3ecf28b70de26f160c187240402f2051dec0f6f926b83ab42efc507f9026f901 | Triage

Sharing

General

Target

eaacfb2e67f71e4f862b40f541950bb7_JaffaCakes118
Size

34KB
Sample

240919-f7rhqatbpn
MD5

eaacfb2e67f71e4f862b40f541950bb7
SHA1

4a0ad1c2e8abca09a5c1c9c08495bd50ec156240
SHA256

3ecf28b70de26f160c187240402f2051dec0f6f926b83ab42efc507f9026f901
SHA512

28eac786f1a989ad1fcd0cfb48be095ef01e7631417bfa998d9ffb3e7b2410f8b5c5652b780ac43948dcc023acc01055f94c8d299778798515034ff78d10d57b
SSDEEP

768:cflivXrVKpVhKvtxwYHwVFoeAQXmucwUW:ylqrVKprVuQX5

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Targets

- Target
  
  eaacfb2e67f71e4f862b40f541950bb7_JaffaCakes118
- Size
  
  34KB
- MD5
  
  eaacfb2e67f71e4f862b40f541950bb7
- SHA1
  
  4a0ad1c2e8abca09a5c1c9c08495bd50ec156240
- SHA256
  
  3ecf28b70de26f160c187240402f2051dec0f6f926b83ab42efc507f9026f901
- SHA512
  
  28eac786f1a989ad1fcd0cfb48be095ef01e7631417bfa998d9ffb3e7b2410f8b5c5652b780ac43948dcc023acc01055f94c8d299778798515034ff78d10d57b
- SSDEEP
  
  768:cflivXrVKpVhKvtxwYHwVFoeAQXmucwUW:ylqrVKprVuQX5
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2