General

  • Target

    b0532c4a6d8d961b0eeca46508da0ab30206d7400c4c0d799b093f2ceac4cdf2N.exe

  • Size

    264KB

  • Sample

    241120-z8sxqavalp

  • MD5

    f87d23a5edb96c0d2f58dd36921c6be0

  • SHA1

    27c2fb9f17952957d928437d8bda2fec5ca3ede0

  • SHA256

    b0532c4a6d8d961b0eeca46508da0ab30206d7400c4c0d799b093f2ceac4cdf2

  • SHA512

    0b3fe249219a40b0754fee936b440fcedf56877aef033406095deeaa97165df1cc82334ed7a41d6b1dd67182f419b11316608bcc3d6160ea9ee44e1e8522e467

  • SSDEEP

    3072:O7BMvaWjzrLXQQJKgmSBAVpet2AgohlMZ+:saaWjz/gGKgmS+k2SF

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      b0532c4a6d8d961b0eeca46508da0ab30206d7400c4c0d799b093f2ceac4cdf2N.exe

    • Size

      264KB

    • MD5

      f87d23a5edb96c0d2f58dd36921c6be0

    • SHA1

      27c2fb9f17952957d928437d8bda2fec5ca3ede0

    • SHA256

      b0532c4a6d8d961b0eeca46508da0ab30206d7400c4c0d799b093f2ceac4cdf2

    • SHA512

      0b3fe249219a40b0754fee936b440fcedf56877aef033406095deeaa97165df1cc82334ed7a41d6b1dd67182f419b11316608bcc3d6160ea9ee44e1e8522e467

    • SSDEEP

      3072:O7BMvaWjzrLXQQJKgmSBAVpet2AgohlMZ+:saaWjz/gGKgmS+k2SF

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks