0376da8b7ca47dc45e8deee2ee4152c0f5eff8ba35a513b9b1d90969a639876d.zip
- SHA256 6f9e6d38c0171f4b271cf53a5561b321a26e644354449156a8c081bb88893b29
Password
infected
Behavioral task
behavioral1
Sample
0376da8b7ca47dc45e8deee2ee4152c0f5eff8ba35a513b9b1d90969a639876d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0376da8b7ca47dc45e8deee2ee4152c0f5eff8ba35a513b9b1d90969a639876d.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 0376da8b7ca47dc45e8deee2ee4152c0f5eff8ba35a513b9b1d90969a639876d.zip
- Size 3.4MB
- Sample260705-a98bcsfx6v
- SHA256 6f9e6d38c0171f4b271cf53a5561b321a26e644354449156a8c081bb88893b29
- MD5 df9230100b9e43300808717b16e267a1
- SHA1 e7d0dfdc4e31c98d11d0683690b29c6b9e639d2a
- SHA512 ae410d66464865ac24d79150652a268a3000cefe88bafc8e78758ab87cb39a7843876f64603c82a1a01af5b7b6e61f57005e69744a3a0ff686736c73687745e4
- SSDEEP 98304:Y/ufgVLe0PXTMdPEQEnBXRz6ZpyG+a+Z33L:YeeCShWZIGEZnL
- TLSH T169F53327181F0FDBA1F3635812A10F733D9CF1793D4A635CEB94AD69663CA966202E13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/0376da8b7ca47dc45e8deee2ee4152c0f5eff8ba35a513b9b1d90969a639876d themida - Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/0376da8b7ca47dc45e8deee2ee4152c0f5eff8ba35a513b9b1d90969a639876d suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/0376da8b7ca47dc45e8deee2ee4152c0f5eff8ba35a513b9b1d90969a639876d
File Explorer
-
0376da8b7ca47dc45e8deee2ee4152c0f5eff8ba35a513b9b1d90969a639876d.zip.zip 3.4MB
-
0376da8b7ca47dc45e8deee2ee4152c0f5eff8ba35a513b9b1d90969a639876d.exe 4.8MB
0376da8b7ca47dc45e8deee2ee4152c0f5eff8ba35a513b9b1d90969a639876d
- IMPHASH cead65acc0ded7a4400c2bf8c4b21d96
- SHA256 0376da8b7ca47dc45e8deee2ee4152c0f5eff8ba35a513b9b1d90969a639876d
- MD5 fb9bb3558f4bc5de31fe63cde6b3214a
- SHA1 2b8245f40a376a94f1f2d92696b65f9cf1f0061d
- SHA512 467faca9280e066cea804c89a2c059866f5556c6bbe197d307144625212f2d3864810dddce3fb0abcbad07bed8d22dcc62d72e2c3e54bd5a93cf876d737e5a68
- SSDEEP 98304:DK02NAG+GK0cvz7ik/Yu5Zr6o3OZf95YIJJ188:a+YC73/Jz3Oz2U
- TLSH T1D1368CA77282F8DAC30BCCF9C991B53E97C3BC2A571A71934925F39DE633918A640744
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
3334232
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
msvcrt
__C_specific_handler
__argv
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_onexit
_mbsdup
_time64
vsnprintf
abort
calloc
exit
fclose
fgets
fopen
fprintf
fread
free
fscanf
fwrite
getenv
malloc
memcpy
signal
sprintf
strcmp
strcpy
strlen
strncmp
strncpy
vfprintf
wininet
InternetReadFile
InternetCloseHandle
kernel32
GetModuleHandleA
__C_specific_handler
shell32
SHGetFolderPathA
user32
CloseClipboard
GetSystemMetrics
advapi32
RegQueryInfoKeyA
Name
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
176KB
Virtual Size
176KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.themida
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ