Extracted

Extracted

• • Target

    TangoGen/TangoGenV1.3.EXE

  • Size

    52.0MB

  • MD5

    e9150812ffb2317a7ff1a2491a392ade

  • SHA1

    6b929ee7d7555604ec71d2463b6c1602aaf38b75

  • SHA256

    0e01eb02101b4aa05e0484ac9caebb77a7ecda7a36263aac8a32225fa2a8d38a

  • SHA512

    7a7a5c6c29848e5a2f1c12753c6bf9900937b99fd5e07cfb6fc6793216361bc7962fbd0a2b29448bae1c028ab93c11640f176cf5d3897a64973dd954ff417914

  • SSDEEP

    1572864:CxLPRJ/aHOlj/wZuj/hzJHW2ldP2dUOpfa4X62AC:CH2Mhzn+dUSh

  Score

  10^/10

  quasarxenoratoffice04persistencepyinstallerratspywarestealertrojanupx

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1

• • Target

    TangoGen/assets.dll

  • Size

    5.1MB

  • MD5

    773b3b72481fd8ef9b62b5ef0fe8040a

  • SHA1

    a42cbc7aab88689e834c158b24af8722586cf1b4

  • SHA256

    7f93fef11819a9f4b8edd342a1c2d3dbab25698ed75f9713ee1167fa2f852331

  • SHA512

    db7d29100060afc909cbf20bcd6d9c02fc0b29d8ee32606e2d6cf18270484f2b46853cda0b495a85cc7a2e3ae4536030a25216f101dceabf2f972e3375208c38

  • SSDEEP

    768:+UI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUIn:3

  Score

  1^/10
  behavioral2behavioral3