General

  • Target

    5xxxx.zip

  • Size

    385.6MB

  • MD5

    ef3e4d0519646e999bc294081acd66a8

  • SHA1

    72d013d994993ab932986ab76bfcb51d2597d2b1

  • SHA256

    7982a8dd7cbafc7dc7bb0987276aa883c347ff496d9dfb5ec0852bc49d03b8bc

  • SHA512

    4a4fdc21c97260512be146305a3c40cc308313295f0f2f607c7743cf27d25aaca35d32e201b578cc69b6534f3bd8333f1e6baa6439b4129b4f7031b79f4c69ba

  • SSDEEP

    6291456:8N6IBVuL2m+nq4lIB/tuUNuCosrLxUYkDpE2kigo9848PXOn6p0vdKFZTFdQBR:u3P/3l/eucLxURE2hnn6p0lcZTP8

Score
3/10

Malware Config

Signatures

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • 5xxxx.zip
    .zip

    Password: infected

  • 1.exe
    .exe windows:5 windows x64 arch:x64

    Password: infected

    838dd9fbdbb409224ad0e13122a109ae


    Headers

    Imports

    Sections

  • 2.exe
    .exe windows:5 windows x64 arch:x64

    Password: infected

    838dd9fbdbb409224ad0e13122a109ae


    Headers

    Imports

    Sections

  • Setup.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f4639a0b3116c2cfc71144b88a929cfd


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    85f08eb0cbec010ecbc287fa68321173


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    509a34b3a68a773e0afb4259e68f9f82


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • Potato_b5632ac/Potato.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    b6230bbe811acccf26e4892517cc89db


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Potato_b5632ac/Updater.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    82b4485d40d6c4a0a4ed72120ae1361b


    Code Sign

    Headers

    Imports

    Sections

  • Potato_b5632ac/plugin/g7tuiyvcgh8
  • Potato_b5632ac/plugin/webrtcmedia.dll
    .dll windows:5 windows x86 arch:x86

    Password: infected

    c619f5005698cd50698a72f66ef8c732


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • d.bmp
  • h.bmp
  • launch9.exe
    .exe windows:5 windows x86 arch:x86

    a4de0ba99eaf25c5b0c13cc5a8ac11d4


    Headers

    Imports

    Sections

  • t9.bmp
  • tank.bmp
  • tex1.bmp
    .zip
  • _中文版_TG_telegrnai_win_dows_ios_X_64.exe
    .exe windows:6 windows x86 arch:x86

    eb5bc6ff6263b364dfbfb78bdb48ed59


    Headers

    Imports

    Exports

    Sections

  • potato_latestx64.exe
    .exe windows:6 windows x86 arch:x86

    40ab50289f7ef5fae60801f88d4541fc


    Headers

    Imports

    Exports

    Sections