General
-
Target
NEAS.00132a03b84d5f0b3514547edcc74ec0.exe
-
Size
252KB
-
Sample
231117-c1tsqaeg5v
-
MD5
00132a03b84d5f0b3514547edcc74ec0
-
SHA1
e89aafd9bede2ed73b83bb18ff3ba88711f68a91
-
SHA256
e6a159e516ba717432dfb3e8ec99116a550da0bf252a37703c49d1d3098c9996
-
SHA512
115af219c2af729fd27467146b21addb573f90efdac1689772f9e0657f2e7877cee07935d7f7236b45965f4be54b68615fa0b1eff359fbfb3d489cb85f80f1d8
-
SSDEEP
3072:afVLWlTTbEGe9AJKlCvIU4qoW1nI5bdLFVgw:cVqdT3GcQ4T7EHVP
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.00132a03b84d5f0b3514547edcc74ec0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.00132a03b84d5f0b3514547edcc74ec0.exe
Resource
win10v2004-20231020-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Targets
-
-
Target
NEAS.00132a03b84d5f0b3514547edcc74ec0.exe
-
Size
252KB
-
MD5
00132a03b84d5f0b3514547edcc74ec0
-
SHA1
e89aafd9bede2ed73b83bb18ff3ba88711f68a91
-
SHA256
e6a159e516ba717432dfb3e8ec99116a550da0bf252a37703c49d1d3098c9996
-
SHA512
115af219c2af729fd27467146b21addb573f90efdac1689772f9e0657f2e7877cee07935d7f7236b45965f4be54b68615fa0b1eff359fbfb3d489cb85f80f1d8
-
SSDEEP
3072:afVLWlTTbEGe9AJKlCvIU4qoW1nI5bdLFVgw:cVqdT3GcQ4T7EHVP
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-