Overview

overview

10

Static

static

3

69ec907c79...cs.exe

windows7-x64

10

69ec907c79...cs.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    69ec907c799b98d387966d82424b6d90_NeikiAnalytics.exe

  • Size

    46KB

  • Sample

    240607-tdhwdaag2s

  • MD5

    69ec907c799b98d387966d82424b6d90

  • SHA1

    48ccf3868a2870977d9057dd71507c84caa9f568

  • SHA256

    59ad80ddf98028a9af673a6f3acc95b40061b4140550ddb9b6f5e8524373e609

  • SHA512

    e39f3875d468cfb7cc3aedad6da21fae595543d8f3eb982e890b8ce7e2ef380afa554f01c09fda15a472efa7750cc65eb8883ab2a06f85956c1ba3529b8091c6

  • SSDEEP

    768:zIP5WOMVs4PSV06ymNNC6S7Cm1n2OBGRIWNSE77NPQ1TTGfGYz6KO:zI0OGrOy6NvSpMZVQ1JHKO

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    griptoloji
  • Password:
    741852

Targets

    • Target

      69ec907c799b98d387966d82424b6d90_NeikiAnalytics.exe

    • Size

      46KB

    • MD5

      69ec907c799b98d387966d82424b6d90

    • SHA1

      48ccf3868a2870977d9057dd71507c84caa9f568

    • SHA256

      59ad80ddf98028a9af673a6f3acc95b40061b4140550ddb9b6f5e8524373e609

    • SHA512

      e39f3875d468cfb7cc3aedad6da21fae595543d8f3eb982e890b8ce7e2ef380afa554f01c09fda15a472efa7750cc65eb8883ab2a06f85956c1ba3529b8091c6

    • SSDEEP

      768:zIP5WOMVs4PSV06ymNNC6S7Cm1n2OBGRIWNSE77NPQ1TTGfGYz6KO:zI0OGrOy6NvSpMZVQ1JHKO

    Score
    10/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks