59812cb3910160a140f898919009711f2df8501cefbad619b40806a5b9ef228f.zip
- SHA256 5d1e95809d14d3f51ecf37947ee314dcb26be94d1317b3682c406df2761817de
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
59812cb3910160a140f898919009711f2df8501cefbad619b40806a5b9ef228f.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
59812cb3910160a140f898919009711f2df8501cefbad619b40806a5b9ef228f.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 59812cb3910160a140f898919009711f2df8501cefbad619b40806a5b9ef228f.zip
- Size 1.2MB
- Sample260623-rd2blsdt6n
- SHA256 5d1e95809d14d3f51ecf37947ee314dcb26be94d1317b3682c406df2761817de
- MD5 ba649ee7281fc48b2a89d72008b33b62
- SHA1 df3eaa99be9ac651e9530c1195dcbec6f92fcd01
- SHA512 67b25a207a9b38744432c4fb1e18ddfa29861137c0c49f16db12267eeff2a8cc4b4314f485535f4640d41da8a4d2a3e35a997bba956b65ab35babbe517c33cc8
- SSDEEP 24576:QWlPIxShb4H2Z6eu4iCq+gFlMdo2+xWArf/zJAEU4J559BLvfSdRTpA/T:QWalH20eu4iC1o2MWUnzR9NvSRTC7
- TLSH T17E4533A1FBD4CAA5053BDF4F16B2A5BF871D5F9A92B40EDE2740C021817A7A3197DC02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Custom signatureDetect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/59812cb3910160a140f898919009711f2df8501cefbad619b40806a5b9ef228f suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/59812cb3910160a140f898919009711f2df8501cefbad619b40806a5b9ef228f
File Explorer
-
59812cb3910160a140f898919009711f2df8501cefbad619b40806a5b9ef228f.zip.zip 1.2MB
-
59812cb3910160a140f898919009711f2df8501cefbad619b40806a5b9ef228f.exe 2.4MB
59812cb3910160a140f898919009711f2df8501cefbad619b40806a5b9ef228f
- IMPHASH ed3c6fe5f2fc90fbaf5b360ba051c76e
- SHA256 59812cb3910160a140f898919009711f2df8501cefbad619b40806a5b9ef228f
- MD5 3fade9bf43da69c3c5099117c2469f64
- SHA1 3b7eb0d9a0ce66727f24deb0e3fd69f798a5b036
- SHA512 57fc7607df6bc2ae70a0c5cff7dc9d0e7bfc3653fdc13880ac8aece1b6dbef8a08a5c6ff24c18d255276fb1f8ad252172385b4cd2e2a54b99a7b7f0e5242a63e
- SSDEEP 49152:ofC7+hLkJiLw/KtbDITXjJG0zvq8ulcdhhtosT1MNSMnMznc2:FoLr9DITjJG0boO1HH
- TLSH T182C59E22FB8290B2E4D601F062BE6BF75D786234572558CBE3C01D6A59202D3763AF5F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
1878247
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
getsockopt
WSACleanup
inet_pton
WSAStartup
WSAResetEvent
closesocket
select
getaddrinfo
send
WSAGetLastError
socket
connect
recv
freeaddrinfo
ioctlsocket
setsockopt
WSAEventSelect
WSAWaitForMultipleEvents
WSASetLastError
ntohs
bind
getpeername
gethostname
sendto
recvfrom
listen
htonl
accept
getsockname
__WSAFDIsSet
htons
WSAIoctl
wldap32
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord143
ord217
ord33
ord35
ord79
ord30
ord200
ord46
ord301
ord211
crypt32
CertOpenStore
CryptUnprotectData
CryptStringToBinaryA
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
PFXImportCertStore
CertCreateCertificateChainEngine
CryptDecodeObjectEx
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCloseStore
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
advapi32
RevertToSelf
GetUserNameW
RegOpenKeyExW
RegCloseKey
DuplicateTokenEx
DuplicateToken
SetThreadToken
OpenProcessToken
ImpersonateLoggedOnUser
LookupPrivilegeValueA
GetTokenInformation
RegQueryValueExW
SystemFunction036
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
OpenThreadToken
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
AdjustTokenPrivileges
kernel32
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
GetTimeZoneInformation
IsValidCodePage
FormatMessageA
MultiByteToWideChar
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
Sleep
GetTempPathA
GetACP
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
RaiseException
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
SizeofResource
FindFirstFileW
FindNextFileW
GetModuleFileNameW
InitializeCriticalSectionEx
FindResourceA
FindClose
OpenProcess
LockResource
LoadResource
DecodePointer
GetComputerNameW
CreateProcessW
GetModuleHandleW
Process32First
TerminateProcess
CreateToolhelp32Snapshot
Process32Next
CreateProcessA
GetCurrentProcess
K32GetModuleFileNameExW
Process32NextW
Process32FirstW
K32EnumProcesses
CreateDirectoryW
GetModuleFileNameA
RemoveDirectoryW
SetFileAttributesW
K32GetModuleFileNameExA
GetNativeSystemInfo
GlobalLock
CopyFileW
QueryFullProcessImageNameW
GlobalUnlock
AcquireSRWLockExclusive
SetLastError
SetEvent
CreateEventA
QueryPerformanceFrequency
GetCurrentThread
GetSystemDirectoryA
GetModuleHandleA
SleepEx
MoveFileExA
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
VerSetConditionMask
VerifyVersionInfoW
GetFileSizeEx
GetCurrentDirectoryW
InitOnceBeginInitialize
InitOnceComplete
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
GetStringTypeW
GetLocaleInfoEx
FormatMessageW
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
IsProcessorFeaturePresent
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryAcquireSRWLockExclusive
GetFileInformationByHandleEx
FindFirstFileExW
GetFileInformationByHandle
ReleaseSRWLockExclusive
user32
MessageBoxW
ReleaseDC
GetClipboardData
CloseClipboard
OpenClipboard
EnumDisplayMonitors
SendMessageA
EmptyClipboard
GetDC
DestroyWindow
GetMonitorInfoW
gdi32
GetDIBits
GetObjectA
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
CreateDCW
DeleteDC
DeleteObject
shell32
SHGetKnownFolderPath
SHGetFolderPathW
ShellExecuteExW
ole32
CoInitializeEx
CoUninitialize
CoTaskMemFree
CreateStreamOnHGlobal
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
oleaut32
VariantClear
SysAllocString
SysFreeString
VariantInit
api-ms-win-shcore-scaling-l1-1-1
SetProcessDpiAwareness
shlwapi
StrStrIW
bcrypt
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptImportKey
BCryptDecrypt
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptGenRandom
BCryptDestroyKey
ncrypt
NCryptFreeObject
NCryptDecrypt
NCryptOpenKey
NCryptOpenStorageProvider
gdiplus
GdipFree
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipAlloc
GdipCloneImage
GdipGetImageEncoders
GdiplusShutdown
GdipDisposeImage
GdiplusStartup
GdipCreateBitmapFromHBITMAP
avicap32
capCreateCaptureWindowA
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
293KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=30795,
count=202, id=261, version=30795,
count=23, id=260, version=30795,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=253, version=32533,
count=18, id=260, version=32533,
count=104, id=261, version=32533,
count=27, id=259, version=32533,
count=2, id=262, version=30795,
count=412, id=1, productName=Unmarked objects,
count=33, id=257, version=30795,
count=162, id=260, version=32825,
count=17, id=265, version=32825,
count=1, id=255, version=32825,
count=1, id=258, version=32825,