General

  • Target

    a17f66b5cdf94e558195b7c163e12640N.exe

  • Size

    96KB

  • Sample

    240905-hjtpaavcrr

  • MD5

    a17f66b5cdf94e558195b7c163e12640

  • SHA1

    ef3943864796d208aff8e3d57bfe2085143ab123

  • SHA256

    7ff297e9e64f6c203633d5052ad3e6c58a1662ddbbee35c7c6c3a79f5659dd78

  • SHA512

    8e627b1e0eedce93eed9ef11f7ed6c5a060271473826d25fe05a252d9c50e128f308bdde9bcf899f5b13fd54f421cb463566a74bb62f677a97975c73d44e0239

  • SSDEEP

    768:p/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJi+vBU6u7DPQ1TTGfGYc+pX:pRsvcdcQjosnvng6uQ1JO

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    griptoloji
  • Password:
    741852

Targets

    • Target

      a17f66b5cdf94e558195b7c163e12640N.exe

    • Size

      96KB

    • MD5

      a17f66b5cdf94e558195b7c163e12640

    • SHA1

      ef3943864796d208aff8e3d57bfe2085143ab123

    • SHA256

      7ff297e9e64f6c203633d5052ad3e6c58a1662ddbbee35c7c6c3a79f5659dd78

    • SHA512

      8e627b1e0eedce93eed9ef11f7ed6c5a060271473826d25fe05a252d9c50e128f308bdde9bcf899f5b13fd54f421cb463566a74bb62f677a97975c73d44e0239

    • SSDEEP

      768:p/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJi+vBU6u7DPQ1TTGfGYc+pX:pRsvcdcQjosnvng6uQ1JO

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks