General
-
Target
ba8e23012c50b03392e2abbca02f89d712fd3de7358797fd92b0bba78118a301
-
Size
90KB
-
Sample
221204-lpfldsbg8w
-
MD5
18f23fe74506528742b5a6f8ddb25777
-
SHA1
b066378133e0ba1c558f7dd5714329961a24800c
-
SHA256
ba8e23012c50b03392e2abbca02f89d712fd3de7358797fd92b0bba78118a301
-
SHA512
977533604fae0aaa8967a36a760941cbb22af77b1720e9ef461f57886f10594c5fbdd192899c8d522aa900fe0265fa3785788a621c3cf3fd067aa396aca2a828
-
SSDEEP
768:EzQYScGrIubHuYtvdxwYHw5FAe2QMncwx:GQTIubHy5wQM
Static task
static1
Behavioral task
behavioral1
Sample
ba8e23012c50b03392e2abbca02f89d712fd3de7358797fd92b0bba78118a301.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ba8e23012c50b03392e2abbca02f89d712fd3de7358797fd92b0bba78118a301.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Targets
-
-
Target
ba8e23012c50b03392e2abbca02f89d712fd3de7358797fd92b0bba78118a301
-
Size
90KB
-
MD5
18f23fe74506528742b5a6f8ddb25777
-
SHA1
b066378133e0ba1c558f7dd5714329961a24800c
-
SHA256
ba8e23012c50b03392e2abbca02f89d712fd3de7358797fd92b0bba78118a301
-
SHA512
977533604fae0aaa8967a36a760941cbb22af77b1720e9ef461f57886f10594c5fbdd192899c8d522aa900fe0265fa3785788a621c3cf3fd067aa396aca2a828
-
SSDEEP
768:EzQYScGrIubHuYtvdxwYHw5FAe2QMncwx:GQTIubHy5wQM
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-