General

  • Target

    feafeaceded39fff414be98a694c74385cbdf760ac57d01142af2d8166e6d926

  • Size

    34KB

  • Sample

    221201-sv8bxsfd6z

  • MD5

    528fd2ccf8b254b31c74e113175490c3

  • SHA1

    21970b58f08b29e79a332411ca5071273b525971

  • SHA256

    feafeaceded39fff414be98a694c74385cbdf760ac57d01142af2d8166e6d926

  • SHA512

    d8f870b8fc886946096d39eab926d0b522b5e98ee0aa508d40ef3f18e4adc04fd74bbba26695b1b454817bc7ce04f8057f44f9981d5649cdcb5b2d5737322505

  • SSDEEP

    768:cflivXrVKpVhKvtxwYHwVFoeAQwmucwUqU:ylqrVKprVuQwHU

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      feafeaceded39fff414be98a694c74385cbdf760ac57d01142af2d8166e6d926

    • Size

      34KB

    • MD5

      528fd2ccf8b254b31c74e113175490c3

    • SHA1

      21970b58f08b29e79a332411ca5071273b525971

    • SHA256

      feafeaceded39fff414be98a694c74385cbdf760ac57d01142af2d8166e6d926

    • SHA512

      d8f870b8fc886946096d39eab926d0b522b5e98ee0aa508d40ef3f18e4adc04fd74bbba26695b1b454817bc7ce04f8057f44f9981d5649cdcb5b2d5737322505

    • SSDEEP

      768:cflivXrVKpVhKvtxwYHwVFoeAQwmucwUqU:ylqrVKprVuQwHU

    Score
    10/10
    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks