Overview

overview

9

Static

static

3

NEAS.000e9...d0.exe

windows7-x64

1

NEAS.000e9...d0.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.000e9829bcad9b40abb1fbbfd292add0.exe

  • Size

    675KB

  • Sample

    231104-rv3wrsbd3w

  • MD5

    000e9829bcad9b40abb1fbbfd292add0

  • SHA1

    5b669ed942b01259eaf0010afdf62017e10f172b

  • SHA256

    3fd1740b68b32f08f8560bbae88da9dcad77db17582c3f64ac3c38aad3c3924a

  • SHA512

    4fc0eec537b8327a085ed968811ebc3056a40d292db044c010f3f7bac31baf15bae05fda6aa0673c2133830969d57ebac40d97f8d5145a505927d498ed52e700

  • SSDEEP

    12288:zgS/52f+ZMu6lWPt+7LF7mrCXH3H8aNk2xgNun0L62:US/5u7urFL0XH8aNk6IL62

Score
9/10
evasion

Malware Config

Targets

    • Target

      NEAS.000e9829bcad9b40abb1fbbfd292add0.exe

    • Size

      675KB

    • MD5

      000e9829bcad9b40abb1fbbfd292add0

    • SHA1

      5b669ed942b01259eaf0010afdf62017e10f172b

    • SHA256

      3fd1740b68b32f08f8560bbae88da9dcad77db17582c3f64ac3c38aad3c3924a

    • SHA512

      4fc0eec537b8327a085ed968811ebc3056a40d292db044c010f3f7bac31baf15bae05fda6aa0673c2133830969d57ebac40d97f8d5145a505927d498ed52e700

    • SSDEEP

      12288:zgS/52f+ZMu6lWPt+7LF7mrCXH3H8aNk2xgNun0L62:US/5u7urFL0XH8aNk6IL62

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks