250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e | Triage

Sharing

General

Target

250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e
Size

509KB
Sample

240801-1b37vswhml
MD5

290e3ac020e970af16f6b9027f7dbdc2
SHA1

10616db84154170aac3ba5069e26eb4f54683dcf
SHA256

250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e
SHA512

6e4a56add0ad2cb9de507c4e033e6ea6a2cf2d2e7d7b287582dd2bcf32b13321298731562a01a12725bdcc14c483b05d2d643e340860e5956c6c41773e5fead9
SSDEEP

3072:jePgCctxGv4QcU9KQ2BBA2waPxstmolzRH+f4VSaPYF8haGjTVtR6:3CctxGsWKQ2Bx5xU3RH+f40i4sPm

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Targets

- Target
  
  250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e
- Size
  
  509KB
- MD5
  
  290e3ac020e970af16f6b9027f7dbdc2
- SHA1
  
  10616db84154170aac3ba5069e26eb4f54683dcf
- SHA256
  
  250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e
- SHA512
  
  6e4a56add0ad2cb9de507c4e033e6ea6a2cf2d2e7d7b287582dd2bcf32b13321298731562a01a12725bdcc14c483b05d2d643e340860e5956c6c41773e5fead9
- SSDEEP
  
  3072:jePgCctxGv4QcU9KQ2BBA2waPxstmolzRH+f4VSaPYF8haGjTVtR6:3CctxGsWKQ2Bx5xU3RH+f40i4sPm
Score

10^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2