Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

NEAS.e18f2...80.exe

windows7-x64

10

NEAS.e18f2...80.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.e18f2ef0dad4026996dcdad9bc453d80.exe

  • Size

    192KB

  • Sample

    231113-cczn3afd5y

  • MD5

    e18f2ef0dad4026996dcdad9bc453d80

  • SHA1

    742acc4cbc8699fe3d40ee5baec84358649048b0

  • SHA256

    f570d306f31da017163d9a2e70340ce1856eb7e18e29dfb4c9597f8860c41de8

  • SHA512

    dfaa6134ba8109bc2ece47ea776726109552868f9365f21c613e4a513e62761581c257f2ffd5a1e38b7395cc8a1b5e8a6aeaf208c26fd772a08540fa60d0e116

  • SSDEEP

    1536:XvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjVSrowND57S:XvVQLIkLWeaA8KlCph9crowNs

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.byethost12.com
  • Port:
    21
  • Username:
    b12_8082975
  • Password:
    951753zx

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      NEAS.e18f2ef0dad4026996dcdad9bc453d80.exe

    • Size

      192KB

    • MD5

      e18f2ef0dad4026996dcdad9bc453d80

    • SHA1

      742acc4cbc8699fe3d40ee5baec84358649048b0

    • SHA256

      f570d306f31da017163d9a2e70340ce1856eb7e18e29dfb4c9597f8860c41de8

    • SHA512

      dfaa6134ba8109bc2ece47ea776726109552868f9365f21c613e4a513e62761581c257f2ffd5a1e38b7395cc8a1b5e8a6aeaf208c26fd772a08540fa60d0e116

    • SSDEEP

      1536:XvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjVSrowND57S:XvVQLIkLWeaA8KlCph9crowNs

    Score
    10/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks