7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497 | Triage

Sharing

General

Target

7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497
Size

232KB
Sample

221124-axsedaag7x
MD5

3a6c36995ac1143df953335d4c38d5a0
SHA1

8ef0107613dfb1fdc2d05d250e532228a9334029
SHA256

7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497
SHA512

f38a078acce721adfd1a5ab3ee7e47d235bdfc28b110e68ad0995492b2755bc3acd165d3159274f9892e5f6a8e01332ebf75f08a66334c120a43e3dd2ad94468
SSDEEP

3072:bfQgicdlGvILcU9KQ2BBAkJaPxsIolx8ha22XX/xU:picdlG5WKQ2BjGx+spY/O

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.byethost12.com
Port:
21
Username:
b12_8082975
Password:
951753zx

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Targets

- Target
  
  7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497
- Size
  
  232KB
- MD5
  
  3a6c36995ac1143df953335d4c38d5a0
- SHA1
  
  8ef0107613dfb1fdc2d05d250e532228a9334029
- SHA256
  
  7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497
- SHA512
  
  f38a078acce721adfd1a5ab3ee7e47d235bdfc28b110e68ad0995492b2755bc3acd165d3159274f9892e5f6a8e01332ebf75f08a66334c120a43e3dd2ad94468
- SSDEEP
  
  3072:bfQgicdlGvILcU9KQ2BBAkJaPxsIolx8ha22XX/xU:picdlG5WKQ2BjGx+spY/O
Score

10^/10

persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2