Overview

overview

10

Static

static

3

764f429e84...18.exe

windows7-x64

10

764f429e84...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    764f429e84db3602d83ddde4d874f815_JaffaCakes118

  • Size

    268KB

  • Sample

    240727-aeds9swhrh

  • MD5

    764f429e84db3602d83ddde4d874f815

  • SHA1

    fa733db8f2b4f28473099b7847c8c28448564a0d

  • SHA256

    f40a7daafb48c13172a25149fa8870758e24a53c54f0071e24fe26606abbaa4a

  • SHA512

    13ba0a33bcb1e0a7d8a55f336a0619c31843f22dc188577f4b72c5e224533c80b1e866aba32a34ee35e26a53af2e07b2679bd4687db7c8b9113eda4bf2cf3835

  • SSDEEP

    3072:wVHgCc4xGvbwcU9KQ2BBAHmaPxNVoOb5EW:NCc4xGxWKQ2Bonxh

Score
10/10
discovery

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      764f429e84db3602d83ddde4d874f815_JaffaCakes118

    • Size

      268KB

    • MD5

      764f429e84db3602d83ddde4d874f815

    • SHA1

      fa733db8f2b4f28473099b7847c8c28448564a0d

    • SHA256

      f40a7daafb48c13172a25149fa8870758e24a53c54f0071e24fe26606abbaa4a

    • SHA512

      13ba0a33bcb1e0a7d8a55f336a0619c31843f22dc188577f4b72c5e224533c80b1e866aba32a34ee35e26a53af2e07b2679bd4687db7c8b9113eda4bf2cf3835

    • SSDEEP

      3072:wVHgCc4xGvbwcU9KQ2BBAHmaPxNVoOb5EW:NCc4xGxWKQ2Bonxh

    Score
    10/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks