General

  • Target

    ab83de45d1c16a443b1ec4baa184a233_JaffaCakes118

  • Size

    208KB

  • Sample

    240819-sm8bysvdmr

  • MD5

    ab83de45d1c16a443b1ec4baa184a233

  • SHA1

    78d05f2d0a3543491217be713abb945f694c4cbe

  • SHA256

    0cbab79640d1995356806068a77d58d4980ba18e21d22a775246807cf811330d

  • SHA512

    c93c338029e7ef8cb272a1891630ac238d4a4e52939420d94c2960198756d121c0048930d936926e32cfc4d9314c4d8ac498224ca339f99d6b239f16908d111f

  • SSDEEP

    3072:tChJgYMm4xf9cU9KQ2BxA59SPMpOoin2t:JYMm4xiWKQ2BiCM7

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      ab83de45d1c16a443b1ec4baa184a233_JaffaCakes118

    • Size

      208KB

    • MD5

      ab83de45d1c16a443b1ec4baa184a233

    • SHA1

      78d05f2d0a3543491217be713abb945f694c4cbe

    • SHA256

      0cbab79640d1995356806068a77d58d4980ba18e21d22a775246807cf811330d

    • SHA512

      c93c338029e7ef8cb272a1891630ac238d4a4e52939420d94c2960198756d121c0048930d936926e32cfc4d9314c4d8ac498224ca339f99d6b239f16908d111f

    • SSDEEP

      3072:tChJgYMm4xf9cU9KQ2BxA59SPMpOoin2t:JYMm4xiWKQ2BiCM7

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks