General

  • Target

    52c8d6354e2b56aa7c44e7d8c56d9be0_NeikiAnalytics

  • Size

    368KB

  • Sample

    240512-a86q5sgg2w

  • MD5

    52c8d6354e2b56aa7c44e7d8c56d9be0

  • SHA1

    be20a0e0fc2e468ef4b448fddc6b00b3e5ea6580

  • SHA256

    2e58876bce227b172c8527deebec550bfe79b80221a0a0dfe86e537a353a38f1

  • SHA512

    a68d5620e469d1ac5ef0eae29287a9dd7e9a495ee909b70918fcdaac4a038f1bfefd30d32ac64a703e71474a73f117baa225c69ecb677817951aec82786c42f2

  • SSDEEP

    3072:0xEEo75OnPSI09qgmBBAGKSvwlQ7iN24s:0xdi5Onz2qgmB9Dws

Score
10/10
upx

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      52c8d6354e2b56aa7c44e7d8c56d9be0_NeikiAnalytics

    • Size

      368KB

    • MD5

      52c8d6354e2b56aa7c44e7d8c56d9be0

    • SHA1

      be20a0e0fc2e468ef4b448fddc6b00b3e5ea6580

    • SHA256

      2e58876bce227b172c8527deebec550bfe79b80221a0a0dfe86e537a353a38f1

    • SHA512

      a68d5620e469d1ac5ef0eae29287a9dd7e9a495ee909b70918fcdaac4a038f1bfefd30d32ac64a703e71474a73f117baa225c69ecb677817951aec82786c42f2

    • SSDEEP

      3072:0xEEo75OnPSI09qgmBBAGKSvwlQ7iN24s:0xdi5Onz2qgmB9Dws

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks