| Attribute | Value |
|---|---|
| Malware Name | ftW.exe |
| Type | Trojan (Information Stealer) |
| Family | MSIL/BPLogger |
| Detection Rate | 77.8% |
| Key Behavior | Credential Theft + C2 Beaconing |
This repository presents a comprehensive malware analysis of ftW.exe, a .NET-based trojan disguised as a legitimate application ("MathPro Scientific Calculator").
The analysis covers:
- Static Analysis
- Dynamic Analysis
- Memory Forensics
- Debugging & Reverse Engineering
- File Name: ftW.exe
- Type: Trojan (Information Stealer)
- Family: Trojan.MSIL/BPLogger
- Platform: Windows (.NET)
- Architecture: 32-bit
- Threat Level: High
-
SHA256:
7bed0eed3f423b22cecbfdd23aad0ca8c3b0e8fb550c0402e19e0273f7c27d3 -
File Size: 618 KB
-
Compilation Timestamp: 2104-09-17 (Suspicious - Future Date)
-
Detection Rate: 77.8% (VirusTotal)
- PEStudio
- VirusTotal
- FLARE VM
- Process Monitor
- Regshot
- Wireshark
- FakeNet
- FTK Imager
- Volatility
- IDA
- dnSpy
- PowerShell
- User executes ftW.exe (disguised as calculator)
- Fake login/register interface initialized
- Multiple processes spawned (self-replication behavior)
- Credential harvesting mechanisms prepared
- Attempts to connect to remote C2 server
- Memory injection and RWX regions observed
- System reconnaissance via registry access
- Credential harvesting (fake login/register UI)
- Keylogging potential (keyboard interception enabled)
- Process injection (RWX memory regions detected)
- Network beaconing (C2 communication attempts)
- System reconnaissance (TCP/IP registry access)
- Obfuscation using resources and fake UI
- C2 IP:
194.156.79.239 - Port:
55615
- Multiple process instances spawned rapidly
- Conhost processes launched for command execution
- Registry access to TCP/IP parameters
- Repeated outbound connection attempts
- No successful C2 communication (likely inactive server)
- RWX (Read-Write-Execute) memory regions detected
- In-memory PE artifacts identified
- Evidence of possible code injection/unpacking
- .NET assembly using WCF-related libraries
- Autonomous execution (no user interaction required)
- High entropy (7.483) → possible obfuscation
- .NET executable using CLR (
mscoree.dll) - Fake application identity ("MathPro Scientific Calculator")
- Credential harvesting via local database (
db_users.mdb) - SQL queries constructed using user input (insecure)
- KeyPreview enabled → potential keylogging behavior
- Credential Access: T1056 (Input Capture)
- Execution: T1059 (.NET Execution)
- Persistence: T1547 (Registry Run Keys - attempted)
- Defense Evasion: T1027 (Obfuscation)
- Command & Control: T1071 (Application Layer Protocol)
- Discovery: T1082 (System Information Discovery)
- No active C2 response (server likely offline)
- Credential harvesting UI not triggered in sandbox
- No persistent registry autorun entries detected
- Monitor abnormal .NET processes
- Detect RWX memory allocations
- Flag repeated outbound connection attempts
- Identify suspicious GUI-based credential prompts
- Block known malicious hash
- Restrict outbound connections to suspicious IPs
- Use EDR for behavior-based detection
- OS: Windows 10 (VM)
- Tools: FLARE VM, Wireshark, Volatility
- Network: Host-only (isolated environment)
ftW.exe is a .NET-based information-stealing trojan from the BPLogger family.
It employs social engineering (fake calculator UI), credential harvesting techniques, and multiple evasion strategies.
Although some malicious features remained inactive in the sandbox environment, memory and behavioral analysis strongly confirm its malicious intent.
This repository is intended for educational and research purposes only.
- No live malware samples are included
- All analysis is conducted in a controlled environment
- Do not execute unknown binaries outside a secure lab setup