General

  • Target

    1.rsp.dat

  • Size

    285KB

  • MD5

    0f2e9f501ca9780eff309b7022c9b01a

  • SHA1

    e7fc80825c5b1f5d29836dde45e9314357d102a0

  • SHA256

    d6ac21a409f35a80ba9ccfe58ae1ae32883e44ecc724e4ae8289e7465ab2cf40

  • SHA512

    a508f303565f3cbe196c415b5b855594bd0ca0a4a0f3957952b012cde2176328063ee658bfeaa6df8163830fda565660dec3aeacfcce54d62ee0b764bea575d0

  • SSDEEP

    3072:oMAWtPNzl5A2H0x4gVpHoam0P1RIm+qdWpwuZ/Q/loWA6cy0wUYHobphfoY46pKn:oMAz2UxPoaTRzRdWpwuZ/Q/90boh/p/

Score
10/10

Malware Config

Extracted

Family

tinyturlang

C2

https://jeepcarlease.com/wp-includes/blocks/rss.old.php

https://caduff-sa.ch/wordpress/wp-includes/rss.old.php

Signatures

  • Tinyturlang family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1.rsp.dat
    .dll windows:6 windows x64 arch:x64

    2240ae6f0dcbc0537836dfd9205a1f2b


    Headers

    Imports

    Exports

    Sections