General
-
Target
NEAS.22ce1c37e5f9c0713faab8e96e3cfa80_JC.exe
-
Size
325KB
-
Sample
231014-sfeq3ahf39
-
MD5
22ce1c37e5f9c0713faab8e96e3cfa80
-
SHA1
13c57b428e65023d2d15c7114f49d6a1d1420016
-
SHA256
75aced31aa3483d1fb895eec10c28427947de068dda090a7aa67879fa290d940
-
SHA512
855636899421c096e310ca7bd88cc3c5650c0dcfdda67eb75c198d549e3a3767ec89ab24567c77e2287f7e7a83fbf75d184edb9b948366224307ba9967e6c401
-
SSDEEP
3072:P53mQkJtnP5I09qgmBBAWgjSvwN/ouW5NeboYXN/L3cc:NmxJtna2qgmBNgQwEekoN7cc
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.22ce1c37e5f9c0713faab8e96e3cfa80_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.22ce1c37e5f9c0713faab8e96e3cfa80_JC.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Targets
-
-
Target
NEAS.22ce1c37e5f9c0713faab8e96e3cfa80_JC.exe
-
Size
325KB
-
MD5
22ce1c37e5f9c0713faab8e96e3cfa80
-
SHA1
13c57b428e65023d2d15c7114f49d6a1d1420016
-
SHA256
75aced31aa3483d1fb895eec10c28427947de068dda090a7aa67879fa290d940
-
SHA512
855636899421c096e310ca7bd88cc3c5650c0dcfdda67eb75c198d549e3a3767ec89ab24567c77e2287f7e7a83fbf75d184edb9b948366224307ba9967e6c401
-
SSDEEP
3072:P53mQkJtnP5I09qgmBBAWgjSvwN/ouW5NeboYXN/L3cc:NmxJtna2qgmBNgQwEekoN7cc
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-