2588dd70e05b37fe963730b30f15d670ed1e2342c48c63cda1ac7a6d0f8f289f | Triage

Sharing

General

Target

886051218e23ddaaed4423ebc10d2ce5_JaffaCakes118
Size

35KB
Sample

240811-bcgmta1gna
MD5

886051218e23ddaaed4423ebc10d2ce5
SHA1

aa79a1f9d75b1b7e69861b6699418a6efb92b651
SHA256

2588dd70e05b37fe963730b30f15d670ed1e2342c48c63cda1ac7a6d0f8f289f
SHA512

ebc6ad5d1f9f12cc5986cdc1ae0dfc17bf8e67001d83140784a8ed9b7c4b2902a43f9de13952016599a838c870905e464850b520f5f57e3572c3fe7f91c73ba1
SSDEEP

768:cflivXrVKpVhKvtxwYHwVFoeAQumucwUo14:ylqrVKprVuQu14

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Targets

- Target
  
  886051218e23ddaaed4423ebc10d2ce5_JaffaCakes118
- Size
  
  35KB
- MD5
  
  886051218e23ddaaed4423ebc10d2ce5
- SHA1
  
  aa79a1f9d75b1b7e69861b6699418a6efb92b651
- SHA256
  
  2588dd70e05b37fe963730b30f15d670ed1e2342c48c63cda1ac7a6d0f8f289f
- SHA512
  
  ebc6ad5d1f9f12cc5986cdc1ae0dfc17bf8e67001d83140784a8ed9b7c4b2902a43f9de13952016599a838c870905e464850b520f5f57e3572c3fe7f91c73ba1
- SSDEEP
  
  768:cflivXrVKpVhKvtxwYHwVFoeAQumucwUo14:ylqrVKprVuQu14
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2