General

  • Target

    cdbff7187582c360121395aa05f0e46ddd1bb4f3472d65975f3ac1a51e550827

  • Size

    47KB

  • Sample

    240704-ecp6qsvdme

  • MD5

    0cad99e2c1b9e79b4ecb7b09d9685f1a

  • SHA1

    12b8a0134b9a23e9d5f9b7d807c105fe51b0e3c2

  • SHA256

    cdbff7187582c360121395aa05f0e46ddd1bb4f3472d65975f3ac1a51e550827

  • SHA512

    13e4ef36a5444fbdc33bd34e528f21f55307ebd9711521cf1f8a6e1e56911b0de66252541355b8d9c4273da969930818c77d48eb8e099fed82bc3f7f2eadc3f7

  • SSDEEP

    768:kflivXrVKpVhKvtxwYHwVFoeAQXmucwUKzdlPPKXDbQU:alqrVKprVuQX7z7Pgn

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      cdbff7187582c360121395aa05f0e46ddd1bb4f3472d65975f3ac1a51e550827

    • Size

      47KB

    • MD5

      0cad99e2c1b9e79b4ecb7b09d9685f1a

    • SHA1

      12b8a0134b9a23e9d5f9b7d807c105fe51b0e3c2

    • SHA256

      cdbff7187582c360121395aa05f0e46ddd1bb4f3472d65975f3ac1a51e550827

    • SHA512

      13e4ef36a5444fbdc33bd34e528f21f55307ebd9711521cf1f8a6e1e56911b0de66252541355b8d9c4273da969930818c77d48eb8e099fed82bc3f7f2eadc3f7

    • SSDEEP

      768:kflivXrVKpVhKvtxwYHwVFoeAQXmucwUKzdlPPKXDbQU:alqrVKprVuQX7z7Pgn

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks