General
-
Target
TangoGen.rar
-
Size
43.6MB
-
Sample
240420-mflaysec84
-
MD5
58499bbb694ff3a09362d57e35c660c7
-
SHA1
8fb1d6c6ff24b9710e78fddce0a3ed20201ccf96
-
SHA256
eb6f8f2a7f814d765640c5e6422921576383c85183677c8c1328f846bda5906e
-
SHA512
bb60444d0c0e91759bc6737a79d1cdb1e678b853fefc0e254a30d3455dcbd4c929847272e2a8f8ef779b6991f1aed44691a10a772c9920dca2a2298fb9a22b89
-
SSDEEP
786432:vBD907AA6x8fc79JOuWYdlWp7vzi9DzsOfRuCgIyM25jtJwiS7Sh7IbaHuFJ9W:ZD906GW9JOufd99DwSRu/z1avJ9W
Static task
static1
Behavioral task
behavioral1
Sample
TangoGen.rar
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
TangoGen/TangoGenV1.3.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
TangoGen/assets.js
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
TangoGen/instructions.txt
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
TangoGen/license.txt
Resource
win10v2004-20240412-en
Malware Config
Extracted
quasar
1.4.1
Office04
6.tcp.ngrok.io:16799
0c20af10-1b0a-4d0e-bbca-3718ee39e827
-
encryption_key
284202D1B7ED732612BB54048953C4453A2549F9
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
System32
-
subdirectory
SubDir
Targets
-
-
Target
TangoGen.rar
-
Size
43.6MB
-
MD5
58499bbb694ff3a09362d57e35c660c7
-
SHA1
8fb1d6c6ff24b9710e78fddce0a3ed20201ccf96
-
SHA256
eb6f8f2a7f814d765640c5e6422921576383c85183677c8c1328f846bda5906e
-
SHA512
bb60444d0c0e91759bc6737a79d1cdb1e678b853fefc0e254a30d3455dcbd4c929847272e2a8f8ef779b6991f1aed44691a10a772c9920dca2a2298fb9a22b89
-
SSDEEP
786432:vBD907AA6x8fc79JOuWYdlWp7vzi9DzsOfRuCgIyM25jtJwiS7Sh7IbaHuFJ9W:ZD906GW9JOufd99DwSRu/z1avJ9W
Score3/10 -
-
-
Target
TangoGen/TangoGenV1.3.EXE
-
Size
52.0MB
-
MD5
e9150812ffb2317a7ff1a2491a392ade
-
SHA1
6b929ee7d7555604ec71d2463b6c1602aaf38b75
-
SHA256
0e01eb02101b4aa05e0484ac9caebb77a7ecda7a36263aac8a32225fa2a8d38a
-
SHA512
7a7a5c6c29848e5a2f1c12753c6bf9900937b99fd5e07cfb6fc6793216361bc7962fbd0a2b29448bae1c028ab93c11640f176cf5d3897a64973dd954ff417914
-
SSDEEP
1572864:CxLPRJ/aHOlj/wZuj/hzJHW2ldP2dUOpfa4X62AC:CH2Mhzn+dUSh
-
Quasar payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
-
-
Target
TangoGen/assets.dll
-
Size
5.1MB
-
MD5
773b3b72481fd8ef9b62b5ef0fe8040a
-
SHA1
a42cbc7aab88689e834c158b24af8722586cf1b4
-
SHA256
7f93fef11819a9f4b8edd342a1c2d3dbab25698ed75f9713ee1167fa2f852331
-
SHA512
db7d29100060afc909cbf20bcd6d9c02fc0b29d8ee32606e2d6cf18270484f2b46853cda0b495a85cc7a2e3ae4536030a25216f101dceabf2f972e3375208c38
-
SSDEEP
768:+UI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUIn:3
Score1/10 -
-
-
Target
TangoGen/instructions.txt
-
Size
283B
-
MD5
d1f4e26ecd7fbecbdc4f78f84ed4fb3e
-
SHA1
ed45ea4e43b929e3fabaed771d678e4ede784e34
-
SHA256
24c17fd24aaf02a5f7ac3f6c94c26aac66b5666fc017339d62d82816c41010ec
-
SHA512
c179bd6dc3525ef97a0db494e6796dcb0f4bf00590b3010f90d02051bf9f18a96e80b52890ad2aedfd9d3f9cc4dc9a129caff2d03f25c5166fd660e1124a34a8
Score1/10 -
-
-
Target
TangoGen/license.txt
-
Size
6KB
-
MD5
0b09566254b011d989decf0e23a902eb
-
SHA1
3ae5cd6be73daf418b8deee9c865cf78225838c9
-
SHA256
a19d58aaab15c4d0019e569d1c073d1b5286fdd37dbeee7a58a7d1ae76045ae1
-
SHA512
4e22e58f925879306261e5993039e1d84d87f8fecc0f9fdad534da55b6fd22be77e622a4077d8d521f7734e5535f66853d581155987e2f3607e2d386938c218b
-
SSDEEP
192:uEwjuKsgA4+XYdXjA+okS63vZBCSUziJm:eNs8+QRVxBRU1
Score1/10 -