Benign windows Download

terragrunt

Legitimate signed Terragrunt binary

Obfuscated Go key generationAssembly LOOP target mnemonic

SHA-2565cdcbd035e9286c4321e7722235d622126a2fdf11575431fd6f05f6da1e784d4

URLhttps://github.com/gruntwork-io/terragrunt/releases/download/v1.1.5/terragrunt_windows_amd64.exe#/terragrunt.exe

MaleculeK₃(Li₅McTe)O₁₀(I₅Al₃As₃C₁₀Ca₃DyEr₄EuLaPr)H₉(Cm₂₈Cr₁₃Db₁₃F₉Hf₂MgOs₁₈Po₉U₂)Md₈(Bi₈BkPaPtSi₃)

Evidence

mov eax, imm32; syscall pattern 0x427e7–0x428a7

⋯3 more rows
0x428178d05e7222302bb11000000e8b9930400..."#...........
0x42827b8f0ff0000e84f0f0500b8f0ff0000e8......O.........
0x42837450f0500b8f0ff0000e83b0f0500b8f0E.........;.....
⋯7 more rows

Go time.Location type name fragment in .text 0xb9b17–0xb9c47

⋯3 more rows
0xb9b479424b000000049b874696d652e4c6f63.$....I.time.Loc
0xb9b574c89041066c7441008616ce9b5010000L...f.D..al.....
0xb9b67488d5a0e4839d973294c898424f80000H.Z.H9.s)L..$...
⋯3 more rows
0xb9ba7000048898c24b800000048b974696d65..H..$....H.time
0xb9bb72e4c6f6348890c1048b96f636174696f.LocH...H.ocatio
0xb9bc76e2848894c1006498b00498b5808e886n(H.L..I..I.X...
0xb9bd7290000488b8c24b0000000488d141948)..H..$....H...H
⋯7 more rows

Go time.UTC type name fragment in .text 0xb9cd8–0xb9d98

⋯3 more rows
0xb9d089424b000000049b874696d652e555443.$....I.time.UTC
0xb9d184c89041048ffc3904839d97311bf0100L...H...H9.s....
0xb9d280000488d3557e26704e88a3ffdffc644..H.5W.g...?...D
⋯7 more rows

ChaCha quarter-round rotation schedule 0x3421e3–0x3422a3

⋯3 more rows
0x34221348899c24000100008d9a6e64203331cbH..$......nd 31.
0x342223c1c310418d4c1d00894c247431d1c1c1...A.L...L$t1...
0x3422330c448d2c0a458dad6e6420334431ebc1.D.,.E..nd 3D1..
⋯7 more rows

Obfuscated Go key generation 0x29bb270–0x29bb3b0

⋯5 more rows
0x29bb2c06e4d61696c2f676f2d63727970746f2fnMail/go-crypto/
0x29bb2d06269746375727665732e282a42697443bitcurves.(*BitC
0x29bb2e075727665292e47656e65726174654b65urve).GenerateKe
0x29bb2f079006769746875622e636f6d2f50726fy.github.com/Pro
0x29bb300746f6e4d61696c2f676f2d6372797074tonMail/go-crypt
⋯11 more rows