General

  • Target

    NEAS.945d8fcf98738fc264ccdabded1214f0.exe

  • Size

    357KB

  • Sample

    231028-ypp62shb8z

  • MD5

    945d8fcf98738fc264ccdabded1214f0

  • SHA1

    9ca597ce6ee41da297e87705ef7a9813e7d01b05

  • SHA256

    ba8f885bafa0932bdc3a3d543b95edd34dc1adcf248e36b2cb56be5b31ed65c4

  • SHA512

    63289b7993b5262e62d3d07c4d15d592ce78ebc7cb0624010fecf8edddea3701e828bfe37e50dc194f22b4335ea6ceee932ca627bd3c635c4fa3d35f94bd63a7

  • SSDEEP

    1536:vZ/fgEAqJlV+n1EgGHo7P1YPx28VayonYsRr:v1gEZl0nt/P1YPx/onJ

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.alizametal.com.tr
  • Port:
    21
  • Username:
    alizametal.com.tr
  • Password:
    hd611

Targets

    • Target

      NEAS.945d8fcf98738fc264ccdabded1214f0.exe

    • Size

      357KB

    • MD5

      945d8fcf98738fc264ccdabded1214f0

    • SHA1

      9ca597ce6ee41da297e87705ef7a9813e7d01b05

    • SHA256

      ba8f885bafa0932bdc3a3d543b95edd34dc1adcf248e36b2cb56be5b31ed65c4

    • SHA512

      63289b7993b5262e62d3d07c4d15d592ce78ebc7cb0624010fecf8edddea3701e828bfe37e50dc194f22b4335ea6ceee932ca627bd3c635c4fa3d35f94bd63a7

    • SSDEEP

      1536:vZ/fgEAqJlV+n1EgGHo7P1YPx28VayonYsRr:v1gEZl0nt/P1YPx/onJ

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks