6fe07b32b0e129f1fa4e51302f1365ffb49a46bf9e46ab813d4d4b4dd5fa2f54[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
6fe07b32b0e129f1fa4e51302f1365ffb49a46bf9e46ab813d4d4b4dd5fa2f54.zip
Size 3.4MB
Sample260624-wzhtlsev21
SHA256 c323ebcb3d661272c103ff1a8b1ab045f65496b17f5bcf3fb0c86ac6f1b6d7cc
MD5 15f00511426f9080608f05bde7ca83b5
SHA1 e646fae441a215b06ee28cce854fe9c52517f158
SHA512 8f08e4c685aa048f056ca6e8bb99ca1c35207b451a30a5c5f1a767cfaa8fb610d67a236abb0bf5116ffa023b7840d4adf92fe353212364e1de99cc5a46c3246a
SSDEEP 98304:EfaXoROBUkqmOutTQF65P3osh+lBu9ZpF/Z52Gs02W7ZYZ:EfWOOBUstF5P4sh+vIZplZ172gZy
TLSH
T1A2F5333D536442DD2CD490283DCA5F4D2DFA2EA90192D592CDCB24ED5D7FAA8C68F322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/6fe07b32b0e129f1fa4e51302f1365ffb49a46bf9e46ab813d4d4b4dd5fa2f54	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/6fe07b32b0e129f1fa4e51302f1365ffb49a46bf9e46ab813d4d4b4dd5fa2f54

File Explorer

6fe07b32b0e129f1fa4e51302f1365ffb49a46bf9e46ab813d4d4b4dd5fa2f54.zip

.zip 3.4MB
6fe07b32b0e129f1fa4e51302f1365ffb49a46bf9e46ab813d4d4b4dd5fa2f54

.exe 8.1MB

6fe07b32b0e129f1fa4e51302f1365ffb49a46bf9e46ab813d4d4b4dd5fa2f54.zip

SHA256 c323ebcb3d661272c103ff1a8b1ab045f65496b17f5bcf3fb0c86ac6f1b6d7cc
MD5 15f00511426f9080608f05bde7ca83b5
SHA1 e646fae441a215b06ee28cce854fe9c52517f158
SHA512 8f08e4c685aa048f056ca6e8bb99ca1c35207b451a30a5c5f1a767cfaa8fb610d67a236abb0bf5116ffa023b7840d4adf92fe353212364e1de99cc5a46c3246a
SSDEEP 98304:EfaXoROBUkqmOutTQF65P3osh+lBu9ZpF/Z52Gs02W7ZYZ:EfWOOBUstF5P4sh+vIZplZ172gZy
TLSH
T1A2F5333D536442DD2CD490283DCA5F4D2DFA2EA90192D592CDCB24ED5D7FAA8C68F322
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

6fe07b32b0e129f1fa4e51302f1365ffb49a46bf9e46ab813d4d4b4dd5fa2f54

IMPHASH bedaded91dc96d44d9e874d156bb66f9
SHA256 6fe07b32b0e129f1fa4e51302f1365ffb49a46bf9e46ab813d4d4b4dd5fa2f54
MD5 36c53cbc8ae2f8324ab828950f12c75f
SHA1 944de461784c1de5c29ffcc9859afc908a312efc
SHA512 9266a0599978cd4c2b76eb0e1e786f10ef018e2d816fd836f10d5fb262f4b661cb3e2a74ee9a0e4f5805de1e8f26e87280fc2cb1ca4f6009c82835eed7340dbe
SSDEEP 196608:rNBXQrUIWtjhDbN8114ZSmIKpxhoJG0f:rrtjFb2114TpnGG
TLSH
T116867B61A756ACB2D69744FA6B32B9BDA8352AD447B900DB23150C4DDCCC1C0FBEA713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

672207

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

ntohs connect getpeername getsockname setsockopt WSAIoctl WSASetLastError select htonl getaddrinfo freeaddrinfo recvfrom WSAWaitForMultipleEvents WSAGetLastError WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getsockopt WSACleanup accept bind htons closesocket listen WSAStartup send socket recv __WSAFDIsSet sendto gethostname ioctlsocket

wldap32

ord217 ord46 ord211 ord60 ord45 ord50 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord41 ord143

crypt32

CertGetCertificateChain CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertFreeCertificateChain

advapi32

CryptReleaseContext GetUserNameW CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam RegQueryValueExW CryptAcquireContextA OpenThreadToken RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW

kernel32

RtlUnwind RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetTimeZoneInformation FlushFileBuffers DeleteFileW HeapReAlloc SetEndOfFile IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetModuleHandleA FindResourceA GetModuleHandleW MultiByteToWideChar SizeofResource EndUpdateResourceW LockResource LoadResource BeginUpdateResourceW UpdateResourceA Sleep CreateDirectoryW GetModuleFileNameW HeapSize GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive CloseHandle LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent WaitForSingleObject CreateEventA QueryPerformanceFrequency GetCurrentThread GetSystemDirectoryA FreeLibrary GetProcAddress LoadLibraryA SleepEx QueryPerformanceCounter GetTickCount GetLastError SetLastError FormatMessageW MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetCurrentProcessId GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW CreateFileA GetFileSizeEx DecodePointer EncodePointer CompareStringEx SleepConditionVariableSRW WakeAllConditionVariable GetFileInformationByHandleEx AreFileApisANSI GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW GetCurrentDirectoryW GetStringTypeW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentThreadId GetCPInfo InitializeSListHead ExitProcess SetFilePointerEx WriteFile GetConsoleMode ReadConsoleW GetConsoleOutputCP HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW EnterCriticalSection IsValidLocale GetFileAttributesW WriteConsoleW GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime LCMapStringEx

user32

CloseClipboard EmptyClipboard SetClipboardData SetScrollInfo DestroyWindow SetWindowPos GetScrollInfo SetTimer KillTimer GetMessageA DispatchMessageA PostMessageA MessageBoxA RegisterClassA CreateWindowExA TranslateMessage LoadIconA OpenClipboard GetParent ReleaseCapture LoadCursorA MessageBoxW CreateWindowExW SendMessageW SetWindowTextW ShowWindow SetWindowLongA GetDlgCtrlID GetWindowLongA LoadBitmapA DefWindowProcA SendMessageA SetCursor GetClientRect GetDlgItem DrawTextW UpdateWindow InvalidateRect BeginPaint EndPaint GetWindowTextW GetWindowTextLengthW PostQuitMessage

gdi32

GetStockObject RoundRect CreateSolidBrush DeleteObject SetBkColor CreatePen SetBkMode SetTextColor DeleteDC CreateCompatibleDC SelectObject BitBlt GetObjectA CreateFontA

comdlg32

GetOpenFileNameW

shell32

ShellExecuteW

ole32

CreateStreamOnHGlobal

gdiplus

GdipCreateFromHDC GdipFree GdipFillRectangle GdipCreateSolidFill GdipDrawImageRectI GdipAlloc GdipDeleteBrush GdipSetCompositingMode GdipSetInterpolationMode GdipDrawImageRect GdiplusShutdown GdiplusStartup GdipLoadImageFromStream GdipDisposeImage GdipCloneImage GdipDeleteGraphics GdipSetSmoothingMode

bcrypt

BCryptGenRandom