Overview

overview

10

Static

static

3

0fbb2c5707...18.exe

windows7-x64

10

0fbb2c5707...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0fbb2c570763c61ffd4a6d7e4cdd455f_JaffaCakes118

  • Size

    34KB

  • Sample

    241003-vfpmdawdmp

  • MD5

    0fbb2c570763c61ffd4a6d7e4cdd455f

  • SHA1

    0eaf2eb214d8e5b674d6f51fa90960367acea7a8

  • SHA256

    adc2c8fd7dfed8f6b1a3974f74c35d52c42eacec3cc8cfd872c380d36abb266d

  • SHA512

    a51bc99750b9a9999a156aec4bbc82c451c6d83d32126746c7169380685650b6fc157ccbc1cb004954cb0d2fe0941c41ae85102053e91a17d07acb86ece8ece6

  • SSDEEP

    768:mzQYScGrIubHuYtvdxwYHw5FAe2Qfncwx/Dw9:gQTIubHy5wQfjDS

Score
10/10
discovery

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      0fbb2c570763c61ffd4a6d7e4cdd455f_JaffaCakes118

    • Size

      34KB

    • MD5

      0fbb2c570763c61ffd4a6d7e4cdd455f

    • SHA1

      0eaf2eb214d8e5b674d6f51fa90960367acea7a8

    • SHA256

      adc2c8fd7dfed8f6b1a3974f74c35d52c42eacec3cc8cfd872c380d36abb266d

    • SHA512

      a51bc99750b9a9999a156aec4bbc82c451c6d83d32126746c7169380685650b6fc157ccbc1cb004954cb0d2fe0941c41ae85102053e91a17d07acb86ece8ece6

    • SSDEEP

      768:mzQYScGrIubHuYtvdxwYHw5FAe2Qfncwx/Dw9:gQTIubHy5wQfjDS

    Score
    10/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks