0cf97c4a0dc46545d3a45490df87fc738652366d9bdfdd6fbe983cbc91e0095b[.]zip

General

Target
0cf97c4a0dc46545d3a45490df87fc738652366d9bdfdd6fbe983cbc91e0095b.zip
Size 7.6MB
Sample260627-3wefcaet2k
SHA256 4a2893901f22441621c0d40f45f2bf0cb29d27118da3639042ed78c3eaa63eae
MD5 a2f434feb157dbcd790c414ffc70d571
SHA1 3be1e5c4db1c8d18f97a33e5477eb9d374162f94
SHA512 3f412c95ba9dc588b2dbe56ee6de17ddd56305c05499011eee193fc1c053a0c6e643bb098005e2b7d27f7c333e4043ffefab5f3df66ef04a4fbcb7f892b1b2ef
SSDEEP 196608:4C7rACbjZtDTDNzwFba5sYdYxDe2wt5SZIMn7V:4fWFtXF7Wpe9E1n7V
TLSH
T1A38633B1F88E5B3CFF8DC291BDF69964EA456DD68791F2C719618AA0300C42770CDE91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/0cf97c4a0dc46545d3a45490df87fc738652366d9bdfdd6fbe983cbc91e0095b	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0cf97c4a0dc46545d3a45490df87fc738652366d9bdfdd6fbe983cbc91e0095b

File Explorer

0cf97c4a0dc46545d3a45490df87fc738652366d9bdfdd6fbe983cbc91e0095b.zip

.zip 7.6MB
0cf97c4a0dc46545d3a45490df87fc738652366d9bdfdd6fbe983cbc91e0095b

.exe 14.9MB

0cf97c4a0dc46545d3a45490df87fc738652366d9bdfdd6fbe983cbc91e0095b.zip

SHA256 4a2893901f22441621c0d40f45f2bf0cb29d27118da3639042ed78c3eaa63eae
MD5 a2f434feb157dbcd790c414ffc70d571
SHA1 3be1e5c4db1c8d18f97a33e5477eb9d374162f94
SHA512 3f412c95ba9dc588b2dbe56ee6de17ddd56305c05499011eee193fc1c053a0c6e643bb098005e2b7d27f7c333e4043ffefab5f3df66ef04a4fbcb7f892b1b2ef
SSDEEP 196608:4C7rACbjZtDTDNzwFba5sYdYxDe2wt5SZIMn7V:4fWFtXF7Wpe9E1n7V
TLSH
T1A38633B1F88E5B3CFF8DC291BDF69964EA456DD68791F2C719618AA0300C42770CDE91
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

0cf97c4a0dc46545d3a45490df87fc738652366d9bdfdd6fbe983cbc91e0095b

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0cf97c4a0dc46545d3a45490df87fc738652366d9bdfdd6fbe983cbc91e0095b
MD5 3af8165f31167a99ce0d277d34e69399
SHA1 81e93493dbf83bec938fa2b3b45b99a35f441216
SHA512 90d41c0d3972749c37ff514b9a0fe3b9f62b683586694f43ad5bb3b1096ca13cef2045d454bf258b58ffaf6263b0c181fabeb28c5ffec286c3005b1286c56029
SSDEEP 196608:1S/BAe1d4ihvy85JhhYc3BSL1kehn4inje:1MyIhhkRka4i
TLSH
T138F69E107BD6800AE47169B00A946AE199BEBE9F2B15D8A930C4331C57F64CCF993FF5
MD5 SHA1 SHA512 SSDEEP TLSH

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

15475086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

0cf97c4a0dc46545d3a45490df87fc738652366d9bdfdd6fbe983cbc91e0095b.zip

0cf97c4a0dc46545d3a45490df87fc738652366d9bdfdd6fbe983cbc91e0095b

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

0cf97c4a0dc46545d3a45490df87fc738652366d9bdfdd6fbe983cbc91e0095b.zip

0cf97c4a0dc46545d3a45490df87fc738652366d9bdfdd6fbe983cbc91e0095b

mscoree

dotnet