821fb0541ff2589dd035ba59d2676cf4ff5f95f189badb4437c350c3b19e3ab5 | Triage

Sharing

General

Target

821fb0541ff2589dd035ba59d2676cf4ff5f95f189badb4437c350c3b19e3ab5N
Size

49KB
Sample

240920-wedn6azarn
MD5

a9bf55a8339b887e60e685ff01984ed0
SHA1

1420650884daf0d7dabefbffe5656131819dceae
SHA256

821fb0541ff2589dd035ba59d2676cf4ff5f95f189badb4437c350c3b19e3ab5
SHA512

19900b47b4a688b04be731eed404add09c5b2e6feef018fa8705b2b67a7ed329f1861b28bd552906482584369aef246665656803c74daa493c609b8a63aaef77
SSDEEP

768:kflivXrVKpVhKvtxwYHwVFoeAQdmucwUKzdlPPKXDbQr8Up:alqrVKprVuQd7z7Pgahp

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Targets

- Target
  
  821fb0541ff2589dd035ba59d2676cf4ff5f95f189badb4437c350c3b19e3ab5N
- Size
  
  49KB
- MD5
  
  a9bf55a8339b887e60e685ff01984ed0
- SHA1
  
  1420650884daf0d7dabefbffe5656131819dceae
- SHA256
  
  821fb0541ff2589dd035ba59d2676cf4ff5f95f189badb4437c350c3b19e3ab5
- SHA512
  
  19900b47b4a688b04be731eed404add09c5b2e6feef018fa8705b2b67a7ed329f1861b28bd552906482584369aef246665656803c74daa493c609b8a63aaef77
- SSDEEP
  
  768:kflivXrVKpVhKvtxwYHwVFoeAQdmucwUKzdlPPKXDbQr8Up:alqrVKprVuQd7z7Pgahp
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2