5e92a4bf3b5d268b156938ebe0b4d719e3bcf95399f148735f03272d7a53d9ed[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
5e92a4bf3b5d268b156938ebe0b4d719e3bcf95399f148735f03272d7a53d9ed.zip
Size 2.7MB
Sample260703-r5graabs71
SHA256 bfbbe5851e28d2e58fc9dd54d4a0163a81011d6a456f3b7902d2601388afd964
MD5 25a148a2382d5671343064e7b603068e
SHA1 1289ebb71dc97be0756f54f9cc25d4ffd46aacec
SHA512 100396618a19ef5122886318d61bac46f124b08eac879cca90ac60639f5000933dbc1f03c056ff65eb2a1033d05f8d21d980c51efcf30e4811b511373cf0a845
SSDEEP 49152:pNUTIocfkNW84MFjQLev/z2usg3SwNiZNOp0dK0Tq3Wy726AUkU97c7copOjiTfb:oItkNWC5Qa6up3SwN0N/K0q3Wy72ba9o
TLSH
T1A9D533C745BC5DB98381AFF03A29F7D74D9EA33DE52666837C807479AD288101A1F227
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/5e92a4bf3b5d268b156938ebe0b4d719e3bcf95399f148735f03272d7a53d9ed	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5e92a4bf3b5d268b156938ebe0b4d719e3bcf95399f148735f03272d7a53d9ed

File Explorer

5e92a4bf3b5d268b156938ebe0b4d719e3bcf95399f148735f03272d7a53d9ed.zip

.zip 2.7MB
5e92a4bf3b5d268b156938ebe0b4d719e3bcf95399f148735f03272d7a53d9ed

.exe 6.5MB

5e92a4bf3b5d268b156938ebe0b4d719e3bcf95399f148735f03272d7a53d9ed.zip

SHA256 bfbbe5851e28d2e58fc9dd54d4a0163a81011d6a456f3b7902d2601388afd964
MD5 25a148a2382d5671343064e7b603068e
SHA1 1289ebb71dc97be0756f54f9cc25d4ffd46aacec
SHA512 100396618a19ef5122886318d61bac46f124b08eac879cca90ac60639f5000933dbc1f03c056ff65eb2a1033d05f8d21d980c51efcf30e4811b511373cf0a845
SSDEEP 49152:pNUTIocfkNW84MFjQLev/z2usg3SwNiZNOp0dK0Tq3Wy726AUkU97c7copOjiTfb:oItkNWC5Qa6up3SwN0N/K0q3Wy72ba9o
TLSH
T1A9D533C745BC5DB98381AFF03A29F7D74D9EA33DE52666837C807479AD288101A1F227
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

5e92a4bf3b5d268b156938ebe0b4d719e3bcf95399f148735f03272d7a53d9ed

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 5e92a4bf3b5d268b156938ebe0b4d719e3bcf95399f148735f03272d7a53d9ed
MD5 22c88f82c6cf3f778ad970899cbbf774
SHA1 0a69fb9b276a5c770f5a3d68c0f0b4fb7442ca3e
SHA512 d5fff8bda6fc2533692eb7549e46fd32d4fcfbc2fb533d830b4609d129d4e1d898b05b2e8af88b1bfe895ea8af2132c4bc04b1df9a7c693a6964c5ae171b1f70
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8C:T6BJUoROZfIA8Xf8xumvBh8huTEEmn
TLSH
T121665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

5e92a4bf3b5d268b156938ebe0b4d719e3bcf95399f148735f03272d7a53d9ed.zip

5e92a4bf3b5d268b156938ebe0b4d719e3bcf95399f148735f03272d7a53d9ed

kernel32

generic