Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    898KB

  • Sample

    240725-1bxebawbnl

  • MD5

    c02798b26bdaf8e27c1c48ef5de4b2c3

  • SHA1

    bc59ab8827e13d1a9a1892eb4da9cf2d7d62a615

  • SHA256

    af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78

  • SHA512

    b541aeedcc4db6f8e0db0788f2791339476a863c15efc72aef3db916fc7c8ab41d84c0546c05b675be4d7700c4f986dbae5e2858d60ecd44b4ffbcae2065cfc4

  • SSDEEP

    24576:juDXTIGaPhEYzUzA0aouDXTIGaPhEYzUzA0br:KDjlabwz9MDjlabwz93

Score
10/10
discovery

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.aw.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    manabon0512

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.netzero.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    kudo1856

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ak.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    rea1415

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    ab.thn.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    0lsiqa7w

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.xx.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    6sherwtd

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.xx.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    naga777

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ax.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    igirisu0617

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    8akcPTi0n@

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    c93zsxhd@

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.progestionchile.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Rrhh2020

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.iloveyou-company.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    hyhyhy

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    twin12@

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Ihave3cats@

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontiernet.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    loramike

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Skeeter1@

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.af.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    4252982

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.wxmail.xyz
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    CoqgfZ72SYv.7

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ar.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    sippochoi

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ax.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    bornin58

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.totalise.co.uk
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    guypat

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Guitar54!

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ca.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    knfymxed

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.crobart-ge.it
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    271089

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.jbtrans.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    @Jbt10201

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.wisesafety.cn
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Fsdhfoqeo91

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontiernet.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Gypsi711$

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.nifty.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    an0908an

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.marmilla.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Marmilla@1

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.xx.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    king0113

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.rr.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    11241206

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.number1cleaningservices.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    MeawMeaw2499

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Forest890#

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.midwich-cuckoos.co.uk
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    folk65

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ak.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    snoopy

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.radiotamandare.com.br
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    luize1984

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.nn.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    naoko705

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.nn.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    itty081101

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontier.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Jennifer1@

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mw-002.cafe24.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    1terat0r

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    ny.thn.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    leon0806

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ag.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    nu53tb3l

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.cascavelfm.com.br
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    fc806024

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.am.em-net.ne.jp
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    etsu2382

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.citlink.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Giftshop1

Targets

    • Target

      file.exe

    • Size

      898KB

    • MD5

      c02798b26bdaf8e27c1c48ef5de4b2c3

    • SHA1

      bc59ab8827e13d1a9a1892eb4da9cf2d7d62a615

    • SHA256

      af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78

    • SHA512

      b541aeedcc4db6f8e0db0788f2791339476a863c15efc72aef3db916fc7c8ab41d84c0546c05b675be4d7700c4f986dbae5e2858d60ecd44b4ffbcae2065cfc4

    • SSDEEP

      24576:juDXTIGaPhEYzUzA0aouDXTIGaPhEYzUzA0br:KDjlabwz9MDjlabwz93

    Score
    10/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks