General
-
Target
NEAS.945d8fcf98738fc264ccdabded1214f0.exe
-
Size
357KB
-
Sample
231028-ypp62shb8z
-
MD5
945d8fcf98738fc264ccdabded1214f0
-
SHA1
9ca597ce6ee41da297e87705ef7a9813e7d01b05
-
SHA256
ba8f885bafa0932bdc3a3d543b95edd34dc1adcf248e36b2cb56be5b31ed65c4
-
SHA512
63289b7993b5262e62d3d07c4d15d592ce78ebc7cb0624010fecf8edddea3701e828bfe37e50dc194f22b4335ea6ceee932ca627bd3c635c4fa3d35f94bd63a7
-
SSDEEP
1536:vZ/fgEAqJlV+n1EgGHo7P1YPx28VayonYsRr:v1gEZl0nt/P1YPx/onJ
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.945d8fcf98738fc264ccdabded1214f0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.945d8fcf98738fc264ccdabded1214f0.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.alizametal.com.tr - Port:
21 - Username:
alizametal.com.tr - Password:
hd611
Targets
-
-
Target
NEAS.945d8fcf98738fc264ccdabded1214f0.exe
-
Size
357KB
-
MD5
945d8fcf98738fc264ccdabded1214f0
-
SHA1
9ca597ce6ee41da297e87705ef7a9813e7d01b05
-
SHA256
ba8f885bafa0932bdc3a3d543b95edd34dc1adcf248e36b2cb56be5b31ed65c4
-
SHA512
63289b7993b5262e62d3d07c4d15d592ce78ebc7cb0624010fecf8edddea3701e828bfe37e50dc194f22b4335ea6ceee932ca627bd3c635c4fa3d35f94bd63a7
-
SSDEEP
1536:vZ/fgEAqJlV+n1EgGHo7P1YPx28VayonYsRr:v1gEZl0nt/P1YPx/onJ
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-