- SHA512 7fe97cc38afea51b8b8776c860d49d3cac92df63f6acd4f647056a6210288ac387d499e8f6f281cdd31d73e6f1218bc08baa696b0c7c8d33d55543875c1be7b6
- SSDEEP 1536:NW7lchydMBUxt/lP8KB1R88EKaoLQWAmcTGI7Unt:MChye+x38KrRLMUnt
- TLSH
  T123931B95FF4700F0EE1706F014ABE76E6632E501983A9DEED7C95E439CE1E92044C6AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery
- Contacts a large (1027) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral8
- Target
  $R9/Stubs/bzip2
- Size 34KB
- SHA256 a32a41c520aa1d08d8e5cbc18c1994f92d47bede5cb8d3aca761579d242d249d
- MD5 7ac2315d458a6c78f81f7167b164ef37
- SHA1 f501956f346fe7ac49454f5eae54907eeb247f1d
- SHA512 00802299e1161ac3a3849678a0515e2ed4548a9c1397635fb546683a525f2dbaab8b90875d81821bc66b76c6669a309922284e818f510fb0d81d0c317458919b
- SSDEEP 768:FqVnDX38+t1ehxQ7unyskUplx3tUeLTjWfgeOVGM4jjfS3XJvai:kjs+t1ehxQuntkULceeM4sXJz
- TLSH
  T131F27D1622F1887BF5B6073149B7BB36F7BBD600011155636B742FAB2D31243DE2A28E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  $R9/Stubs/bzip2_solid
- Size 34KB
- SHA256 5a9ecc6d9dbd32c54507496f022ecca949e18235bb0865e1aa345eb84e6af0cf
- MD5 0a108faf2f740e2b1a97d64985fdd1b4
- SHA1 e349e668f756ea4b9460bcb2be54504dc357d3d1
- SHA512 3f27d919d40dfbd431c1516a8803178d5e699f91856e8f9616b7f3fdc755af863f25c29cf08191775ab04d1457a0db8741e1697a66bd2c84252de58942c16faf
- SSDEEP 768:/Jyky/Nki4Q/JRQ/RZ49ylKR2e7jbEcIKFvGmjXO3XJOai:hiki4Q/JR2RZ49A1ecjXJ+
- TLSH
  T1CAF27D1661F1C87BF5AA473249B3BB3AF7B7D600051156531B602F6B6E31243DE2B28E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  $R9/Stubs/lzma
- Size 33KB
- SHA256 b72d402fce699b21bbf0a4a86ab9fb7f8a083aeacd4f797be7a7f6f91ef93d62
- MD5 9557ea4608e64b857c1125eb41ba7429
- SHA1 d7276eccc032919c84fc05f206d3cdd0b40fe1fb
- SHA512 8eb238cd34668c12779553b7ef15cbeb4d8dd7aac36b5f044c680b83b04f7e2564905625e14ae5c5e06e4e9b5ccdb1663a08aa63a95e176266d59924061a6ce8
- SSDEEP 768:/ip/4K0wirQK33PaH81Fej4w0kGvFONg4jjfS3XJWai:6Zr0wirt3/aEecbsg4sXJW
- TLSH
  T11BF25B9636F1843BE55607304AB7EB7AFBB7A200162156576F601F7E3D21282CE1938F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  $R9/Stubs/zlib
- Size 35KB
- SHA256 c96383fe97a213140741bf5df71f322753200c094cb22db634e050d2be744a4f
- MD5 346d3c8665f307a06aba85f8745360e8
- SHA1 de87ba7e2553f0efd531d30d6a5997dab9a6bc2f
- SHA512 6d9910251618226bfd94c94661b86db0b6c07d5dbc5445cbd0ae7bd34fc42e0b2af53fbd14b57969cda9deb747dae7837209eb4c61b4b130b0170f584b839aa2
- SSDEEP 768:x0gFJMBrbxJQJFiXDYwQ5NTdKqP5sCOfZ7jrG0D3cjfS3XJQai:xfYBrbzmFizYwUK1G0DRXJQ
- TLSH
  T142F28E06B7F1897BE596473105B3BB7AFBBBC10016211A035BB41FBE3C612839D1A24E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  $R9/makensis.exe
- Size 484KB
- SHA256 572a6f9cb5b37b6eec13b578d346c2568ce3ec88bb711d75dac9e82fc01c8860
- MD5 e79833cb0d7b2573819ded2122b57bdd
- SHA1 71ead8cd4a95704a0cade630bb3ce280af7e028e
- SHA512 4b023e60392ead0691621a1306286fda6cdc4c447f164c8f249c59db2500d8b98514d93c7a7e8d3cfd60818d2ca74e84ec24163492765b6c17fe94ea0385bd69
- SSDEEP 12288:LhHlj+wtKJVIo9ZoACV6sil8+eSycI+Tt0XCyzLHWj:Lxl+0KJVpneV6siy+I+TtcCyzLHW
- TLSH
  T178B4AF117DB580B5CD46B1B00DBE9B767678D6960B228BC3B7C4DD382E234B1A33725A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13