Overview

overview

10

Static

static

3

8520d5e511...18.exe

windows7-x64

10

8520d5e511...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8520d5e5112f7b3cedd64ed8b5a52e37_JaffaCakes118

  • Size

    35KB

  • Sample

    240810-hcx35azakj

  • MD5

    8520d5e5112f7b3cedd64ed8b5a52e37

  • SHA1

    9164bea8ddfaff585146dbbe5ade74650476df4b

  • SHA256

    6673878c02f5371fac73ec96109ca401bb51cb10492942197c01c17569de794c

  • SHA512

    e740325f94d0df38aeb0d6f72b6981e343d784086f34ef0b805456738acc37ed0ebf6e7d0efd3c920ff1438e686e7267c84e22b437adc35635c64bcef9b341c8

  • SSDEEP

    768:zflivXrVKpVhKvtxwYHwVFoeAQWmucwUF:7lqrVKprVuQW2

Score
10/10
discovery

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      8520d5e5112f7b3cedd64ed8b5a52e37_JaffaCakes118

    • Size

      35KB

    • MD5

      8520d5e5112f7b3cedd64ed8b5a52e37

    • SHA1

      9164bea8ddfaff585146dbbe5ade74650476df4b

    • SHA256

      6673878c02f5371fac73ec96109ca401bb51cb10492942197c01c17569de794c

    • SHA512

      e740325f94d0df38aeb0d6f72b6981e343d784086f34ef0b805456738acc37ed0ebf6e7d0efd3c920ff1438e686e7267c84e22b437adc35635c64bcef9b341c8

    • SSDEEP

      768:zflivXrVKpVhKvtxwYHwVFoeAQWmucwUF:7lqrVKprVuQW2

    Score
    10/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks