General

  • Target

    9bf6ca2738cded03883c66b694f04ae11566067bf327ae542329bcf707669be2N

  • Size

    64KB

  • Sample

    240920-t15cwswcrf

  • MD5

    5510c5334a5b62efe1cb75f5ba1a17e0

  • SHA1

    59839cacc268ce9edcdca6deb5b807eb85ddcd92

  • SHA256

    9bf6ca2738cded03883c66b694f04ae11566067bf327ae542329bcf707669be2

  • SHA512

    70df587f532a08c69cc8c5b4bc0db27987cf07a29eea5c4f670049114229708661e9f8ab4be4a0a4d2a172375acb23a5bfc8c8c996ae4b7bd96560e2b6a51624

  • SSDEEP

    768:b/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfLvgwc:bRsvcdcQjosnvnZ6LQ1EYl

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    griptoloji
  • Password:
    741852

Targets

    • Target

      9bf6ca2738cded03883c66b694f04ae11566067bf327ae542329bcf707669be2N

    • Size

      64KB

    • MD5

      5510c5334a5b62efe1cb75f5ba1a17e0

    • SHA1

      59839cacc268ce9edcdca6deb5b807eb85ddcd92

    • SHA256

      9bf6ca2738cded03883c66b694f04ae11566067bf327ae542329bcf707669be2

    • SHA512

      70df587f532a08c69cc8c5b4bc0db27987cf07a29eea5c4f670049114229708661e9f8ab4be4a0a4d2a172375acb23a5bfc8c8c996ae4b7bd96560e2b6a51624

    • SSDEEP

      768:b/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfLvgwc:bRsvcdcQjosnvnZ6LQ1EYl

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks