d6642657cbb5913bdc30d71e5e06589d5c08c5ecdacc2b6dbc081d9182ac7a1e | Triage

Sharing

General

Target

d6642657cbb5913bdc30d71e5e06589d5c08c5ecdacc2b6dbc081d9182ac7a1e.exe
Size

96KB
Sample

241120-gf14hssamg
MD5

79a55854d5d72f5cb04a2b8efed5b4b5
SHA1

154a9fc82a3afc68249cec3ce561f56b670fe644
SHA256

d6642657cbb5913bdc30d71e5e06589d5c08c5ecdacc2b6dbc081d9182ac7a1e
SHA512

5b85bd41dd25153fd9d84ff09bf90ed76ab39400428e156e9da51256794383bb984755039b8cd163c4a7c3086d48d4c054b19aa4796acf03fac9ac2641000a45
SSDEEP

768:r/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfLB:rRsvcdcQjosnvnZ6LQ1EB

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
griptoloji
Password:
741852

Targets

- Target
  
  d6642657cbb5913bdc30d71e5e06589d5c08c5ecdacc2b6dbc081d9182ac7a1e.exe
- Size
  
  96KB
- MD5
  
  79a55854d5d72f5cb04a2b8efed5b4b5
- SHA1
  
  154a9fc82a3afc68249cec3ce561f56b670fe644
- SHA256
  
  d6642657cbb5913bdc30d71e5e06589d5c08c5ecdacc2b6dbc081d9182ac7a1e
- SHA512
  
  5b85bd41dd25153fd9d84ff09bf90ed76ab39400428e156e9da51256794383bb984755039b8cd163c4a7c3086d48d4c054b19aa4796acf03fac9ac2641000a45
- SSDEEP
  
  768:r/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfLB:rRsvcdcQjosnvnZ6LQ1EB
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2