General
-
Target
NEAS.3206d7de9243c98097a0d41ff1a0ceb0_JC.exe
-
Size
318KB
-
Sample
231103-bf3dpahg4x
-
MD5
3206d7de9243c98097a0d41ff1a0ceb0
-
SHA1
acf062a85060b9520cf7bf7152e8a5faf1206044
-
SHA256
8e1e75cab9e91f2c8d7f6014facd939ad8d5fa4948ef8b91f24f01cae9cbca07
-
SHA512
543c35a5ab5f34d0e683e33c5873236df9d95891fd02a9db9c4840b76267bba831a1ffd63e42ebf47d259d76ddef81956a3d1c5234375551cbc2ecdbb2bf87b9
-
SSDEEP
3072:RChJgYMm4xf9cU9KQ2BxA59SPMLOoVn2PjHNRaeqSjGJ37XKmIiQJmtonVmc1:lYMm4xiWKQ2BiCMOOejc7oJnnV/1
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.3206d7de9243c98097a0d41ff1a0ceb0_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.3206d7de9243c98097a0d41ff1a0ceb0_JC.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Targets
-
-
Target
NEAS.3206d7de9243c98097a0d41ff1a0ceb0_JC.exe
-
Size
318KB
-
MD5
3206d7de9243c98097a0d41ff1a0ceb0
-
SHA1
acf062a85060b9520cf7bf7152e8a5faf1206044
-
SHA256
8e1e75cab9e91f2c8d7f6014facd939ad8d5fa4948ef8b91f24f01cae9cbca07
-
SHA512
543c35a5ab5f34d0e683e33c5873236df9d95891fd02a9db9c4840b76267bba831a1ffd63e42ebf47d259d76ddef81956a3d1c5234375551cbc2ecdbb2bf87b9
-
SSDEEP
3072:RChJgYMm4xf9cU9KQ2BxA59SPMLOoVn2PjHNRaeqSjGJ37XKmIiQJmtonVmc1:lYMm4xiWKQ2BiCMOOejc7oJnnV/1
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-