Overview

overview

10

Static

static

3

0483909a7b...cs.exe

windows7-x64

10

0483909a7b...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0483909a7ba88c9bb131c1210df13640_NeikiAnalytics.exe

  • Size

    45KB

  • Sample

    240521-xzfvpafe48

  • MD5

    0483909a7ba88c9bb131c1210df13640

  • SHA1

    b77a68a17037e86390ecd095f76cb36ae352de8a

  • SHA256

    9e6c99fcdb431ee0f0b7899d0848fdec15687f21ab96ccd43af40271a02e67c1

  • SHA512

    1fc371b5ac850f3b0645b621ebe0fa7f4472fb666dee05011d1d17be161b0c7adec226ed119999b957d0ceaa2170636c6ecb9d1ace7a672d8c1840c3fc1a2a88

  • SSDEEP

    768:zIP5WOMVs4PSV06ymNNC6S7Cm1n2OBGRIWNSE77NPQ1TTGfGYy6Kw:zI0OGrOy6NvSpMZVQ1J4Kw

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    griptoloji
  • Password:
    741852

Targets

    • Target

      0483909a7ba88c9bb131c1210df13640_NeikiAnalytics.exe

    • Size

      45KB

    • MD5

      0483909a7ba88c9bb131c1210df13640

    • SHA1

      b77a68a17037e86390ecd095f76cb36ae352de8a

    • SHA256

      9e6c99fcdb431ee0f0b7899d0848fdec15687f21ab96ccd43af40271a02e67c1

    • SHA512

      1fc371b5ac850f3b0645b621ebe0fa7f4472fb666dee05011d1d17be161b0c7adec226ed119999b957d0ceaa2170636c6ecb9d1ace7a672d8c1840c3fc1a2a88

    • SSDEEP

      768:zIP5WOMVs4PSV06ymNNC6S7Cm1n2OBGRIWNSE77NPQ1TTGfGYy6Kw:zI0OGrOy6NvSpMZVQ1J4Kw

    Score
    10/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks