General

  • Target

    5bf365b97c7bfba3052230642dfa037a59e966998de7177f0a903440cd76e781

  • Size

    35KB

  • Sample

    220919-1venlsbaf2

  • MD5

    12cb7a8956ffc45c91251835c49feeca

  • SHA1

    34b123f51108c1f900c99e27869d30d0561f9435

  • SHA256

    5bf365b97c7bfba3052230642dfa037a59e966998de7177f0a903440cd76e781

  • SHA512

    37220ad7a873db1d043101821f219509752b1f67e6fdf507bba059db6271837871c9ee8ac513768c1318ebd1a05ddee734242d258e810dd93cec1a0415810f60

  • SSDEEP

    768:cflivXrVKpVhKvtxwYHwVFoeAQumucwUBaa0:ylqrVKprVuQul

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      5bf365b97c7bfba3052230642dfa037a59e966998de7177f0a903440cd76e781

    • Size

      35KB

    • MD5

      12cb7a8956ffc45c91251835c49feeca

    • SHA1

      34b123f51108c1f900c99e27869d30d0561f9435

    • SHA256

      5bf365b97c7bfba3052230642dfa037a59e966998de7177f0a903440cd76e781

    • SHA512

      37220ad7a873db1d043101821f219509752b1f67e6fdf507bba059db6271837871c9ee8ac513768c1318ebd1a05ddee734242d258e810dd93cec1a0415810f60

    • SSDEEP

      768:cflivXrVKpVhKvtxwYHwVFoeAQumucwUBaa0:ylqrVKprVuQul

    Score
    10/10
    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks