General

  • Target

    eef3355677cedcf0b4ddc3a4158e36f2_JaffaCakes118

  • Size

    208KB

  • Sample

    240921-dhgacasbnq

  • MD5

    eef3355677cedcf0b4ddc3a4158e36f2

  • SHA1

    46037dcfb9421b611769f2d133f3c69787d18b22

  • SHA256

    977a51ee8ca1bb6b29b806fb210ff63828909fae364e8391be82f5f732e9dd81

  • SHA512

    81dd518d32adb2137a05c0ae17743ce90b8b79a474552730f4ffb05395174a12f3b607b7571b0ce82fa7ba72d71d0c571261646b5a1cdda4fa5132a0301936fd

  • SSDEEP

    3072:SChJgYMm4xf9cU9KQ2BxA59SPMGOorn2C:qYMm4xiWKQ2BiCMi

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      eef3355677cedcf0b4ddc3a4158e36f2_JaffaCakes118

    • Size

      208KB

    • MD5

      eef3355677cedcf0b4ddc3a4158e36f2

    • SHA1

      46037dcfb9421b611769f2d133f3c69787d18b22

    • SHA256

      977a51ee8ca1bb6b29b806fb210ff63828909fae364e8391be82f5f732e9dd81

    • SHA512

      81dd518d32adb2137a05c0ae17743ce90b8b79a474552730f4ffb05395174a12f3b607b7571b0ce82fa7ba72d71d0c571261646b5a1cdda4fa5132a0301936fd

    • SSDEEP

      3072:SChJgYMm4xf9cU9KQ2BxA59SPMGOorn2C:qYMm4xiWKQ2BiCMi

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks