General

  • Target

    298fae714e936c6e02696291c8d32f5e_JaffaCakes118

  • Size

    34KB

  • Sample

    240706-29ahwayfmb

  • MD5

    298fae714e936c6e02696291c8d32f5e

  • SHA1

    a5bcb3ed705bcccbb5774bd2032c3d2db530dac6

  • SHA256

    483c72e9f008793acf1cfd97617f34aab79f9604ebf4ce393b7c522b9b7f23ac

  • SHA512

    6dc55df53c359927bd9ab145c504b9f9ea4a40ab543ccf0fbe83753a0bccac7fdf3b1c9a4fa9913b3bdcfedeee27eaa1b449880230ba562dc23a0c3dfd7d3f72

  • SSDEEP

    768:cflivXrVKpVhKvtxwYHwVFoeAQRmucwU7:ylqrVKprVuQRO

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      298fae714e936c6e02696291c8d32f5e_JaffaCakes118

    • Size

      34KB

    • MD5

      298fae714e936c6e02696291c8d32f5e

    • SHA1

      a5bcb3ed705bcccbb5774bd2032c3d2db530dac6

    • SHA256

      483c72e9f008793acf1cfd97617f34aab79f9604ebf4ce393b7c522b9b7f23ac

    • SHA512

      6dc55df53c359927bd9ab145c504b9f9ea4a40ab543ccf0fbe83753a0bccac7fdf3b1c9a4fa9913b3bdcfedeee27eaa1b449880230ba562dc23a0c3dfd7d3f72

    • SSDEEP

      768:cflivXrVKpVhKvtxwYHwVFoeAQRmucwU7:ylqrVKprVuQRO

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks