General

  • Target

    TurboVPN_setup.exe

  • Size

    25.2MB

  • MD5

    1c3cbc60f4893b76ea941647026015e5

  • SHA1

    9533bb4005d1b1e387e93c6fedd6df5eb2cba17c

  • SHA256

    77ea0713009782e09bebd0750c56a5be774c67a5e43b5d1a3f1741a5e2a0a734

  • SHA512

    aa8cffda95de6b62779dd4f8774c9bd2dfe8aa8bc17d27ca71fd02130e4d7659c6ac6149bd25801dfc8610e17f0cbac41f5ceb9c9bc4366ff3d29a02d18e91b1

  • SSDEEP

    393216:m3nw8WReNsdyFhIPP6CEYeVvVB+0dXtdq0A57U6w6HdGSr5TTrGgvrLPz2aDPskL:m3h+eNm3CV7+G/yUcGS1VvaeUkGT9U

Score
3/10

Malware Config

Signatures

  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

Files

  • TurboVPN_setup.exe
    .exe windows:4 windows x86 arch:x86

    7eae418c7423834ffc3d79b4300bd6fb


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/FindProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    e26d7460d0c04056b9226a899477ba4d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    4b45b7e00344a87332fbd12653854d1a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/myinternet.dll
    .dll windows:6 windows x86 arch:x86

    3212fdee6404f24f8cda4370b9d5d08b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    488b9c61d28b8855f328d854ae7601be


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    439074d1c01f7b16781bdf060930814a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $WINDIR/SysWOW64/remote_config_data
  • $WINDIR/System32/remote_config_data
  • Driver32/driver_win10_x64/OemVista.inf
  • Driver32/driver_win10_x64/tap0901.cat
  • Driver32/driver_win10_x64/tap0901.sys
    .sys windows:10 windows x64 arch:x64

    6951888e15c9a7d15f304320298d1328


    Code Sign

    Headers

    Imports

    Sections

  • Driver32/driver_win10_x86/OemVista.inf
  • Driver32/driver_win10_x86/tap0901.cat
  • Driver32/driver_win10_x86/tap0901.sys
    .sys windows:10 windows x86 arch:x86

    2c09622014813b5b7c47e98874279da6


    Code Sign

    Headers

    Imports

    Sections

  • Driver32/driver_win7_x64/OemVista.inf
  • Driver32/driver_win7_x64/tap0901.cat
  • Driver32/driver_win7_x64/tap0901.sys
    .sys windows:6 windows x64 arch:x64

    a13cebc938af36dab20cc614c6fb7e94


    Headers

    Imports

    Sections

  • Driver32/driver_win7_x86/OemVista.inf
  • Driver32/driver_win7_x86/tap0901.cat
  • Driver32/driver_win7_x86/tap0901.sys
    .sys windows:6 windows x86 arch:x86

    e8e98f9c6dd2ed86b62e0eee9ae50433


    Headers

    Imports

    Sections

  • Driver32/libeay32.dll
    .dll windows:6 windows x86 arch:x86

    e1827570319fa0b8eb784893f5f9f90f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Driver32/libpkcs11-helper-1.dll
    .dll windows:6 windows x86 arch:x86

    9e4a3855e4da3186c1ab3538dee952e1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Driver32/lzo2.dll
    .dll windows:6 windows x86 arch:x86

    c49dba8aebaba9a941177cc7178d3d32


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Driver32/ssleay32.dll
    .dll windows:6 windows x86 arch:x86

    7351ce03e873deceb1ce6cbef407a8d3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Driver32/vpncore.exe
    .exe windows:6 windows x86 arch:x86

    07f8ab4a7d02ceb3a0b8444cc31468ed


    Code Sign

    Headers

    Imports

    Sections

  • NewClientDL/Clientdl.exe
    .exe windows:6 windows x86 arch:x86

    2e9b1fa3079dd447471be2ae7f8f5610


    Code Sign

    Headers

    Imports

    Sections

  • Retention.exe
    .exe windows:6 windows x86 arch:x86

    3b30fad6db42e97231385f1a0783c7a2


    Code Sign

    Headers

    Imports

    Sections

  • TurboVPN.exe
    .exe windows:6 windows x86 arch:x86

    7e4cebadc7d923b90fa75bdbb4107145


    Code Sign

    Headers

    Imports

    Sections

  • TurboVPNLauncher.exe
    .exe windows:6 windows x86 arch:x86

    2c5e6b1d38ec7c6401e1b912502f6e52


    Code Sign

    Headers

    Imports

    Sections

  • WebView2Loader.dll
    .dll windows:5 windows x86 arch:x86

    608537c42a46a95b31cc1ef01ab6eeb0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WinSparkle.dll
    .dll windows:5 windows x86 arch:x86

    ed7ae9546bde6e53f962a6ae8ae4845d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • breakpad.dll
    .dll windows:6 windows x86 arch:x86

    de1a1664509a2e8ffd40c899c756f245


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • core/tun2socks.exe
    .exe windows:4 windows x86 arch:x86

    a41f14dddbaa9ffbfbc83cb5eedd765e


    Code Sign

    Headers

    Imports

    Sections

  • core/xray.exe
    .exe windows:6 windows x86 arch:x86

    ff9f3a86709796c17211f9df12aae74d


    Code Sign

    Headers

    Imports

    Sections

  • data/de989cd46b71b6bf
  • data/lang.lang
  • data/plan.dat
  • data/sdata.dat
  • data/turbo.cfg
  • dbghelp.dll
    .dll windows:6 windows x86 arch:x86

    3f5a00ef2a36f3cd8924690a5a1d6f3c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • installtapx64.exe
    .exe windows:6 windows x64 arch:x64

    52ab5cbae7bd503c9ab801501cc86096


    Code Sign

    Headers

    Imports

    Sections

  • installtapx86.exe
    .exe windows:6 windows x86 arch:x86

    75026c13b2f9c8dac270bef5dce0a48c


    Code Sign

    Headers

    Imports

    Sections

  • myinternet.dll
    .dll windows:6 windows x86 arch:x86

    b473975b6662b14bca09add270e9b0a9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • payment.dll
    .dll windows:6 windows x86 arch:x86

    ff471ce7d0a4597840119df99fbe088f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • remote_config_data
  • rlottie.dll
    .dll windows:6 windows x86 arch:x86

    7de8e1febf7d62e1f647165ba7a75170


    Headers

    Imports

    Exports

    Sections

  • ssr/libPrivoxy.dll
    .dll windows:6 windows x86 arch:x86

    af8cc58df27660fa9f2fcc50939bd361


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ssr/libsodium.dll
    .dll windows:6 windows x86 arch:x86

    873d3dafff360ff494085a76e30883df


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ssr/ssr.exe
    .exe windows:6 windows x86 arch:x86

    80e2dfdbbeda737d30e3b1a01d4e47ff


    Headers

    Imports

    Exports

    Sections

  • turbo_vpn-service.exe
    .exe windows:6 windows x86 arch:x86

    2601cf1620d96e76361e45752be3b844


    Code Sign

    Headers

    Imports

    Sections

  • turboconfig.exe
    .exe windows:6 windows x86 arch:x86

    64e24458ea9d5349ee7d875655d31aa1


    Code Sign

    Headers

    Imports

    Sections

  • uninst.exe.nsis
  • wfpcallout/x64/win10/PiaWFPCallout.inf
  • wfpcallout/x64/win10/PiaWfpCallout.sys
    .sys windows:10 windows x64 arch:x64

    62cb5785a6043d503449eb53cbf45319


    Headers

    Imports

    Sections

  • wfpcallout/x64/win10/piawfpcallout.cat
  • wfpcallout/x64/win7/PiaWFPCallout.inf
  • wfpcallout/x64/win7/PiaWfpCallout.sys
    .sys windows:10 windows x64 arch:x64

    62cb5785a6043d503449eb53cbf45319


    Code Sign

    Headers

    Imports

    Sections

  • wfpcallout/x64/win7/piawfpcallout.cat
  • wfpcallout/x86/win10/PiaWFPCallout.inf
  • wfpcallout/x86/win10/PiaWfpCallout.sys
    .sys windows:10 windows x86 arch:x86

    62cb5785a6043d503449eb53cbf45319


    Headers

    Imports

    Sections

  • wfpcallout/x86/win10/piawfpcallout.cat
  • wfpcallout/x86/win7/PiaWFPCallout.inf
  • wfpcallout/x86/win7/PiaWfpCallout.sys
    .sys windows:10 windows x86 arch:x86

    62cb5785a6043d503449eb53cbf45319


    Code Sign

    Headers

    Imports

    Sections

  • wfpcallout/x86/win7/piawfpcallout.cat
  • xpntroj/libcrypto-1_1.dll
    .dll windows:5 windows x86 arch:x86

    1a4728323839926a0cea4a4ffbbfc558


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xpntroj/libssl-1_1.dll
    .dll windows:5 windows x86 arch:x86

    b80464344ed56357f2bdb2a72269a0f0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xpntroj/vcruntime140.dll
    .dll windows:6 windows x86 arch:x86

    6a84b7445ccacd5d29ac27de2745f356


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xpntroj/xpntroj.exe
    .exe windows:6 windows x86 arch:x86

    64bda4e636449fa6d894191d6fed166f


    Code Sign

    Headers

    Imports

    Sections