General

  • Target

    NEAS.22ce1c37e5f9c0713faab8e96e3cfa80_JC.exe

  • Size

    325KB

  • Sample

    231014-sfeq3ahf39

  • MD5

    22ce1c37e5f9c0713faab8e96e3cfa80

  • SHA1

    13c57b428e65023d2d15c7114f49d6a1d1420016

  • SHA256

    75aced31aa3483d1fb895eec10c28427947de068dda090a7aa67879fa290d940

  • SHA512

    855636899421c096e310ca7bd88cc3c5650c0dcfdda67eb75c198d549e3a3767ec89ab24567c77e2287f7e7a83fbf75d184edb9b948366224307ba9967e6c401

  • SSDEEP

    3072:P53mQkJtnP5I09qgmBBAWgjSvwN/ouW5NeboYXN/L3cc:NmxJtna2qgmBNgQwEekoN7cc

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      NEAS.22ce1c37e5f9c0713faab8e96e3cfa80_JC.exe

    • Size

      325KB

    • MD5

      22ce1c37e5f9c0713faab8e96e3cfa80

    • SHA1

      13c57b428e65023d2d15c7114f49d6a1d1420016

    • SHA256

      75aced31aa3483d1fb895eec10c28427947de068dda090a7aa67879fa290d940

    • SHA512

      855636899421c096e310ca7bd88cc3c5650c0dcfdda67eb75c198d549e3a3767ec89ab24567c77e2287f7e7a83fbf75d184edb9b948366224307ba9967e6c401

    • SSDEEP

      3072:P53mQkJtnP5I09qgmBBAWgjSvwN/ouW5NeboYXN/L3cc:NmxJtna2qgmBNgQwEekoN7cc

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks