a411666e342831625a3205e63413e91448aa4d4d02da059f3d799f675416d285[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
a411666e342831625a3205e63413e91448aa4d4d02da059f3d799f675416d285.zip
Size 2.7MB
Sample260705-vg29vsd17t
SHA256 718237bcea66bb26db14b058a07f8361b8f89caca6e7ec4d20d7d26cf5bb994f
MD5 603b296a6b4f6f89230273a260c5eefd
SHA1 17cb8479100f807dc4838e527037b9cd480288c8
SHA512 63d4e0fdc5535bab225c17764432475fb558a71be4a1d31761e2379e7e25d49683c3e431646bac9b794db9e99f94ce92ff6bc9b2d68214418ffe243ac3eef06a
SSDEEP 49152:al8l6mFqTxMGao/kef0KNV2Df/GT51c0w7en9Wd4gZ0Wplx39oXJOcBAdzCfunm:jKaozMgofOTY+n9Wx/bZf3m
TLSH
T149D533FAC374344A05C67F35183D412239F97ECC2BF5E84974B0AAA65261E0DDA8B64F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/a411666e342831625a3205e63413e91448aa4d4d02da059f3d799f675416d285	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a411666e342831625a3205e63413e91448aa4d4d02da059f3d799f675416d285

File Explorer

a411666e342831625a3205e63413e91448aa4d4d02da059f3d799f675416d285.zip

.zip 2.7MB
a411666e342831625a3205e63413e91448aa4d4d02da059f3d799f675416d285

.exe 6.5MB

a411666e342831625a3205e63413e91448aa4d4d02da059f3d799f675416d285.zip

SHA256 718237bcea66bb26db14b058a07f8361b8f89caca6e7ec4d20d7d26cf5bb994f
MD5 603b296a6b4f6f89230273a260c5eefd
SHA1 17cb8479100f807dc4838e527037b9cd480288c8
SHA512 63d4e0fdc5535bab225c17764432475fb558a71be4a1d31761e2379e7e25d49683c3e431646bac9b794db9e99f94ce92ff6bc9b2d68214418ffe243ac3eef06a
SSDEEP 49152:al8l6mFqTxMGao/kef0KNV2Df/GT51c0w7en9Wd4gZ0Wplx39oXJOcBAdzCfunm:jKaozMgofOTY+n9Wx/bZf3m
TLSH
T149D533FAC374344A05C67F35183D412239F97ECC2BF5E84974B0AAA65261E0DDA8B64F
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

a411666e342831625a3205e63413e91448aa4d4d02da059f3d799f675416d285

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 a411666e342831625a3205e63413e91448aa4d4d02da059f3d799f675416d285
MD5 4ebfe04a2291a127360277132463515a
SHA1 fff5289f2cd99d108b24466ed917d701d94baca7
SHA512 517cbb2747def3ad7ee0878ffd261ccb73fbb414d65d71b290c1a846c52f39ccc6e69d7557b085f49712ac0db7374eafda0bff36e99971514de1336127ca9a51
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8S:T6BJUoROZfIA8Xf8xumvBh8huTEEmD
TLSH
T148665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

a411666e342831625a3205e63413e91448aa4d4d02da059f3d799f675416d285.zip

a411666e342831625a3205e63413e91448aa4d4d02da059f3d799f675416d285

kernel32

generic