394815d29801462e7c64bcd3eae9aa337e44f8153e1128964132e1bf7c2e8461 | Triage

Sharing

General

Target

c266a80102b18214213c40df8ae1a590N
Size

213KB
Sample

240912-ylssrs1fjm
MD5

c266a80102b18214213c40df8ae1a590
SHA1

22e116c56d8003cc76ebc20c9c6208ddc39d4c2b
SHA256

394815d29801462e7c64bcd3eae9aa337e44f8153e1128964132e1bf7c2e8461
SHA512

1517295e31eb032f0300d4b2282d55999c5e2d287b66ce857ccb7c49481a9df7e9e93314434df50573e03df07ba943527777679ee5ecafb5a1bb217028fcecb0
SSDEEP

1536:P5AiTLOQ74YDtnlN5UL09atT0mBBAragjSvIYFwAmd/oHQpNulP:P53mQ7JtnP5I09qgmBBAWgjSvwN/oHWm

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Targets

- Target
  
  c266a80102b18214213c40df8ae1a590N
- Size
  
  213KB
- MD5
  
  c266a80102b18214213c40df8ae1a590
- SHA1
  
  22e116c56d8003cc76ebc20c9c6208ddc39d4c2b
- SHA256
  
  394815d29801462e7c64bcd3eae9aa337e44f8153e1128964132e1bf7c2e8461
- SHA512
  
  1517295e31eb032f0300d4b2282d55999c5e2d287b66ce857ccb7c49481a9df7e9e93314434df50573e03df07ba943527777679ee5ecafb5a1bb217028fcecb0
- SSDEEP
  
  1536:P5AiTLOQ74YDtnlN5UL09atT0mBBAragjSvIYFwAmd/oHQpNulP:P53mQ7JtnP5I09qgmBBAWgjSvwN/oHWm
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2