General

  • Target

    5a1fe1b68cee21a617b769a68bcdc9a0N.exe

  • Size

    226KB

  • Sample

    240720-gwzkmazbqj

  • MD5

    5a1fe1b68cee21a617b769a68bcdc9a0

  • SHA1

    a58098a58bd07565b26ecc471ad2d6a5f368834d

  • SHA256

    20ab759531a45365e500196dd7abbad51aedbe73396310cc9687226f957222ed

  • SHA512

    102b08358b8b9eabe1f3473d9f4f41c31d70c2c411aa0b3fc6165968db19893faec4d47cc291aa55b6d8f74daf6a5faf6c9cc64fcd57d99ab2717e056890d658

  • SSDEEP

    3072:DVHgCc4xGvbwcU9KQ2BBAHmaPxtVo6b5E8Sy/O:KCc4xGxWKQ2Bonx1/O

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      5a1fe1b68cee21a617b769a68bcdc9a0N.exe

    • Size

      226KB

    • MD5

      5a1fe1b68cee21a617b769a68bcdc9a0

    • SHA1

      a58098a58bd07565b26ecc471ad2d6a5f368834d

    • SHA256

      20ab759531a45365e500196dd7abbad51aedbe73396310cc9687226f957222ed

    • SHA512

      102b08358b8b9eabe1f3473d9f4f41c31d70c2c411aa0b3fc6165968db19893faec4d47cc291aa55b6d8f74daf6a5faf6c9cc64fcd57d99ab2717e056890d658

    • SSDEEP

      3072:DVHgCc4xGvbwcU9KQ2BBAHmaPxtVo6b5E8Sy/O:KCc4xGxWKQ2Bonx1/O

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks