General
-
Target
9bf6ca2738cded03883c66b694f04ae11566067bf327ae542329bcf707669be2N
-
Size
64KB
-
Sample
240920-t15cwswcrf
-
MD5
5510c5334a5b62efe1cb75f5ba1a17e0
-
SHA1
59839cacc268ce9edcdca6deb5b807eb85ddcd92
-
SHA256
9bf6ca2738cded03883c66b694f04ae11566067bf327ae542329bcf707669be2
-
SHA512
70df587f532a08c69cc8c5b4bc0db27987cf07a29eea5c4f670049114229708661e9f8ab4be4a0a4d2a172375acb23a5bfc8c8c996ae4b7bd96560e2b6a51624
-
SSDEEP
768:b/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfLvgwc:bRsvcdcQjosnvnZ6LQ1EYl
Static task
static1
Behavioral task
behavioral1
Sample
9bf6ca2738cded03883c66b694f04ae11566067bf327ae542329bcf707669be2N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9bf6ca2738cded03883c66b694f04ae11566067bf327ae542329bcf707669be2N.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
griptoloji - Password:
741852
Targets
-
-
Target
9bf6ca2738cded03883c66b694f04ae11566067bf327ae542329bcf707669be2N
-
Size
64KB
-
MD5
5510c5334a5b62efe1cb75f5ba1a17e0
-
SHA1
59839cacc268ce9edcdca6deb5b807eb85ddcd92
-
SHA256
9bf6ca2738cded03883c66b694f04ae11566067bf327ae542329bcf707669be2
-
SHA512
70df587f532a08c69cc8c5b4bc0db27987cf07a29eea5c4f670049114229708661e9f8ab4be4a0a4d2a172375acb23a5bfc8c8c996ae4b7bd96560e2b6a51624
-
SSDEEP
768:b/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfLvgwc:bRsvcdcQjosnvnZ6LQ1EYl
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-