a424c8c4cc8ad901fdb368cf3e8d2f5c5174b42a3fff147d09b1072cc6a75e94 | Triage

Sharing

General

Target

a424c8c4cc8ad901fdb368cf3e8d2f5c5174b42a3fff147d09b1072cc6a75e94N
Size

244KB
Sample

241005-ebyrgsxhjd
MD5

fac83a63f0530074bbab15b03e8717b0
SHA1

24c55c796064b5fb9afa3b22db5678acc3202695
SHA256

a424c8c4cc8ad901fdb368cf3e8d2f5c5174b42a3fff147d09b1072cc6a75e94
SHA512

5cdbbd3e40cbce73e06481cfdd0cc470bf5f4fa2031e81b442a7878c529cd15b2b0557bafbdc3cae9ed19720971f3afa73b26706012007342afd983cd17e3eb8
SSDEEP

3072:hePgCctxGv4QcU9KQ2BBA2waPxhtmollrAN/kcMKF:dCctxGsWKQ2Bx5xvhcNOKF

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Targets

- Target
  
  a424c8c4cc8ad901fdb368cf3e8d2f5c5174b42a3fff147d09b1072cc6a75e94N
- Size
  
  244KB
- MD5
  
  fac83a63f0530074bbab15b03e8717b0
- SHA1
  
  24c55c796064b5fb9afa3b22db5678acc3202695
- SHA256
  
  a424c8c4cc8ad901fdb368cf3e8d2f5c5174b42a3fff147d09b1072cc6a75e94
- SHA512
  
  5cdbbd3e40cbce73e06481cfdd0cc470bf5f4fa2031e81b442a7878c529cd15b2b0557bafbdc3cae9ed19720971f3afa73b26706012007342afd983cd17e3eb8
- SSDEEP
  
  3072:hePgCctxGv4QcU9KQ2BBA2waPxhtmollrAN/kcMKF:dCctxGsWKQ2Bx5xvhcNOKF
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2