General
-
Target
5a1fe1b68cee21a617b769a68bcdc9a0N.exe
-
Size
226KB
-
Sample
240720-gwzkmazbqj
-
MD5
5a1fe1b68cee21a617b769a68bcdc9a0
-
SHA1
a58098a58bd07565b26ecc471ad2d6a5f368834d
-
SHA256
20ab759531a45365e500196dd7abbad51aedbe73396310cc9687226f957222ed
-
SHA512
102b08358b8b9eabe1f3473d9f4f41c31d70c2c411aa0b3fc6165968db19893faec4d47cc291aa55b6d8f74daf6a5faf6c9cc64fcd57d99ab2717e056890d658
-
SSDEEP
3072:DVHgCc4xGvbwcU9KQ2BBAHmaPxtVo6b5E8Sy/O:KCc4xGxWKQ2Bonx1/O
Static task
static1
Behavioral task
behavioral1
Sample
5a1fe1b68cee21a617b769a68bcdc9a0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5a1fe1b68cee21a617b769a68bcdc9a0N.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Targets
-
-
Target
5a1fe1b68cee21a617b769a68bcdc9a0N.exe
-
Size
226KB
-
MD5
5a1fe1b68cee21a617b769a68bcdc9a0
-
SHA1
a58098a58bd07565b26ecc471ad2d6a5f368834d
-
SHA256
20ab759531a45365e500196dd7abbad51aedbe73396310cc9687226f957222ed
-
SHA512
102b08358b8b9eabe1f3473d9f4f41c31d70c2c411aa0b3fc6165968db19893faec4d47cc291aa55b6d8f74daf6a5faf6c9cc64fcd57d99ab2717e056890d658
-
SSDEEP
3072:DVHgCc4xGvbwcU9KQ2BBAHmaPxtVo6b5E8Sy/O:KCc4xGxWKQ2Bonx1/O
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-