General

  • Target

    866e1a62a136ae541f416c9a8da33a20_NEIKI

  • Size

    36KB

  • Sample

    240508-bdbsyscf72

  • MD5

    866e1a62a136ae541f416c9a8da33a20

  • SHA1

    e3e586159fac5a9ca7573ae7f8ab1a3743c7bc07

  • SHA256

    bd1e5a063049a0219e8a423294c14b12750ddaa3891186d4f3537069a98b81fa

  • SHA512

    f47786bc966b96f2fbe98fdc7ced87d9af25e630b2eaf6d2b96ee56a0de422c0add4a4b86a648fd672471075b4572528591d65b473595cf25505886d89ad7c33

  • SSDEEP

    768:9qSqC8+N5ozQQRncwxWmNXMX3cX8wtgg/X/zCtgcgCEX8u/vSXrXrXrXrXrXyupn:9rqfzQQRamN88Fr277777RNP

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      866e1a62a136ae541f416c9a8da33a20_NEIKI

    • Size

      36KB

    • MD5

      866e1a62a136ae541f416c9a8da33a20

    • SHA1

      e3e586159fac5a9ca7573ae7f8ab1a3743c7bc07

    • SHA256

      bd1e5a063049a0219e8a423294c14b12750ddaa3891186d4f3537069a98b81fa

    • SHA512

      f47786bc966b96f2fbe98fdc7ced87d9af25e630b2eaf6d2b96ee56a0de422c0add4a4b86a648fd672471075b4572528591d65b473595cf25505886d89ad7c33

    • SSDEEP

      768:9qSqC8+N5ozQQRncwxWmNXMX3cX8wtgg/X/zCtgcgCEX8u/vSXrXrXrXrXrXyupn:9rqfzQQRamN88Fr277777RNP

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks