Overview

overview

10

Static

static

3

7765102853...18.exe

windows7-x64

10

7765102853...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    77651028536a2a1d47efcdcb336fff99_JaffaCakes118

  • Size

    188KB

  • Sample

    240727-jgadasxeld

  • MD5

    77651028536a2a1d47efcdcb336fff99

  • SHA1

    e32b8e6d76c59e5dff326a09fb74f9058ae7b38e

  • SHA256

    3736f2f482cc91dc5a46411b8b5b57290c1119139223d08c8b63a314889c091a

  • SHA512

    a21544cbcdcae96f2d43921cdef80697b90811f43bdac572312c728ac6b911828b0719daa18cac10fa4cb39c2d4124ff8aa6ab4a5770d2b6aab0c6b1ddae4c34

  • SSDEEP

    1536:gvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjrSrow4tz4:gvVQLIkLWeaA8KlCph9Grow4tz4

Score
10/10
discovery

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      77651028536a2a1d47efcdcb336fff99_JaffaCakes118

    • Size

      188KB

    • MD5

      77651028536a2a1d47efcdcb336fff99

    • SHA1

      e32b8e6d76c59e5dff326a09fb74f9058ae7b38e

    • SHA256

      3736f2f482cc91dc5a46411b8b5b57290c1119139223d08c8b63a314889c091a

    • SHA512

      a21544cbcdcae96f2d43921cdef80697b90811f43bdac572312c728ac6b911828b0719daa18cac10fa4cb39c2d4124ff8aa6ab4a5770d2b6aab0c6b1ddae4c34

    • SSDEEP

      1536:gvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjrSrow4tz4:gvVQLIkLWeaA8KlCph9Grow4tz4

    Score
    10/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks