General

  • Target

    ecb80689896739e5065405d5a464da2b_JaffaCakes118

  • Size

    34KB

  • Sample

    240920-djw27avfpc

  • MD5

    ecb80689896739e5065405d5a464da2b

  • SHA1

    5640ed0c219a2e7d092aec52bddfa613b1b06c7d

  • SHA256

    5f3d2f047e4466d8887e076b0fd364b79140e8c1280ce3f19527edab29adeea1

  • SHA512

    b9eaa12f8760ca82d8e8d5d934ee87c9762ab5e6742cfe8bc1faec372d8db7677f64991519e8d9925f942385ea1718222403e5f1ad091cd05207ca66ad46de90

  • SSDEEP

    768:cflivXrVKpVhKvtxwYHwVFoeAQxmucwUe:ylqrVKprVuQxT

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      ecb80689896739e5065405d5a464da2b_JaffaCakes118

    • Size

      34KB

    • MD5

      ecb80689896739e5065405d5a464da2b

    • SHA1

      5640ed0c219a2e7d092aec52bddfa613b1b06c7d

    • SHA256

      5f3d2f047e4466d8887e076b0fd364b79140e8c1280ce3f19527edab29adeea1

    • SHA512

      b9eaa12f8760ca82d8e8d5d934ee87c9762ab5e6742cfe8bc1faec372d8db7677f64991519e8d9925f942385ea1718222403e5f1ad091cd05207ca66ad46de90

    • SSDEEP

      768:cflivXrVKpVhKvtxwYHwVFoeAQxmucwUe:ylqrVKprVuQxT

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks