General

  • Target

    a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe

  • Size

    224KB

  • Sample

    231015-yex4xadf2s

  • MD5

    a60cf7efc2377fe9ed86a9fa2f4ba8f0

  • SHA1

    acbe5f92322a52c2f56baa3b6046f0e941e8fb83

  • SHA256

    8a09833749c4d48210e885688a7f1208d4a96c00a1ea5c925b0bea552e0f09d3

  • SHA512

    f5f37e2c47f43b6e762fd838677a522f8c0c4953dd329ed24959e45090cda6020873d9a78d6e2a719ce8d3ba742c3ce24aa6f9ea10deb05b3d78479a3de1c24c

  • SSDEEP

    1536:HvV6iLUWGI3UmkFlgZLu6xXXq5pm9AKTrSrowl+Oy:HvV6iUW5UmkH+lxX6Tmwrowl5y

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe

    • Size

      224KB

    • MD5

      a60cf7efc2377fe9ed86a9fa2f4ba8f0

    • SHA1

      acbe5f92322a52c2f56baa3b6046f0e941e8fb83

    • SHA256

      8a09833749c4d48210e885688a7f1208d4a96c00a1ea5c925b0bea552e0f09d3

    • SHA512

      f5f37e2c47f43b6e762fd838677a522f8c0c4953dd329ed24959e45090cda6020873d9a78d6e2a719ce8d3ba742c3ce24aa6f9ea10deb05b3d78479a3de1c24c

    • SSDEEP

      1536:HvV6iLUWGI3UmkFlgZLu6xXXq5pm9AKTrSrowl+Oy:HvV6iUW5UmkH+lxX6Tmwrowl5y

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks