General

  • Target

    ac964fea8ed8c4e8645cdd81686900f4

  • Size

    216KB

  • Sample

    240228-xez3tsbc88

  • MD5

    ac964fea8ed8c4e8645cdd81686900f4

  • SHA1

    7abbca1a295ee6b9ad5cf04dae50913fa432bbed

  • SHA256

    b894fa914f5addea917491cb91d0d54badd61cc8f83b7b251b18a3f25c786c9b

  • SHA512

    0a541f13cb61cf28a97d73af4710b1de6070294615aae4e4aaa84ea6a78a14b9346fd81d4d9aa1c44a4d875dc7259f4639bd7ffcd0eb80012930e22944da0e7f

  • SSDEEP

    3072:RfVLWlTTbEGe9AJKlCvIUBqoW6nBOol0exNDWb5:tVqdT3GcQ4TpIn

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.byethost6.com
  • Port:
    21
  • Username:
    b6_9261312
  • Password:
    741852

Targets

    • Target

      ac964fea8ed8c4e8645cdd81686900f4

    • Size

      216KB

    • MD5

      ac964fea8ed8c4e8645cdd81686900f4

    • SHA1

      7abbca1a295ee6b9ad5cf04dae50913fa432bbed

    • SHA256

      b894fa914f5addea917491cb91d0d54badd61cc8f83b7b251b18a3f25c786c9b

    • SHA512

      0a541f13cb61cf28a97d73af4710b1de6070294615aae4e4aaa84ea6a78a14b9346fd81d4d9aa1c44a4d875dc7259f4639bd7ffcd0eb80012930e22944da0e7f

    • SSDEEP

      3072:RfVLWlTTbEGe9AJKlCvIUBqoW6nBOol0exNDWb5:tVqdT3GcQ4TpIn

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks