Overview

overview

10

Static

static

3

a41c42d3e0...b6.exe

windows7-x64

7

a41c42d3e0...b6.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a41c42d3e015cd5f34528529493066460d5aa54866caa035cd5553904dce83b6

  • Size

    180KB

  • Sample

    240417-c1hepabd72

  • MD5

    0e5ee730483da039e706d34809e3cf11

  • SHA1

    3f775300ff07c72144d781928a16631c4b750e8b

  • SHA256

    a41c42d3e015cd5f34528529493066460d5aa54866caa035cd5553904dce83b6

  • SHA512

    85423f79d562c645ff4b3357410e9af97375857d4a41db5a1039cf1a3afc8b5e0f103a12da80921c2ca06a120a0cd71a5c664effd4bf0685fd7180e709c2b5e5

  • SSDEEP

    768:u/5inm+cd5rHemPXKqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfLOkM:uRsvcdCQjosnvnZ6LQ1EXM

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    griptoloji
  • Password:
    741852

Targets

    • Target

      a41c42d3e015cd5f34528529493066460d5aa54866caa035cd5553904dce83b6

    • Size

      180KB

    • MD5

      0e5ee730483da039e706d34809e3cf11

    • SHA1

      3f775300ff07c72144d781928a16631c4b750e8b

    • SHA256

      a41c42d3e015cd5f34528529493066460d5aa54866caa035cd5553904dce83b6

    • SHA512

      85423f79d562c645ff4b3357410e9af97375857d4a41db5a1039cf1a3afc8b5e0f103a12da80921c2ca06a120a0cd71a5c664effd4bf0685fd7180e709c2b5e5

    • SSDEEP

      768:u/5inm+cd5rHemPXKqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfLOkM:uRsvcdCQjosnvnZ6LQ1EXM

    Score
    10/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks