General
-
Target
a17f66b5cdf94e558195b7c163e12640N.exe
-
Size
96KB
-
Sample
240905-hjtpaavcrr
-
MD5
a17f66b5cdf94e558195b7c163e12640
-
SHA1
ef3943864796d208aff8e3d57bfe2085143ab123
-
SHA256
7ff297e9e64f6c203633d5052ad3e6c58a1662ddbbee35c7c6c3a79f5659dd78
-
SHA512
8e627b1e0eedce93eed9ef11f7ed6c5a060271473826d25fe05a252d9c50e128f308bdde9bcf899f5b13fd54f421cb463566a74bb62f677a97975c73d44e0239
-
SSDEEP
768:p/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJi+vBU6u7DPQ1TTGfGYc+pX:pRsvcdcQjosnvng6uQ1JO
Static task
static1
Behavioral task
behavioral1
Sample
a17f66b5cdf94e558195b7c163e12640N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a17f66b5cdf94e558195b7c163e12640N.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
griptoloji - Password:
741852
Targets
-
-
Target
a17f66b5cdf94e558195b7c163e12640N.exe
-
Size
96KB
-
MD5
a17f66b5cdf94e558195b7c163e12640
-
SHA1
ef3943864796d208aff8e3d57bfe2085143ab123
-
SHA256
7ff297e9e64f6c203633d5052ad3e6c58a1662ddbbee35c7c6c3a79f5659dd78
-
SHA512
8e627b1e0eedce93eed9ef11f7ed6c5a060271473826d25fe05a252d9c50e128f308bdde9bcf899f5b13fd54f421cb463566a74bb62f677a97975c73d44e0239
-
SSDEEP
768:p/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJi+vBU6u7DPQ1TTGfGYc+pX:pRsvcdcQjosnvng6uQ1JO
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-