General

  • Target

    NEAS.341dedc9f376bf051dc164b9def2e350.exe

  • Size

    218KB

  • Sample

    231118-gzedvscb99

  • MD5

    341dedc9f376bf051dc164b9def2e350

  • SHA1

    a56b51a1bceea109d516e3b7a2c8127e8fa2efff

  • SHA256

    18e708cb84cabf4dec525ea16569fd45f6d7787fe905123752473cffa7c5ce0c

  • SHA512

    542c45d4e9d37d65b5ba70a6c685fe5fcd1a23da9863e026b70c689a21d0ac514819c5248efd42f66e0ad7ec4743ae08ee41e7742fb09b9731a6c38afe1e32f3

  • SSDEEP

    1536:AvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjZSrowPYJZBd8Laz:AvVQLIkLWeaA8KlCph9YrowPYJZALk

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      NEAS.341dedc9f376bf051dc164b9def2e350.exe

    • Size

      218KB

    • MD5

      341dedc9f376bf051dc164b9def2e350

    • SHA1

      a56b51a1bceea109d516e3b7a2c8127e8fa2efff

    • SHA256

      18e708cb84cabf4dec525ea16569fd45f6d7787fe905123752473cffa7c5ce0c

    • SHA512

      542c45d4e9d37d65b5ba70a6c685fe5fcd1a23da9863e026b70c689a21d0ac514819c5248efd42f66e0ad7ec4743ae08ee41e7742fb09b9731a6c38afe1e32f3

    • SSDEEP

      1536:AvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjZSrowPYJZBd8Laz:AvVQLIkLWeaA8KlCph9YrowPYJZALk

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks