c136c4ac27cf07852cdcd23cee55177c05cc987cfbafcb5b11c029457f2ab811[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
c136c4ac27cf07852cdcd23cee55177c05cc987cfbafcb5b11c029457f2ab811.zip
Size 2.7MB
Sample260623-revv8adv7s
SHA256 a174dace317d11bd00340c44a101b480e3b4f8f6ea92082118023596fadee4bb
MD5 d7af7a9b88aeaa000eca7330975cd428
SHA1 0b02edcddd3d192b141c609ef336f9af85c8e826
SHA512 449e540544911d4d5c38d755cffdafaef25bc563f6f6971e59948508186052ba4c9878c106162b638229f6e6332204f770a07d2f1648de920569a462415a98f1
SSDEEP 49152:8zhjqcu2ks/V+pdjyb0nltki/muEe3q9gAzY4NXUAlwecAKLIyTxUmOyee1v6P:88cuJTq0TkyEmq9ukUAVhKEYQP
TLSH
T182D533B0D5D0202A4501EA33289BB8C7DB59D5E66F62DBD3A0492314AF73B2F4D5F50E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/c136c4ac27cf07852cdcd23cee55177c05cc987cfbafcb5b11c029457f2ab811	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/c136c4ac27cf07852cdcd23cee55177c05cc987cfbafcb5b11c029457f2ab811

File Explorer

c136c4ac27cf07852cdcd23cee55177c05cc987cfbafcb5b11c029457f2ab811.zip

.zip 2.7MB
c136c4ac27cf07852cdcd23cee55177c05cc987cfbafcb5b11c029457f2ab811

.exe 6.5MB

c136c4ac27cf07852cdcd23cee55177c05cc987cfbafcb5b11c029457f2ab811.zip

SHA256 a174dace317d11bd00340c44a101b480e3b4f8f6ea92082118023596fadee4bb
MD5 d7af7a9b88aeaa000eca7330975cd428
SHA1 0b02edcddd3d192b141c609ef336f9af85c8e826
SHA512 449e540544911d4d5c38d755cffdafaef25bc563f6f6971e59948508186052ba4c9878c106162b638229f6e6332204f770a07d2f1648de920569a462415a98f1
SSDEEP 49152:8zhjqcu2ks/V+pdjyb0nltki/muEe3q9gAzY4NXUAlwecAKLIyTxUmOyee1v6P:88cuJTq0TkyEmq9ukUAVhKEYQP
TLSH
T182D533B0D5D0202A4501EA33289BB8C7DB59D5E66F62DBD3A0492314AF73B2F4D5F50E
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

c136c4ac27cf07852cdcd23cee55177c05cc987cfbafcb5b11c029457f2ab811

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 c136c4ac27cf07852cdcd23cee55177c05cc987cfbafcb5b11c029457f2ab811
MD5 5931da3e932d099e54fd4826fc80aa58
SHA1 e16bacba26fc82bc51796b028ee677cd0004f6ec
SHA512 effa735ee97e998a7f84e4a5dc645edb7b75cae3b85d6e3c0aa90c7b713e6e09f3b9a2c5532caa55fe7c3769a91fc62fff40f98bc1ea5273fae3ed7269cda851
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8+:T6BJUoROZfIA8Xf8xumvBh8huTEEmN
TLSH
T12E665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

c136c4ac27cf07852cdcd23cee55177c05cc987cfbafcb5b11c029457f2ab811.zip

c136c4ac27cf07852cdcd23cee55177c05cc987cfbafcb5b11c029457f2ab811

kernel32

generic