a2f8a0bd595764dc576197c9c884b5f4a37febfa8e1d80e9af6ec37f7394d321 | Triage

Sharing

General

Target

eab67ce0abea1d78963bfb9078d37736_JaffaCakes118
Size

96KB
Sample

240919-gn6c7sthpn
MD5

eab67ce0abea1d78963bfb9078d37736
SHA1

768a411fe89654c6cb7f59a76506058b8f689002
SHA256

a2f8a0bd595764dc576197c9c884b5f4a37febfa8e1d80e9af6ec37f7394d321
SHA512

430205dd38d6cc21ee71e9e427995902331d10e2967ee174eedae870de5d460463d6a1ea2c141021092f077ee793744c616c91951b76dd6817c491d3aa6650f0
SSDEEP

768:sqQoj/dSzNVQ1mDNJWbKEdBMQXQ3Cn4eQQercwxsRf:RQoj/YNJcAQeMJ

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
griptoloji
Password:
741852

Targets

- Target
  
  eab67ce0abea1d78963bfb9078d37736_JaffaCakes118
- Size
  
  96KB
- MD5
  
  eab67ce0abea1d78963bfb9078d37736
- SHA1
  
  768a411fe89654c6cb7f59a76506058b8f689002
- SHA256
  
  a2f8a0bd595764dc576197c9c884b5f4a37febfa8e1d80e9af6ec37f7394d321
- SHA512
  
  430205dd38d6cc21ee71e9e427995902331d10e2967ee174eedae870de5d460463d6a1ea2c141021092f077ee793744c616c91951b76dd6817c491d3aa6650f0
- SSDEEP
  
  768:sqQoj/dSzNVQ1mDNJWbKEdBMQXQ3Cn4eQQercwxsRf:RQoj/YNJcAQeMJ
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2