General

  • Target

    a3cf9309c8001d8e3b6441b402a081b9_JC.exe

  • Size

    426KB

  • Sample

    231001-pr95kacc39

  • MD5

    a3cf9309c8001d8e3b6441b402a081b9

  • SHA1

    fb4b057f280cba7b0f730527f89157a8b19291f7

  • SHA256

    eee81ef502aa32633278ba040b4987caf3d5c5c1eca09012b0be79c8aeedd053

  • SHA512

    18050ebf16a3fb9b83cf14b2a6e15a294e494bad4e6a18906e159b5344821495a8e00ab4d7efb03450b10d44d0f311e5fe7b580b402aa090c605c4bcdbb5793a

  • SSDEEP

    3072:kChJgYMm4xf9cU9KQ2BxA59SPM2OoSn240YK0FN8lpSUyKncAxi2u:MYMm4xiWKQ2BiCMtZK03kNcATu

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      a3cf9309c8001d8e3b6441b402a081b9_JC.exe

    • Size

      426KB

    • MD5

      a3cf9309c8001d8e3b6441b402a081b9

    • SHA1

      fb4b057f280cba7b0f730527f89157a8b19291f7

    • SHA256

      eee81ef502aa32633278ba040b4987caf3d5c5c1eca09012b0be79c8aeedd053

    • SHA512

      18050ebf16a3fb9b83cf14b2a6e15a294e494bad4e6a18906e159b5344821495a8e00ab4d7efb03450b10d44d0f311e5fe7b580b402aa090c605c4bcdbb5793a

    • SSDEEP

      3072:kChJgYMm4xf9cU9KQ2BxA59SPM2OoSn240YK0FN8lpSUyKncAxi2u:MYMm4xiWKQ2BiCMtZK03kNcATu

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks