General

  • Target

    92ce2b0839191ba540c0c132aa2c11c0N.exe

  • Size

    45KB

  • Sample

    240823-gc1zcazfqp

  • MD5

    92ce2b0839191ba540c0c132aa2c11c0

  • SHA1

    41d76cf8ddfcb958e990328c878ffb6729a3338b

  • SHA256

    5cc1fb8781ef9054f3232729d3f1a16b0fd3dd4b7b4c7c25ddd55c87bee5945f

  • SHA512

    9b1a5a8347b3ca6d76c45ab86a02293af829fa58f63fd4fe943b0520ae07e90f46adffaabcad0996a69cf989ed93e30e398bce43399235027bf2e7c2ef600be5

  • SSDEEP

    768:9qSqC8+N5ozQQnncwxWmNXMX3cX8tcXmcX8/XrX8/uUjJ:9rqfzQQnamN88xjm7c7t

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      92ce2b0839191ba540c0c132aa2c11c0N.exe

    • Size

      45KB

    • MD5

      92ce2b0839191ba540c0c132aa2c11c0

    • SHA1

      41d76cf8ddfcb958e990328c878ffb6729a3338b

    • SHA256

      5cc1fb8781ef9054f3232729d3f1a16b0fd3dd4b7b4c7c25ddd55c87bee5945f

    • SHA512

      9b1a5a8347b3ca6d76c45ab86a02293af829fa58f63fd4fe943b0520ae07e90f46adffaabcad0996a69cf989ed93e30e398bce43399235027bf2e7c2ef600be5

    • SSDEEP

      768:9qSqC8+N5ozQQnncwxWmNXMX3cX8tcXmcX8/XrX8/uUjJ:9rqfzQQnamN88xjm7c7t

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks