General

  • Target

    3b4877332d9c3227c9abb97c99e6f370_NeikiAnalytics

  • Size

    60KB

  • Sample

    240512-wqwzwace47

  • MD5

    3b4877332d9c3227c9abb97c99e6f370

  • SHA1

    e7395810ed78f922f4913df0c82fdd8d77a7df98

  • SHA256

    3ff605b14279ada137006757003946b493ca00c81b33fe3e12babb52d460520c

  • SHA512

    0f071852843192cfc1740bf70aac52efc96c33b03494a0cf989fa148802530d12d0c8ebe0b5402fc70dcaa1c658400c4fdcdde70d1ab98d8ff898262e0590d13

  • SSDEEP

    768:9qSqC8+N5ozQQqncwxWmNXMX3cX8wtgtzpAXpX8/X/7CUrfbtS6o:9rqfzQQqamN8835mv7CUro1

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      3b4877332d9c3227c9abb97c99e6f370_NeikiAnalytics

    • Size

      60KB

    • MD5

      3b4877332d9c3227c9abb97c99e6f370

    • SHA1

      e7395810ed78f922f4913df0c82fdd8d77a7df98

    • SHA256

      3ff605b14279ada137006757003946b493ca00c81b33fe3e12babb52d460520c

    • SHA512

      0f071852843192cfc1740bf70aac52efc96c33b03494a0cf989fa148802530d12d0c8ebe0b5402fc70dcaa1c658400c4fdcdde70d1ab98d8ff898262e0590d13

    • SSDEEP

      768:9qSqC8+N5ozQQqncwxWmNXMX3cX8wtgtzpAXpX8/X/7CUrfbtS6o:9rqfzQQqamN8835mv7CUro1

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks