General
-
Target
TR4SH.exe
-
Size
21.8MB
-
Sample
240607-g52rcaag9t
-
MD5
1ecea7c2cadbab8e2d578df23eaa5ce7
-
SHA1
100a31e4b2df453709719cfd606b5ded63c648aa
-
SHA256
460bfc0c7f4f54283bc0a80db04c664a9c382dcf53d6a5876b0add1b0163d403
-
SHA512
d71a7f759d27c1620ff80abb94f6c9b556b23c02ee51eddbead221b0308f148f96adaa1f6c1bdcdcfb9231dbfd51810ea97d6496e1e15744614e095ac790e90c
-
SSDEEP
393216:ezQtsfh5+Kmr2pu0tTkQETS5vJQn+5PjDCA75umzTdrgDaMwUI6dA:ezQtsfX+Kmr2puIYQEW5hQ+d3fnJrewD
Behavioral task
behavioral1
Sample
TR4SH.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TR4SH.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
TR4SH.pyc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
TR4SH.pyc
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
TR4SH.exe
-
Size
21.8MB
-
MD5
1ecea7c2cadbab8e2d578df23eaa5ce7
-
SHA1
100a31e4b2df453709719cfd606b5ded63c648aa
-
SHA256
460bfc0c7f4f54283bc0a80db04c664a9c382dcf53d6a5876b0add1b0163d403
-
SHA512
d71a7f759d27c1620ff80abb94f6c9b556b23c02ee51eddbead221b0308f148f96adaa1f6c1bdcdcfb9231dbfd51810ea97d6496e1e15744614e095ac790e90c
-
SSDEEP
393216:ezQtsfh5+Kmr2pu0tTkQETS5vJQn+5PjDCA75umzTdrgDaMwUI6dA:ezQtsfX+Kmr2puIYQEW5hQ+d3fnJrewD
-
Drops startup file
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
-
-
Target
TR4SH.pyc
-
Size
48KB
-
MD5
7668979f3a8e3bfb1f6606af4ab81628
-
SHA1
eb5637b1be97af8da3f323008be971eeb2bab6e7
-
SHA256
4eb471cb563f610e15443009a2cf93f0dde6e151ab0e05acfab67563e40cadbc
-
SHA512
78be9b5759530ca7d6e6dd484b6fdda4751126e6eefbc6d5f879a7b9a5d745200fc21799bc7021e170f53db91fd8c0ad4b2f9a5c47b4ee0f330f77d3ef4b03bc
-
SSDEEP
768:pxu+/nZtgH7+96XVYVxc8X+9xkIsmzw2QqCBpJS68CZxmtreQM3lU0XnW6z:fW+yVicjjTw2QqCjJJatK93BXnWW
Score3/10 -