Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 20:10
General
- Target $R9/Plugins/tftp.exe
- Size 95KB
- Sample260905-yxtjfafg39
- SHA256 73ddf0df4e9e3866511ef9eae421b11615b81491d0db1d4a7ed19441e368ecef
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
182.92.102.5
-
Port
21
-
Username
root
-
Password
lol123
Extracted
Credentials
-
Protocol
ftp
-
Host
66.117.14.6
-
Port
21
-
Username
user
-
Password
12345678
Extracted
Credentials
-
Protocol
ftp
-
Host
154.213.127.9
-
Port
21
-
Username
server
-
Password
lol123
Signatures
- Contacts a large (1027) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\$R9\Plugins\tftp.exe"C:\Users\Admin\AppData\Local\Temp\$R9\Plugins\tftp.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4960-0-0x0000000000400000-0x0000000000421000-memory.dmp