00f16c82d5d13d5c535d279c60cfc9a0065bfc84aec3996fd30986314be08cc8 | Triage

Sharing

General

Target

00f16c82d5d13d5c535d279c60cfc9a0065bfc84aec3996fd30986314be08cc8
Size

63KB
Sample

241122-xyc3eawqhs
MD5

aaba05f611a5339dbdc62bdbcc835c0b
SHA1

5cd9f3a623ad3844d0688ba924dff8e9a5fae487
SHA256

00f16c82d5d13d5c535d279c60cfc9a0065bfc84aec3996fd30986314be08cc8
SHA512

e90f9c3e4a3cd15afdac300bf82eafa044ce772ab691000078919a59431a6068ce79a5843aed04e8e6dc5ab958c53ef7ba6835cdec3d55d99cd149985611114e
SSDEEP

1536:gQTIubHy5wQYJAejpzkGdxDLw3qMndrpPj:R4w7ZpzNdxDL25Z

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Targets

- Target
  
  00f16c82d5d13d5c535d279c60cfc9a0065bfc84aec3996fd30986314be08cc8
- Size
  
  63KB
- MD5
  
  aaba05f611a5339dbdc62bdbcc835c0b
- SHA1
  
  5cd9f3a623ad3844d0688ba924dff8e9a5fae487
- SHA256
  
  00f16c82d5d13d5c535d279c60cfc9a0065bfc84aec3996fd30986314be08cc8
- SHA512
  
  e90f9c3e4a3cd15afdac300bf82eafa044ce772ab691000078919a59431a6068ce79a5843aed04e8e6dc5ab958c53ef7ba6835cdec3d55d99cd149985611114e
- SSDEEP
  
  1536:gQTIubHy5wQYJAejpzkGdxDLw3qMndrpPj:R4w7ZpzNdxDL25Z
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2