General
-
Target
NEAS.341dedc9f376bf051dc164b9def2e350.exe
-
Size
218KB
-
Sample
231118-gzedvscb99
-
MD5
341dedc9f376bf051dc164b9def2e350
-
SHA1
a56b51a1bceea109d516e3b7a2c8127e8fa2efff
-
SHA256
18e708cb84cabf4dec525ea16569fd45f6d7787fe905123752473cffa7c5ce0c
-
SHA512
542c45d4e9d37d65b5ba70a6c685fe5fcd1a23da9863e026b70c689a21d0ac514819c5248efd42f66e0ad7ec4743ae08ee41e7742fb09b9731a6c38afe1e32f3
-
SSDEEP
1536:AvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjZSrowPYJZBd8Laz:AvVQLIkLWeaA8KlCph9YrowPYJZALk
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.341dedc9f376bf051dc164b9def2e350.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.341dedc9f376bf051dc164b9def2e350.exe
Resource
win10v2004-20231020-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Targets
-
-
Target
NEAS.341dedc9f376bf051dc164b9def2e350.exe
-
Size
218KB
-
MD5
341dedc9f376bf051dc164b9def2e350
-
SHA1
a56b51a1bceea109d516e3b7a2c8127e8fa2efff
-
SHA256
18e708cb84cabf4dec525ea16569fd45f6d7787fe905123752473cffa7c5ce0c
-
SHA512
542c45d4e9d37d65b5ba70a6c685fe5fcd1a23da9863e026b70c689a21d0ac514819c5248efd42f66e0ad7ec4743ae08ee41e7742fb09b9731a6c38afe1e32f3
-
SSDEEP
1536:AvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjZSrowPYJZBd8Laz:AvVQLIkLWeaA8KlCph9YrowPYJZALk
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-