156610ede72452aa14b583310bc6d8478d3b33554c4f4f8012a0a5bb117b5088[.]zip

General

Target
156610ede72452aa14b583310bc6d8478d3b33554c4f4f8012a0a5bb117b5088.zip
Size 49KB
Sample260507-sa6mlae18x
SHA256 bb5e2f047541a2fda82b22e7d05304e7093dcd19236c7eb762d994481c9148a3
MD5 abfff623742da8258587ba6575211012
SHA1 77f9542b363ab96ac2a6e578bd1abddd8fb24e17
SHA512 0e2b0d0ca9fcc734b5b2fa197c3168d0c1b0c7b19c2f0e75509e27c8e5de8f17c24d32dacdcb77e0510e63fc44710b93d7e013065da6327a4e54db57d6b53283
SSDEEP 1536:7inBEQmEd8KJzfayy5XuIu/CHKepSuSlprWK9SUV:7inK68KLap5XuIWYK2StGKrV
TLSH
T1A1330202134A22FF67D9ED6432670FC75D6FFC99F231914A31F4B6A2888099DEC190AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Custom signature

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/156610ede72452aa14b583310bc6d8478d3b33554c4f4f8012a0a5bb117b5088	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/156610ede72452aa14b583310bc6d8478d3b33554c4f4f8012a0a5bb117b5088

File Explorer

156610ede72452aa14b583310bc6d8478d3b33554c4f4f8012a0a5bb117b5088.zip

.zip 49KB
156610ede72452aa14b583310bc6d8478d3b33554c4f4f8012a0a5bb117b5088

.exe 91KB

156610ede72452aa14b583310bc6d8478d3b33554c4f4f8012a0a5bb117b5088.zip

SHA256 bb5e2f047541a2fda82b22e7d05304e7093dcd19236c7eb762d994481c9148a3
MD5 abfff623742da8258587ba6575211012
SHA1 77f9542b363ab96ac2a6e578bd1abddd8fb24e17
SHA512 0e2b0d0ca9fcc734b5b2fa197c3168d0c1b0c7b19c2f0e75509e27c8e5de8f17c24d32dacdcb77e0510e63fc44710b93d7e013065da6327a4e54db57d6b53283
SSDEEP 1536:7inBEQmEd8KJzfayy5XuIu/CHKepSuSlprWK9SUV:7inK68KLap5XuIWYK2StGKrV
TLSH
T1A1330202134A22FF67D9ED6432670FC75D6FFC99F231914A31F4B6A2888099DEC190AD
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

156610ede72452aa14b583310bc6d8478d3b33554c4f4f8012a0a5bb117b5088

IMPHASH 76675e224bd40187130dd2af449532dd
SHA256 156610ede72452aa14b583310bc6d8478d3b33554c4f4f8012a0a5bb117b5088
MD5 2cb2f31eb0fabe854bfa724a41f8a1e8
SHA1 e605d84095d382b987d94ec6abefa32d6219a6a1
SHA512 6e4934e8945e9038b5fc9a122b7ace2733c045b77114be51d46ff7fcc630419ddf48e097dcb4fe3b6bd5728fe697dc30e49789796a8507fc3bdba773d9865337
SSDEEP 1536:9wvukQV3Zve9E6BzmHrspbyDtp88q0bETk1Nk+2SVQ0vfUCYbzwaDgsWVtcdR/NG:9wKZZv6V2SMp88qVTkrk+2gQ0vfYb7DC
TLSH
T1AC936D01B5C1C471E5B259751C64DEB19A3EFD201F219EEB339816BA0F342C19E36EAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

6

Entry point

7965

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetOpenUrlA InternetCloseHandle InternetOpenA

user32

GetMessageA CallNextHookEx SetWindowsHookExA ShowWindow DispatchMessageA TranslateMessage

kernel32

GetProcAddress WriteConsoleW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetModuleHandleA GetConsoleWindow ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW IsProcessorFeaturePresent HeapReAlloc RaiseException RtlUnwind GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW DecodePointer GetCommandLineA GetCommandLineW IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetProcessHeap HeapSize

Sharing