General
-
Target
02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557
-
Size
216KB
-
Sample
240305-vrg2nsch72
-
MD5
f3adc6a2dfd5da230cbf44d3b7b7fe61
-
SHA1
c92fe5a63149edcc306423ec1aeaf58a7997d7f3
-
SHA256
02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557
-
SHA512
b3e3caa2dfea6b074c6a04d3afa7b4aead26c94a6079cce4ce1fe38de056eef7bcecd04bedb02ef5b53649a44b5739c7f909496905883a32f87e158401006596
-
SSDEEP
3072:HePgHctxGv4QcU9KQ2BBA2waPxVtmolhK1r:THctxGsWKQ2Bx5xjt8r
Static task
static1
Behavioral task
behavioral1
Sample
02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.byethost12.com - Port:
21 - Username:
b12_8082975 - Password:
951753zx
Targets
-
-
Target
02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557
-
Size
216KB
-
MD5
f3adc6a2dfd5da230cbf44d3b7b7fe61
-
SHA1
c92fe5a63149edcc306423ec1aeaf58a7997d7f3
-
SHA256
02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557
-
SHA512
b3e3caa2dfea6b074c6a04d3afa7b4aead26c94a6079cce4ce1fe38de056eef7bcecd04bedb02ef5b53649a44b5739c7f909496905883a32f87e158401006596
-
SSDEEP
3072:HePgHctxGv4QcU9KQ2BBA2waPxVtmolhK1r:THctxGsWKQ2Bx5xjt8r
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-