General

  • Target

    NEAS.782aeefbd955d45961ae1061db532380.exe

  • Size

    210KB

  • Sample

    231031-kvfmxaef79

  • MD5

    782aeefbd955d45961ae1061db532380

  • SHA1

    16f20dcba806379cb3410bb214cfd14ea426b230

  • SHA256

    53feb9a6b0f3c57f6b0e3b5474bd9e805c1b41113613a92e609f6cc08534ca15

  • SHA512

    bead21ff537246f7ebbad8d69cf1c1d70b7927f897729a75001451548090cedb68c3f82806cbbe2afbdf810bbc394ab806e108f1a5dbcd48751b7039eba8bda9

  • SSDEEP

    3072:pePgCctxGv4QcU9KQ2BBA2waPxhtmollsX:lCctxGsWKQ2Bx5xvhC

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      NEAS.782aeefbd955d45961ae1061db532380.exe

    • Size

      210KB

    • MD5

      782aeefbd955d45961ae1061db532380

    • SHA1

      16f20dcba806379cb3410bb214cfd14ea426b230

    • SHA256

      53feb9a6b0f3c57f6b0e3b5474bd9e805c1b41113613a92e609f6cc08534ca15

    • SHA512

      bead21ff537246f7ebbad8d69cf1c1d70b7927f897729a75001451548090cedb68c3f82806cbbe2afbdf810bbc394ab806e108f1a5dbcd48751b7039eba8bda9

    • SSDEEP

      3072:pePgCctxGv4QcU9KQ2BBA2waPxhtmollsX:lCctxGsWKQ2Bx5xvhC

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks