f69bbc1712a96808500ab25d758e08cea5221c2a269ebd97f88fb152710ab7d8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

758eb451a33886e9dca5ef9f9b27fc40N
Size

58KB
Sample

240914-wm2qysxgmf
MD5

758eb451a33886e9dca5ef9f9b27fc40
SHA1

e91fabf736fedb02068bbad1a58091bc935b7cd6
SHA256

f69bbc1712a96808500ab25d758e08cea5221c2a269ebd97f88fb152710ab7d8
SHA512

3a78df0cdd12bc17822a76025291ebb976773fa4ccc6930c96a685dbf21cccc21a2b7b0163e9ce4395b318b987a1a3a72abb17225dc5c15756d6b0a40bce17ae
SSDEEP

768:9qSqC8+N5ozQQRncwxWmNXMX3cX8wtgtzpAXpX8/X/7CUrfbtSqkf:9rqfzQQRamN8835mv7CUroqkf

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Targets

- Target
  
  758eb451a33886e9dca5ef9f9b27fc40N
- Size
  
  58KB
- MD5
  
  758eb451a33886e9dca5ef9f9b27fc40
- SHA1
  
  e91fabf736fedb02068bbad1a58091bc935b7cd6
- SHA256
  
  f69bbc1712a96808500ab25d758e08cea5221c2a269ebd97f88fb152710ab7d8
- SHA512
  
  3a78df0cdd12bc17822a76025291ebb976773fa4ccc6930c96a685dbf21cccc21a2b7b0163e9ce4395b318b987a1a3a72abb17225dc5c15756d6b0a40bce17ae
- SSDEEP
  
  768:9qSqC8+N5ozQQRncwxWmNXMX3cX8wtgtzpAXpX8/X/7CUrfbtSqkf:9rqfzQQRamN8835mv7CUroqkf
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2