General

  • Target

    ba8e23012c50b03392e2abbca02f89d712fd3de7358797fd92b0bba78118a301

  • Size

    90KB

  • Sample

    221204-lpfldsbg8w

  • MD5

    18f23fe74506528742b5a6f8ddb25777

  • SHA1

    b066378133e0ba1c558f7dd5714329961a24800c

  • SHA256

    ba8e23012c50b03392e2abbca02f89d712fd3de7358797fd92b0bba78118a301

  • SHA512

    977533604fae0aaa8967a36a760941cbb22af77b1720e9ef461f57886f10594c5fbdd192899c8d522aa900fe0265fa3785788a621c3cf3fd067aa396aca2a828

  • SSDEEP

    768:EzQYScGrIubHuYtvdxwYHw5FAe2QMncwx:GQTIubHy5wQM

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      ba8e23012c50b03392e2abbca02f89d712fd3de7358797fd92b0bba78118a301

    • Size

      90KB

    • MD5

      18f23fe74506528742b5a6f8ddb25777

    • SHA1

      b066378133e0ba1c558f7dd5714329961a24800c

    • SHA256

      ba8e23012c50b03392e2abbca02f89d712fd3de7358797fd92b0bba78118a301

    • SHA512

      977533604fae0aaa8967a36a760941cbb22af77b1720e9ef461f57886f10594c5fbdd192899c8d522aa900fe0265fa3785788a621c3cf3fd067aa396aca2a828

    • SSDEEP

      768:EzQYScGrIubHuYtvdxwYHw5FAe2QMncwx:GQTIubHy5wQM

    Score
    10/10
    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks