Overview

overview

10

Static

static

3

c91936d78b...18.exe

windows7-x64

10

c91936d78b...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c91936d78bc5413a33031aae8465d5ab_JaffaCakes118

  • Size

    64KB

  • Sample

    240829-swc76syekh

  • MD5

    c91936d78bc5413a33031aae8465d5ab

  • SHA1

    a3dcafd44bb61273337a861585b61c2fa42c841a

  • SHA256

    d4219ed6780b831560a7aca863c97d2880cfda219b592b494270544094a08706

  • SHA512

    c0e00d154030f420d01511cff7ff3e88c26d5d706bb7286e12b5a49825d207e852edf78f9b49745de85e76768db367a399d316db4ad8292c757879cb3bd34abe

  • SSDEEP

    768:6/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfL5:6RsvcdcQjosnvnZ6LQ1E5

Score
10/10
discovery

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    griptoloji
  • Password:
    741852

Targets

    • Target

      c91936d78bc5413a33031aae8465d5ab_JaffaCakes118

    • Size

      64KB

    • MD5

      c91936d78bc5413a33031aae8465d5ab

    • SHA1

      a3dcafd44bb61273337a861585b61c2fa42c841a

    • SHA256

      d4219ed6780b831560a7aca863c97d2880cfda219b592b494270544094a08706

    • SHA512

      c0e00d154030f420d01511cff7ff3e88c26d5d706bb7286e12b5a49825d207e852edf78f9b49745de85e76768db367a399d316db4ad8292c757879cb3bd34abe

    • SSDEEP

      768:6/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfL5:6RsvcdcQjosnvnZ6LQ1E5

    Score
    10/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks