General

  • Target

    TouchVPN Installer.exe

  • Size

    1.0MB

  • Sample

    250114-wy65taxmdl

  • MD5

    7ec7f13778ff6a2c47bacd5f421506a0

  • SHA1

    d3e49937895de5b700bb455a4f2c65e5a251617d

  • SHA256

    c54d526da6cc7ab50db767bb1666e111a334df6f24240667d472d0522e06ae7e

  • SHA512

    834d2175b4a0c83d26fa306687e87dbb636fdf449a0b02dfe123bd42704597aa948d0ee91a79f0972aba009c2a058007ec4ce7e60d601e93898dfc56b43ed383

  • SSDEEP

    12288:qvUGQWpy+Tac0RDffXJjyYpcyoNHSy5viczPESsQ3BaE32VfXJjyYpz:lGQB+2DR7BWYpcyo44u0aPVBWYpz

Malware Config

Targets

    • Target

      TouchVPN Installer.exe

    • Size

      1.0MB

    • MD5

      7ec7f13778ff6a2c47bacd5f421506a0

    • SHA1

      d3e49937895de5b700bb455a4f2c65e5a251617d

    • SHA256

      c54d526da6cc7ab50db767bb1666e111a334df6f24240667d472d0522e06ae7e

    • SHA512

      834d2175b4a0c83d26fa306687e87dbb636fdf449a0b02dfe123bd42704597aa948d0ee91a79f0972aba009c2a058007ec4ce7e60d601e93898dfc56b43ed383

    • SSDEEP

      12288:qvUGQWpy+Tac0RDffXJjyYpcyoNHSy5viczPESsQ3BaE32VfXJjyYpz:lGQB+2DR7BWYpcyo44u0aPVBWYpz

    • Detected google phishing page

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks