Tags
country: Germany Russia
attack-pattern: Data Credentials - T1589.001 Domains - T1583.001 Domains - T1584.001 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Whois - T1596.002
Show in Graph
Common Information
Type Value
UUID 9097ae5a-1b0c-41e7-9c98-e281b2abbc1f
Fingerprint e50c1d6aa503a611
Analysis status DONE
Considered CTI value 2
Text language
Published Jan. 27, 2014, midnight
Added to db Jan. 18, 2023, 8:14 p.m.
Last updated Nov. 14, 2024, 5:58 p.m.
Headline List of available regions
Title
Detected Hints/Tags/Attributes 24/2/15
Source URLs
Redirection Url
Details Source https://blog.avast.com/2014/01/27/malformed-filezilla-ftp-client-with-login-stealer/
URL Provider
Details Provider Source level domain
Details avast.com blog.avast.com
Attributes
Details Type #Events CTI Value
Details Domain 1 
ftp.domain.com
Details Domain 3 
go-upload.ru
Details Domain 2 
aliserv2013.ru
Details Domain 2 
ngusto-uro.ru
Details Domain 1 
naunet.ru
Details Email 1 
password@ftp.domain.com
Details File 10 
filezilla.exe
Details File 1 
ibgcc_s_dw2-1.dll
Details File 2 
libstdc++-6.dll
Details sha256 1 
595d954c7ce574337c97a0801e779bc3dca94fc92afae8f483dcdd1a053c5c24
Details sha256 1 
525e9ed135c1435772a774d7ad7168ceccd225e354118e621482db61174f6734
Details sha256 1 
b9a12f9b6827144d84e65ef2ba454d77cb423c5e136f44bc8d3163d93b97f11f
Details sha256 1 
2451599c03b136c1848f538184f0f266973b65afc8dd25f272a7e6b0555b657a
Details IPv4 2 
144.76.120.243
Details Url 1 
ftp://username:password@ftp.domain.com