General
-
Target
3e13f3bc8785bb9ff03b182fac64b4ec5cf3fa6c9dc7ba7953ac632bdd2a9862
-
Size
61KB
-
Sample
240601-zajldseb3x
-
MD5
7f701255b54f1fb039dd91808281696e
-
SHA1
305345a91a3deb723f4f28b18f54f61dc79f9f29
-
SHA256
3e13f3bc8785bb9ff03b182fac64b4ec5cf3fa6c9dc7ba7953ac632bdd2a9862
-
SHA512
92e00783f6813834e41211ca8c30f8944f6eaf6d0502e01e1590f16fe89291256b93639a5eff553d5acc3d6f209bd7434bed744ff05c0b65679222e390e1a72c
-
SSDEEP
768:9qSqC8+N5ozQQRncwxWmNXMX3cX8wtgtzpAXpX8/X/7CUrfbtS69Fz:9rqfzQQRamN8835mv7CUro+R
Static task
static1
Behavioral task
behavioral1
Sample
3e13f3bc8785bb9ff03b182fac64b4ec5cf3fa6c9dc7ba7953ac632bdd2a9862.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3e13f3bc8785bb9ff03b182fac64b4ec5cf3fa6c9dc7ba7953ac632bdd2a9862.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Targets
-
-
Target
3e13f3bc8785bb9ff03b182fac64b4ec5cf3fa6c9dc7ba7953ac632bdd2a9862
-
Size
61KB
-
MD5
7f701255b54f1fb039dd91808281696e
-
SHA1
305345a91a3deb723f4f28b18f54f61dc79f9f29
-
SHA256
3e13f3bc8785bb9ff03b182fac64b4ec5cf3fa6c9dc7ba7953ac632bdd2a9862
-
SHA512
92e00783f6813834e41211ca8c30f8944f6eaf6d0502e01e1590f16fe89291256b93639a5eff553d5acc3d6f209bd7434bed744ff05c0b65679222e390e1a72c
-
SSDEEP
768:9qSqC8+N5ozQQRncwxWmNXMX3cX8wtgtzpAXpX8/X/7CUrfbtS69Fz:9rqfzQQRamN8835mv7CUro+R
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-