General

  • Target

    NEAS.c25323c99ac8d16a73f33eadc8fe66a0.exe

  • Size

    224KB

  • Sample

    231111-e9cxnsbf89

  • MD5

    c25323c99ac8d16a73f33eadc8fe66a0

  • SHA1

    a79c20ab303e9b59f2f14bccfff9f44929087fdd

  • SHA256

    2da702e6666e772a5aa0bceddc7152489c0b676846d3c8bbd085d3e1795b1f3b

  • SHA512

    66addaa69eb9eed89b31df73cf9364d5d206f4050736a1993af57a741424a1ed79906bfac42c0af3f858ba16aa7c888c1de6ddefeb309f9c1ecfb97a231cc8e8

  • SSDEEP

    3072:vVHgCc4xGvbwcU9KQ2BBAHmaPxsSVoKb5Eo:mCc4xGxWKQ2BonxsG

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      NEAS.c25323c99ac8d16a73f33eadc8fe66a0.exe

    • Size

      224KB

    • MD5

      c25323c99ac8d16a73f33eadc8fe66a0

    • SHA1

      a79c20ab303e9b59f2f14bccfff9f44929087fdd

    • SHA256

      2da702e6666e772a5aa0bceddc7152489c0b676846d3c8bbd085d3e1795b1f3b

    • SHA512

      66addaa69eb9eed89b31df73cf9364d5d206f4050736a1993af57a741424a1ed79906bfac42c0af3f858ba16aa7c888c1de6ddefeb309f9c1ecfb97a231cc8e8

    • SSDEEP

      3072:vVHgCc4xGvbwcU9KQ2BBAHmaPxsSVoKb5Eo:mCc4xGxWKQ2BonxsG

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks