5e92bd3a4e02469c6c7a61fbff7a3d5b0822f2222ddd2745acaf4bd6a58f8a81 | Triage

Sharing

General

Target

5e92bd3a4e02469c6c7a61fbff7a3d5b0822f2222ddd2745acaf4bd6a58f8a81N.exe
Size

66KB
Sample

241122-rnv8cayjgp
MD5

a20cb46917b23e0f6a324566c9a1dd50
SHA1

be5734dfda3e0a1b4c84b9f4dd73c4f1e400e9f8
SHA256

5e92bd3a4e02469c6c7a61fbff7a3d5b0822f2222ddd2745acaf4bd6a58f8a81
SHA512

c1541b41e46b13e0a894a27c40249016ba7628bfbbc1657094141ebad20109299a27b2f654b4219feb8c3203183aface62f00d4649415366bdaa8ac1a7ce7cae
SSDEEP

768:D/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJfU60+ppQ1TTGfLS:DRsvcdcQjosnvnc6LQ1ES

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
griptoloji
Password:
741852

Targets

- Target
  
  5e92bd3a4e02469c6c7a61fbff7a3d5b0822f2222ddd2745acaf4bd6a58f8a81N.exe
- Size
  
  66KB
- MD5
  
  a20cb46917b23e0f6a324566c9a1dd50
- SHA1
  
  be5734dfda3e0a1b4c84b9f4dd73c4f1e400e9f8
- SHA256
  
  5e92bd3a4e02469c6c7a61fbff7a3d5b0822f2222ddd2745acaf4bd6a58f8a81
- SHA512
  
  c1541b41e46b13e0a894a27c40249016ba7628bfbbc1657094141ebad20109299a27b2f654b4219feb8c3203183aface62f00d4649415366bdaa8ac1a7ce7cae
- SSDEEP
  
  768:D/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJfU60+ppQ1TTGfLS:DRsvcdcQjosnvnc6LQ1ES
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2