Overview

overview

10

Static

static

10

d6ac21a409...40.dll

windows7-x64

1

d6ac21a409...40.dll

windows10-2004-x64

1

Resubmissions

26/07/2024, 16:00

240726-tf1tza1gpe 10

26/07/2024, 15:58

240726-tepqbaxgqq 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    turla.zip

  • Size

    145KB

  • MD5

    ee34760609a2ec6e0505bc8f6accc540

  • SHA1

    d0323c62262f0621743747380445e26255235bda

  • SHA256

    5644144b2895fe44b5cd6e64dfdbd7989c39650208954b2108c9584b3d960e11

  • SHA512

    9d9cfa399e50472931d93f6a2c66dd0eeef9f1df0fbdc713ffc60b67ed22b9a4af8bc2c17667a75639be76dd952770091119a95dd789b84ed083b8bd4c049fb3

  • SSDEEP

    3072:tZ0Ds/3IR2nSJvkSd5QrwWAwswxT2Lz8Zhty18n1KrDUEKIv:Eac2SxkS5TWATMC4Zhty184X

Score
10/10
tinyturlang

Malware Config

Extracted

Family

tinyturlang

C2

https://jeepcarlease.com/wp-includes/blocks/rss.old.php

https://caduff-sa.ch/wordpress/wp-includes/rss.old.php

Signatures

  • Tinyturlang family
    tinyturlang
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • turla.zip
    .zip

    Password: infected

  • d6ac21a409f35a80ba9ccfe58ae1ae32883e44ecc724e4ae8289e7465ab2cf40.exe
    .dll windows:6 windows x64 arch:x64

    Password: infected

    2240ae6f0dcbc0537836dfd9205a1f2b


    Headers

    Imports

    Exports

    Sections