Overview

overview

10

Static

static

3

8017bc74b5...0N.exe

windows7-x64

10

8017bc74b5...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8017bc74b506199dc07cee0017dc8e50N

  • Size

    34KB

  • Sample

    240914-t4r7qstdjm

  • MD5

    8017bc74b506199dc07cee0017dc8e50

  • SHA1

    c6b03002c79b1e03e0116013d22f227f084ed5df

  • SHA256

    91efcb53a274cc43a6385d605fec2e6c31848fc571f5e83b83395c7a2ef16d7d

  • SHA512

    589055c7452f885b057655ded241c58923aecf8cdb978f321ef268b9ec4ba9a6e58040f2725a893003fb2070dc158d618ea60c990650a32ff8d69d99ee615144

  • SSDEEP

    768:9qSqC8+N5ozQQxncwxWmNXMX3cX8wtgg/X/zCtgcgCEX8u/vSXrXrXrXrXrXyirI:9rqfzQQxamN88Fr277777BI

Score
10/10
discovery

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      8017bc74b506199dc07cee0017dc8e50N

    • Size

      34KB

    • MD5

      8017bc74b506199dc07cee0017dc8e50

    • SHA1

      c6b03002c79b1e03e0116013d22f227f084ed5df

    • SHA256

      91efcb53a274cc43a6385d605fec2e6c31848fc571f5e83b83395c7a2ef16d7d

    • SHA512

      589055c7452f885b057655ded241c58923aecf8cdb978f321ef268b9ec4ba9a6e58040f2725a893003fb2070dc158d618ea60c990650a32ff8d69d99ee615144

    • SSDEEP

      768:9qSqC8+N5ozQQxncwxWmNXMX3cX8wtgg/X/zCtgcgCEX8u/vSXrXrXrXrXrXyirI:9rqfzQQxamN88Fr277777BI

    Score
    10/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks