General

  • Target

    TAXUS.rar

  • Size

    2.9MB

  • MD5

    613f6cd82ccda6e0282d3932f4e7aa99

  • SHA1

    c3a006ca1106f49a069e1b4b2489c446b6a87c87

  • SHA256

    180e304f14e6503b975942df3222d1accb8ca24a96ee836606a9e7b43e8eef44

  • SHA512

    dd28742c51c68cd09fa6d3635bcccc718739a14bd85e277b1010d7c4e7764e445fdb77e2cf80d68e14535567a8ca835e8955c266fe9c6889861fa6eefcd79def

  • SSDEEP

    49152:5SyhTvpiLYgIQVJYzJk4fDV6g0x6Gr+yCJSSVjb1AgyJKJ6koH:5SwiYg0Ffh6AJyWSYAajoH

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • TAXUS.rar
    .rar
  • Debug/ForlornApi.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • Debug/Scripts/ADD YOUR SCRIPTS HERE! (remove this).txt
  • Debug/TAXUS.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • Debug/TAXUS.exe.config
  • Debug/TAXUS.pdb
  • Debug/bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    ac435dfa812fddee99bbf7a986186d1d


    Headers

    Imports

    Exports

    Sections

  • Debug/bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • Debug/bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    1dedd757946c1ca3c32f97146f7a6c25


    Headers

    Imports

    Exports

    Sections

  • Debug/bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • Debug/bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • Debug/workspace/.tests/appendfile.txt
  • Debug/workspace/.tests/getcustomasset.txt
  • Debug/workspace/.tests/isfile.txt
  • Debug/workspace/.tests/listfiles/test_1.txt
  • Debug/workspace/.tests/listfiles/test_2.txt
  • Debug/workspace/.tests/loadfile.txt
  • Debug/workspace/.tests/readfile.txt
  • Debug/workspace/.tests/writefile
  • Debug/workspace/.tests/writefile.txt
  • Debug/workspace/3b2169cf53bc6104dabe8e19562e5cc2-cache.lua
    .js
  • Debug/workspace/BaldyToSorcerer/ReversalRedFire.MP3
  • Debug/workspace/BaldyToSorcerer/ReversalRedStartup2.MP3
  • Debug/workspace/IY_FE.iy
  • Debug/workspace/MangoHub/Data.cfg