General

  • Target

    46c78829d737abb18064e48c827070e39c49f3cae1f0cdbd69846e6f8ef346e5N

  • Size

    93KB

  • Sample

    240920-bxn8dssala

  • MD5

    fa43e6ff3ea083478501fc7350ac7ce0

  • SHA1

    e3136c2f630cf597473a10ea778677a5acbe9780

  • SHA256

    46c78829d737abb18064e48c827070e39c49f3cae1f0cdbd69846e6f8ef346e5

  • SHA512

    236899359a12e2b25b1797238d0a1a58f3e530cdc1cecab6e3bdbb15be713dc90feec6ada15ca02996dfc6497dbb94c6864e88398d366e7627a818b37b044eff

  • SSDEEP

    1536:gQTIubHy5wQKJAejpzkGdxDLw3qMnd2943aX9xYTjipvF2MVJi:R4wZZpzNdxDL252943GxYvQd2oo

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      46c78829d737abb18064e48c827070e39c49f3cae1f0cdbd69846e6f8ef346e5N

    • Size

      93KB

    • MD5

      fa43e6ff3ea083478501fc7350ac7ce0

    • SHA1

      e3136c2f630cf597473a10ea778677a5acbe9780

    • SHA256

      46c78829d737abb18064e48c827070e39c49f3cae1f0cdbd69846e6f8ef346e5

    • SHA512

      236899359a12e2b25b1797238d0a1a58f3e530cdc1cecab6e3bdbb15be713dc90feec6ada15ca02996dfc6497dbb94c6864e88398d366e7627a818b37b044eff

    • SSDEEP

      1536:gQTIubHy5wQKJAejpzkGdxDLw3qMnd2943aX9xYTjipvF2MVJi:R4wZZpzNdxDL252943GxYvQd2oo

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks