dynam1c | 53917ed9caf56cf52e75c3843a0bfdf6a2cd996a0dcccfb8519479f1114d5d89[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
53917ed9caf56cf52e75c3843a0bfdf6a2cd996a0dcccfb8519479f1114d5d89.zip
Size 4.1MB
Sample240521-gf2eaaee92
SHA256 74aeb42fb3716c9a4111768aad66c88f4108140122c855a1664e4181a5133906
MD5 3ace4f98a8e2ca5ace180869db765846
SHA1 76cf3c93a4f62cd164964ca0ed87be803e835220
SHA512 6d816f039896e3e63d4b7a4a14a6587b8d7cd0fa5d1fdc43539cb0c2c81173b267dca9d3c999f513b47004f66ea65836f004efbdac717dc32ca263910b68fce8
SSDEEP 98304:u6HhGCtqyAqtkuWPuxHk8qmQ0YkqnP9jlR+GDVD:uVKkuWGVk8qmDYHFXVD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dynam1c

Malware Config

Extracted

Family

dynam1c

https://api.telegram.org/bot6842353583:AAEgR3kxlNRjwYDcC3dhMp3Rc4cvQgVYxzY

Signatures

Dynam1c family
dynam1c

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/53917ed9caf56cf52e75c3843a0bfdf6a2cd996a0dcccfb8519479f1114d5d89	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/53917ed9caf56cf52e75c3843a0bfdf6a2cd996a0dcccfb8519479f1114d5d89

File Explorer

53917ed9caf56cf52e75c3843a0bfdf6a2cd996a0dcccfb8519479f1114d5d89.zip

.zip 4.1MB
53917ed9caf56cf52e75c3843a0bfdf6a2cd996a0dcccfb8519479f1114d5d89

.exe 7.3MB

53917ed9caf56cf52e75c3843a0bfdf6a2cd996a0dcccfb8519479f1114d5d89.zip

SHA256 74aeb42fb3716c9a4111768aad66c88f4108140122c855a1664e4181a5133906
MD5 3ace4f98a8e2ca5ace180869db765846
SHA1 76cf3c93a4f62cd164964ca0ed87be803e835220
SHA512 6d816f039896e3e63d4b7a4a14a6587b8d7cd0fa5d1fdc43539cb0c2c81173b267dca9d3c999f513b47004f66ea65836f004efbdac717dc32ca263910b68fce8
SSDEEP 98304:u6HhGCtqyAqtkuWPuxHk8qmQ0YkqnP9jlR+GDVD:uVKkuWGVk8qmDYHFXVD
MD5 SHA1 SHA512 SSDEEP

Password

infected

53917ed9caf56cf52e75c3843a0bfdf6a2cd996a0dcccfb8519479f1114d5d89

IMPHASH c2d457ad8ac36fc9f18d45bffcd450c2
SHA256 53917ed9caf56cf52e75c3843a0bfdf6a2cd996a0dcccfb8519479f1114d5d89
MD5 1e8eaf6f4607c61f9f929ac2ec6b0be1
SHA1 58a1be42f65daf7eafd03524aa331a9aa3e4aa96
SHA512 3d56a2d4c9f2065fcb6446d659ca26591761820d547fec8772d5ffcfec71d7be88ab46ae06585d6f870ff71db572ea707adc0c734d658586e40f04c5a2d302b6
SSDEEP 98304:evx2ACQXbQ3rCEmb8y51zM/H4LMHbi48abmAdcecVvV538Ivpedr/E6:exXbQLmbXz2HkKt8hJeMV5sO0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

448800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

213KB

Virtual Size

779KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

297B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

422KB

Virtual Size

421KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/32

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/46

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/65

Size

731KB

Virtual Size

730KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/78

Size

536KB

Virtual Size

535KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/90

Size

158KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

343KB

Virtual Size

342KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

53917ed9caf56cf52e75c3843a0bfdf6a2cd996a0dcccfb8519479f1114d5d89.zip

53917ed9caf56cf52e75c3843a0bfdf6a2cd996a0dcccfb8519479f1114d5d89

kernel32

generic