General
-
Target
866e1a62a136ae541f416c9a8da33a20_NEIKI
-
Size
36KB
-
Sample
240508-bdbsyscf72
-
MD5
866e1a62a136ae541f416c9a8da33a20
-
SHA1
e3e586159fac5a9ca7573ae7f8ab1a3743c7bc07
-
SHA256
bd1e5a063049a0219e8a423294c14b12750ddaa3891186d4f3537069a98b81fa
-
SHA512
f47786bc966b96f2fbe98fdc7ced87d9af25e630b2eaf6d2b96ee56a0de422c0add4a4b86a648fd672471075b4572528591d65b473595cf25505886d89ad7c33
-
SSDEEP
768:9qSqC8+N5ozQQRncwxWmNXMX3cX8wtgg/X/zCtgcgCEX8u/vSXrXrXrXrXrXyupn:9rqfzQQRamN88Fr277777RNP
Static task
static1
Behavioral task
behavioral1
Sample
866e1a62a136ae541f416c9a8da33a20_NEIKI.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
866e1a62a136ae541f416c9a8da33a20_NEIKI.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Targets
-
-
Target
866e1a62a136ae541f416c9a8da33a20_NEIKI
-
Size
36KB
-
MD5
866e1a62a136ae541f416c9a8da33a20
-
SHA1
e3e586159fac5a9ca7573ae7f8ab1a3743c7bc07
-
SHA256
bd1e5a063049a0219e8a423294c14b12750ddaa3891186d4f3537069a98b81fa
-
SHA512
f47786bc966b96f2fbe98fdc7ced87d9af25e630b2eaf6d2b96ee56a0de422c0add4a4b86a648fd672471075b4572528591d65b473595cf25505886d89ad7c33
-
SSDEEP
768:9qSqC8+N5ozQQRncwxWmNXMX3cX8wtgg/X/zCtgcgCEX8u/vSXrXrXrXrXrXyupn:9rqfzQQRamN88Fr277777RNP
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-