b18e5cb328994d4284191faf8479d8607a5f4d2366b2f10c9311ec499d1f4957

General

Target
TAL_RSA1024_KeyGen.exe
Size 868KB
Sample260809-pcafdsz1a1
SHA256 b18e5cb328994d4284191faf8479d8607a5f4d2366b2f10c9311ec499d1f4957
MD5 d2dc39d83adcce20de74147958e29e77
SHA1 79efc36f702722aa7bce5143726e71d00251874a
SHA512 f4df6e5ad8f3e65b869bcc3f06389303649c3d814ab03d7b875d1a8d2106819dfa78b1813f6ae46fd9b430858f8972ba9bd80f4ced3d8ae14b562e3ee231d8be
SSDEEP 12288:sc9t2SllUsgxJJahnsQDdC4+J/fLYBrmxMWXl4g+rQPscchI7:scLysgxJJknsQDuXyrCMeArQD
TLSH
T1BA152313B8E186C7D3F64BF264B7B8226A3DAC058477164B3BA433757933353120B6A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  TAL_RSA1024_KeyGen.exe
- Size 868KB
- SHA256 b18e5cb328994d4284191faf8479d8607a5f4d2366b2f10c9311ec499d1f4957
- MD5 d2dc39d83adcce20de74147958e29e77
- SHA1 79efc36f702722aa7bce5143726e71d00251874a
- SHA512 f4df6e5ad8f3e65b869bcc3f06389303649c3d814ab03d7b875d1a8d2106819dfa78b1813f6ae46fd9b430858f8972ba9bd80f4ced3d8ae14b562e3ee231d8be
- SSDEEP 12288:sc9t2SllUsgxJJahnsQDdC4+J/fLYBrmxMWXl4g+rQPscchI7:scLysgxJJknsQDuXyrCMeArQD
- TLSH
  T1BA152313B8E186C7D3F64BF264B7B8226A3DAC058477164B3BA433757933353120B6A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

google discovery persistence phishing privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Detected potential entity reuse from brand GOOGLE.
  phishing google
- Probable phishing domain
behavioral1
- Target
  $TEMP/BASSMOD.dll
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH
  T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $TEMP/R2RJUCE.dll
- Size 308KB
- SHA256 56d2fe3beb3c57e3ccb8e7e1feda4cf37145f2f949881abae4a472289cb18b1e
- MD5 43816a9f9bc418b0c728c123d22ab3e3
- SHA1 74848859db7d6ad2c31be428aaad14859daef221
- SHA512 94842c4250b9e1cfa5c74f5498c48e45da604fc7b4ca4d23b0d216f66bdd0bcbfb34b8513a8bc4fede02f2cd3fdcbf304b1d638190065fc41ed57e61a7daabd6
- SSDEEP 6144:4whivqdhFlt1/aGA1rplhQgnN5Ytjjy2KeAOd4TBmE/S3x:4Pq/lRaGA1r/N5Qjj1HT4TIP3x
- TLSH
  T19B64AE00B593C076D27E093019B5AB661B7DB9300EB0CDBB6BD81F1D0FB95C19B62E66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $TEMP/keygen.exe
- Size 771KB
- SHA256 4ad17ef1cc0445aca66988d7be356cb9e95089eee57926e42d57c0e7902a0b7f
- MD5 52daa5d93e30df314b36b154e11cc9d8
- SHA1 e8d5e90731f1ae392ade5412b5afc676110607d9
- SHA512 81c35fe6fa32cdf2f3993a4e7ecc193b5d04965b18bfc431c3001ade158e8411826ec96c7adba179fb05a820b9d73896f0608331ca0e11daaa04e15e7c2efffc
- SSDEEP 12288:tpGVQ4KQonRBVrzRNUhYDKCZYQlfmA6A0w+NT:tp1QonRBVrzTKbQcA6AE
- TLSH
  T1E1F46298DA1285EFF4FA433C9145A214D058B3BCC226E0AFC1EFED69507915F24F91EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4