General

  • Target

    NEAS.8e58c900964c6c6a987fc284e23b3350.exe

  • Size

    376KB

  • Sample

    231013-zasjascc2w

  • MD5

    8e58c900964c6c6a987fc284e23b3350

  • SHA1

    11d97983d82fe650b82ff08c7f5130e324509b53

  • SHA256

    8ade8ba36fd01edcc2ed33decbe2b277049b20107ed361e4337e6ba117cbe10b

  • SHA512

    31657412048dbbea8d5cc80fc28cb9a03a4b974dc32b0680a7a74d66fdca255e68850af377b1e9780728d7338029ad4009568956d1a34a0285569251b50f3551

  • SSDEEP

    6144:YVTarW9Q2d06VPAKovnQUvmmAF7J77777S40XB7:YVmrW9HNPGvnQUvmmAF7J77777SnXB7

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      NEAS.8e58c900964c6c6a987fc284e23b3350.exe

    • Size

      376KB

    • MD5

      8e58c900964c6c6a987fc284e23b3350

    • SHA1

      11d97983d82fe650b82ff08c7f5130e324509b53

    • SHA256

      8ade8ba36fd01edcc2ed33decbe2b277049b20107ed361e4337e6ba117cbe10b

    • SHA512

      31657412048dbbea8d5cc80fc28cb9a03a4b974dc32b0680a7a74d66fdca255e68850af377b1e9780728d7338029ad4009568956d1a34a0285569251b50f3551

    • SSDEEP

      6144:YVTarW9Q2d06VPAKovnQUvmmAF7J77777S40XB7:YVmrW9HNPGvnQUvmmAF7J77777SnXB7

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks