ae2c55d97db902836aa071e9730107d63442618abf55e1788fb03d62f3e1b111 | Triage

Sharing

General

Target

ed4f086cec6ebcca17add47eee7c68ce_JaffaCakes118
Size

236KB
Sample

240920-ljwqeszclh
MD5

ed4f086cec6ebcca17add47eee7c68ce
SHA1

9e09812c7a6461488275805bfa67c095d68af561
SHA256

ae2c55d97db902836aa071e9730107d63442618abf55e1788fb03d62f3e1b111
SHA512

82ecbc827138bd4561971eab87cd9a4735d7858c8c754ee2c9153c17092124732a15f4a23f38b28fd4420437b0a2f572acfbfbc38e181f58c466bc3d6fd4e685
SSDEEP

3072:UVHgCc4xGvbwcU9KQ2BBAHmaPxlVoIb5ERvi5PZGU:BCc4xGxWKQ2Bonx9P3

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.byethost12.com
Port:
21
Username:
b12_8082975
Password:
951753zx

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Targets

- Target
  
  ed4f086cec6ebcca17add47eee7c68ce_JaffaCakes118
- Size
  
  236KB
- MD5
  
  ed4f086cec6ebcca17add47eee7c68ce
- SHA1
  
  9e09812c7a6461488275805bfa67c095d68af561
- SHA256
  
  ae2c55d97db902836aa071e9730107d63442618abf55e1788fb03d62f3e1b111
- SHA512
  
  82ecbc827138bd4561971eab87cd9a4735d7858c8c754ee2c9153c17092124732a15f4a23f38b28fd4420437b0a2f572acfbfbc38e181f58c466bc3d6fd4e685
- SSDEEP
  
  3072:UVHgCc4xGvbwcU9KQ2BBAHmaPxlVoIb5ERvi5PZGU:BCc4xGxWKQ2Bonx9P3
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2