e04b9ea8d977059ae11c0f9ed5b4dac36195c2dc569b8cc1cc7f9b8e95ce7eec | Triage

Sharing

General

Target

eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118
Size

188KB
Sample

240921-aybg9axapp
MD5

eebe41bea4001decb58d5d64a42c9dc6
SHA1

778d20e8f40241586f0158078bf08515f0f08721
SHA256

e04b9ea8d977059ae11c0f9ed5b4dac36195c2dc569b8cc1cc7f9b8e95ce7eec
SHA512

95f2d90e890f3b46e941d8f2591b029df2b2de53552e010da5199cddaae7ea78c63e2f42756a5bc1c57cba96f8a202639eb3233610f08a4f2b90f2f136e5609f
SSDEEP

1536:EvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcj0Srowm0:EvVQLIkLWeaA8KlCph9hrowm0

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Targets

- Target
  
  eebe41bea4001decb58d5d64a42c9dc6_JaffaCakes118
- Size
  
  188KB
- MD5
  
  eebe41bea4001decb58d5d64a42c9dc6
- SHA1
  
  778d20e8f40241586f0158078bf08515f0f08721
- SHA256
  
  e04b9ea8d977059ae11c0f9ed5b4dac36195c2dc569b8cc1cc7f9b8e95ce7eec
- SHA512
  
  95f2d90e890f3b46e941d8f2591b029df2b2de53552e010da5199cddaae7ea78c63e2f42756a5bc1c57cba96f8a202639eb3233610f08a4f2b90f2f136e5609f
- SSDEEP
  
  1536:EvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcj0Srowm0:EvVQLIkLWeaA8KlCph9hrowm0
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2