General
-
Target
TR4SH.exe
-
Size
21.2MB
-
Sample
240301-rdl7pagg89
-
MD5
c069d10ecdfd8a24d4718cc882a6ea3c
-
SHA1
11fed76430d553b1a91146b17922fd11b32c815f
-
SHA256
f7a943ecd80633da1e52538b56dadb6e8ab6cbf7a7cd5005b58ce1a844cb02fb
-
SHA512
6097a62ff864866d2050071cde2566540a78394ef1dae92197250f708cdb21d41e0a6f6203508401b9503d2a0e6911dfc721ec881e910d5fb64e730b728f1b0a
-
SSDEEP
393216:rzQtsfh5mKmr2pu0tTkQETS8vJQn+9PWkA75umhTdbgDqxMwsQkd:rzQtsfXmKmr2puIYQEW8hQ+ZWl9Jb0wS
Behavioral task
behavioral1
Sample
TR4SH.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TR4SH.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
TR4SH.pyc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
TR4SH.pyc
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
TR4SH.exe
-
Size
21.2MB
-
MD5
c069d10ecdfd8a24d4718cc882a6ea3c
-
SHA1
11fed76430d553b1a91146b17922fd11b32c815f
-
SHA256
f7a943ecd80633da1e52538b56dadb6e8ab6cbf7a7cd5005b58ce1a844cb02fb
-
SHA512
6097a62ff864866d2050071cde2566540a78394ef1dae92197250f708cdb21d41e0a6f6203508401b9503d2a0e6911dfc721ec881e910d5fb64e730b728f1b0a
-
SSDEEP
393216:rzQtsfh5mKmr2pu0tTkQETS8vJQn+9PWkA75umhTdbgDqxMwsQkd:rzQtsfXmKmr2puIYQEW8hQ+ZWl9Jb0wS
-
Drops startup file
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
-
-
Target
TR4SH.pyc
-
Size
48KB
-
MD5
49c8bb4ec04b30871407200bee9a066f
-
SHA1
0952360f858a4444699588877cec8b6787c53554
-
SHA256
2d124e3dbc66a11d8553c65fc0aea733a5db6088aa5cd8c34a79c092b4e75343
-
SHA512
55f425f0ffa3262800b965443419155ed66bc29014105f1a74762f2887f036ca2a40836d2e6aaf337fbfd57f7e882f8471ca171d66ba15cf20896d7d503d81e8
-
SSDEEP
768:pAu+/nZtgH7+96XVYVxc8X+9xkIsmzw2QqCBpJS68CZxmtreQM3lU0XnW6z:SW+yVicjjTw2QqCjJJatK93BXnWW
Score3/10 -