e4550793f6c7fb6363cd1fb2f58c9195743d88d792dc231056b3ab9ca0234624

Sharing

Copy URL Twitter E-mail

General

Target
FileZilla_3.71.1_win64_sponsored2-setup.exe
Size 12.5MB
Sample260910-pl81bawyaz
SHA256 e4550793f6c7fb6363cd1fb2f58c9195743d88d792dc231056b3ab9ca0234624
MD5 5926511e60507e7674bf75987df4af69
SHA1 dd469ec4149b79ce91dba2a3ab839e9ff31834b5
SHA512 271766cb1978e873788e9cd41935237c590fd97537f383147fbf0bcebfb2da2af6c78d7f6979ac2bd15a8f275c7772a7df0fd4e9166183f08932d60d9fa0a726
SSDEEP 393216:xl39PhOYoXZrubaly2Rekj3m1u9sG1ySRAq6xg1o:xl39gYYQb/hq3+u9skRAlgK
TLSH
T13CD6338F835D4EDEC0510179FB5BA6E292A0377790786C9FD0157E6BFA4E21920D8EC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  FileZilla_3.71.1_win64_sponsored2-setup.exe
- Size 12.5MB
- SHA256 e4550793f6c7fb6363cd1fb2f58c9195743d88d792dc231056b3ab9ca0234624
- MD5 5926511e60507e7674bf75987df4af69
- SHA1 dd469ec4149b79ce91dba2a3ab839e9ff31834b5
- SHA512 271766cb1978e873788e9cd41935237c590fd97537f383147fbf0bcebfb2da2af6c78d7f6979ac2bd15a8f275c7772a7df0fd4e9166183f08932d60d9fa0a726
- SSDEEP 393216:xl39PhOYoXZrubaly2Rekj3m1u9sG1ySRAq6xg1o:xl39gYYQb/hq3+u9skRAlgK
- TLSH
  T13CD6338F835D4EDEC0510179FB5BA6E292A0377790786C9FD0157E6BFA4E21920D8EC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 24KB
- SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
- MD5 640bff73a5f8e37b202d911e4749b2e9
- SHA1 9588dd7561ab7de3bca392b084bec91f3521c879
- SHA512 39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
- SSDEEP 384:wv1j9e9dEs+rN+qFLAjNXT37vYnOrvFhSL+ZwcSyekzANZBJ:w1AvEs3HBLzYn29vYh
- TLSH
  T1F2B2E69157EA135EF7F19F347475EB2249BBBC214821C8CF5633268E19B2242E930727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 33a6c41f262fe4f5f5eada6c3dca5d1a6512bf09bd09e05b223882630fd24e89
- MD5 9ba64ba25b26b3964fe1ca1d331387ee
- SHA1 305e7ef9bec45556fe2de80d0ab107f12a8f4eee
- SHA512 741f72b15f6f138c0fd0ccf799dd031c731e79b54eb417a615a04d53eed72891f92196beb03795fad990c158cd358b460ecb6eefed5fc2ef53400310b2249df4
- SSDEEP 96:ZIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/O3lkCTcaqHCI:+hE+A0+sF6piUFkA6lncviI
- TLSH
  T1DFF1C776F3D20673FAAB427428232F231B2AF521576981A6490316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 0893c4d31c7d9c2106eea64f10d6b17a00b742727662a883c39990bcee6a7d15
- MD5 a189f9b1c9ef05e23e5aed0bdb2a1bf4
- SHA1 584e9461cbb901aecabe61b4c3fbed146da0035f
- SHA512 d9f34ea10b8174c031b25dace65f092dacd0e582e3b8cf1779ca9721f50a896cdd3be2cb6738a7ae487a3f8dc1b4548045ac6ca875138003903b0e6e055412ee
- TLSH
  T1EE8173BB92E00CF3D0A44BB740A71CE362B5DD201756001F4A478AA92590B67EE7E715
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsis_appid.dll
- Size 3KB
- SHA256 e9e1ba410636698d666b328eea71346b8287248d262e44da07ce8b5fa24c5e5f
- MD5 19071761e91c43c115a16b52458869b7
- SHA1 75ddb807157f1aa31a08f87be0270f60990bcbbc
- SHA512 bc0eab51cf27f657cd3fd62a47894ee13f3f561feaa565f16ba15088be39be73c9839a3cf35b538219ec83a03d48970b89258c5f20c37bcaf76438998437786c
- TLSH
  T15E5186A38B7988B1C0190B335A8714E572FDC31B229E402EFF98090B7E4065FD9A6160
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $R0
- Size 32KB
- SHA256 e55816003c559b1155b6a6c100c9795b4730dd4b98c5a2179d4f3366a8e62755
- MD5 7d5b239118bf6b2d8d8bb26be7a68394
- SHA1 0a6c9789c9e0a800be464d2d638351291e8f0c38
- SHA512 521d27422bbf5deb19aaf7f9593b135a2c5cbfa39e3fdeaa0b82c4d53f423bfbe2d95eb9df9b58a38efcb5573ad03dcbafac6528578deaf250da380b6f490e55
- SSDEEP 768:j/Bod79KZGU7L5oF6vPs7QnLMcAAswd9j1lDibLfW2:j/Wd7Tkku4cAAswdp1l2X
- TLSH
  T124E25D06FF1168B1DED34CF4A9D9D77B86B03532CD164AB6FB14C2487822B63A904E1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $R2/NSIS.Library.RegTool.v3.$_106_.exe
- Size 5KB
- SHA256 e682c229a6453fa37ce380b59b4c28b5292b9caafd13e7972cab089f10996262
- MD5 2f86235a4603b89b4ae4debc33a22a72
- SHA1 e5a48f3444d0350bc432ff292b71ebc2c6cfc861
- SHA512 1ae90b4ed74a5598028572aa10121701c297d09efcffa429982c28b1eb71f98e6736addc73a23dfad5251493b65dbba52de9bf4d08b0845ed8768734cb600524
- SSDEEP 96:UBg4ARDDMDQB4dtVfhxr+qOspqME3zpHC5:YsDDcQWd/hxaq/sMsC5
- TLSH
  T184B1A617B9100972DBCA06720D569DAE7BE54567032184EA0EF363DBAA78C2749A4352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $_36_
- Size 932KB
- SHA256 03617ef6705ecd575f209b1023c85e9f5e3ac174e2e2de088553a4536cb930ae
- MD5 f03205b2487fbda78c05fe108b8d672e
- SHA1 1b87ca18cef9961a3653a405c8104f45f5a58042
- SHA512 795a736541e0e243dbb8179e10c0cb8ca27946db03f1cee4fceed225daf21edf795534f5d5c12240bba6da3968038cd530ece2242f9409332df66eb14fc09ff3
- SSDEEP 24576:BGnKuf3luMuieVaGCCCdEU2nUR/65vPmvVqN:BU3l/uar2nUR/65vPmdqN
- TLSH
  T12615CFA33D8480B2E69E01B01579E7760B7D75350F2189D7A7E07BADEE311C1D23AB4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  GPL.html
- Size 15KB
- SHA256 f7e89c1edbbef8bc837b47c48113a2416f1af0cfc2b2218da39085465ea1045c
- MD5 11e176c5e0120ee94e365f999084bce8
- SHA1 a612f6d40d0d2ae045d80b60bce6fb6f81a811ef
- SHA512 d0532df4fe5e995df49f3e58127f5fc9637fc4f1afbb29e92ad16897c1055f77963277f5143458b9a294d1c24559bc594e0ae5469271ece639c8e66a5555d5a3
- SSDEEP 192:tiMUzQS+LrQWJz6Z6q6pdPIK8kV6AWRzdbDaz0pmN1rMbkBJ9R8/CmBHf3KWkc:tZUz5irJq6jIuV6fRzd3c0pmbMCzRLw7
- TLSH
  T18772836E774503B309C306A16A4B28DBA32EC578727E11A43459C15D236FE35C3BFADA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  filezilla.exe
- Size 4.1MB
- SHA256 84ade0a797ffab4771eb4b0521b4404ec0be86e91824bbe0dafb69c099d74828
- MD5 a6adf61f3232f0ce074666c3fac9e7fc
- SHA1 abd7384d7ed1afbfb68f765d76e833ef6d156120
- SHA512 126bd22d7b7f17d27362f5ca1882c47f874bd0327277c17186cfad6e7788242ec85dbfe473b03dc92bdfca9ba64f395e894093a346c1e38d8822cae8832fc787
- SSDEEP 49152:ZxOHVosxSAWv5j3KVksj9i/tbgbhVSvuUKVWYsseazNwN/S3jSH4zGJsyj3LzdAJ:ZBrb1HKVf7zGhpF6WQWTY
- TLSH
  T19116D607E652858CC47AD178876A76336A72BC0D45303B5EAB51FF322F52FA0927EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
behavioral25 behavioral26
- Target
  fzstorj.exe
- Size 9.8MB
- SHA256 b75d99891b9cd2ed3a34ac7660f5557b56b05055ace5a2629357994b419a592e
- MD5 9eaef02d6dabbda215c3ae15d68aee30
- SHA1 e32784cd95a0e7e84dbbb19f856b75e1cb3b5814
- SHA512 a7bd41493322a78c3a549be60a6b66436775d24b63cf2bd49b49e5d3a4fee8170fd1d6dd6c793bf66099fa3af518be6af77edb4dc589b296911f71bf878b2b2b
- SSDEEP 98304:O0jMdP9uE9l22xij8Y3G78uCAR3AYGM/dOiA:zjMdP9R722xij8Y3G7zHRGQwP
- TLSH
  T164A64B07F8A244E6C67FE03096559222BA71349543317BDF5E94BB9A2E22FE4B73D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  libargon2.dll
- Size 53KB
- SHA256 f454f73ce04a80ed86fbe1c8ce176fb767be308deacc6369ed02a16366b6d3c1
- MD5 3a1b8ea633f406ad339cdbb9da199adb
- SHA1 5c4f24b2ff9c54cea1ec3b8e4be7a3eec5a9e1ea
- SHA512 9eb086bd8d18042d71f0829b7784acdfbbb952f22aa482a723e6771d4026c2a784d8c9015bf694b2df5c7cfe068b475af6f18e97bcf2be095d27db6f9b129c26
- SSDEEP 768:26knff8caxdotTEYWzW9yS918h4en/g2akIE5rrRsQhQtwd9j1lDibLCJ/:2Hf0caxeMGm4l2akI8v2twdp1l26J/
- TLSH
  T1FF334B57B663B1FCCA27C078D693A777B832749166602DFF4290C7362C35E20272E61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  libfilezilla-59.dll
- Size 1.1MB
- SHA256 e6a0f23f251f0c7772bc1d5609700185c91b6c2e79ccf04f043b470e94f3e074
- MD5 f45f4cc9be9a8cd3c20743b2e84f128c
- SHA1 c395bee9edaae38fe0b07e749c548e845da15acf
- SHA512 aaa29ccd8fd059d7be0f477374b2f8e4c61b5c1a63b558656a24d4a2e0da6d1aafcfb5c2b8b9bf75f41ad8efe3b4906817770f79837761f9a36abd1c5e765b9c
- SSDEEP 24576:eb/mQujXmiOrXdHhe7+F7YBTbDtQIxvwv:A/mxEdHCvD9A
- TLSH
  T19F453907E2A755ECC43FD5744317A676F831BC0846387E6EAA90DF312E22F60966EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads data files stored by FTP clients

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32