3988b1bedf2b3eda6e695016f892a5d13ff7868e3a8bbd77913e2955a4364803.zip
- SHA256 680be70cb6ca969c71293838fbdf550e47c1b1be7682e6db5d8589f06680a38e
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
3988b1bedf2b3eda6e695016f892a5d13ff7868e3a8bbd77913e2955a4364803.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
3988b1bedf2b3eda6e695016f892a5d13ff7868e3a8bbd77913e2955a4364803.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 3988b1bedf2b3eda6e695016f892a5d13ff7868e3a8bbd77913e2955a4364803.zip
- Size 48KB
- Sample260707-sp1d5af161
- SHA256 680be70cb6ca969c71293838fbdf550e47c1b1be7682e6db5d8589f06680a38e
- MD5 e36fc18a78bef31f08f030f7361b2ae4
- SHA1 1251fe628e2066763485ef3ba9e93120e032a721
- SHA512 f806c37cbd0674667138baf3cc56866ed8e0023add1071d2a5a682a9308748f551eff1092587234dc646125ab86d409251a509d67a2457cac9e58f2b38966b8b
- SSDEEP 768:cQfdo1gSy3ebJuHBbIB4aJY/8fMWRVF4KQPzwibsu07tnILNDNRA:nfa183eboH6B4l0fhzF4KqpnMtI1w
- TLSH T10F330232E56D2858FAB752FAC8584D2D14240BF7CB6111278B82C6DCA734F459B13EBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/3988b1bedf2b3eda6e695016f892a5d13ff7868e3a8bbd77913e2955a4364803 suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/3988b1bedf2b3eda6e695016f892a5d13ff7868e3a8bbd77913e2955a4364803
File Explorer
-
3988b1bedf2b3eda6e695016f892a5d13ff7868e3a8bbd77913e2955a4364803.zip.zip 48KB
-
3988b1bedf2b3eda6e695016f892a5d13ff7868e3a8bbd77913e2955a4364803.exe 112KB
3988b1bedf2b3eda6e695016f892a5d13ff7868e3a8bbd77913e2955a4364803
- IMPHASH f861f37e5d02a8dc976139866dc6cce1
- SHA256 3988b1bedf2b3eda6e695016f892a5d13ff7868e3a8bbd77913e2955a4364803
- MD5 3a9043dde8713317f8b948526d5004bb
- SHA1 1bad98683069e5910a9e93b54f4ef672ca92c384
- SHA512 3326d820a2bec6ad2bb54f4fd78a8be3414aec2ad989f940096ab6ac1e19c87024d2e0a4884f3cfd03c8e30085f2bdd9b6a6ddbfe0f5df70f4a57bd97d1ad191
- SSDEEP 1536:QjOzOfgUID9kKyZoYZxPf3GWuzbQV9yACAU4SaNbHMnCgpkqMxHjjdaAWJj6GuJN:KlGWuwV9yACAUopIUHj0AKmGuT
- TLSH T1ACB33A2AB958507DD276C5B8DA875C02DB32B8890371ABDF53905DE30E12AE49F3F712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
70288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\adria\Downloads\tdata stealer\tdata_stealer\x64\Release\tdata_stealer.pdb
zip
zip_discard
zip_source_buffer
zip_file_add
zip_open
zip_close
libcurl
curl_mime_free
curl_easy_setopt
curl_easy_cleanup
curl_mime_name
curl_mime_type
curl_easy_init
curl_mime_addpart
curl_easy_perform
curl_easy_escape
curl_mime_filename
curl_mime_init
curl_mime_data
shell32
SHGetFolderPathA
advapi32
GetUserNameA
kernel32
GetStartupInfoW
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetLocaleInfoEx
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
GetFileInformationByHandleEx
LocalFree
GetModuleHandleW
GetModuleHandleA
Sleep
GetTempPathA
DeleteFileA
CloseHandle
Module32FirstW
GetProcAddress
CreateProcessW
GetTempFileNameA
GetComputerNameA
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFinalPathNameByHandleW
CreateFile2
AreFileApisANSI
GetLastError
user32
PostMessageW
GetWindowThreadProcessId
EnumWindows
msvcp140
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
memcpy
__std_exception_destroy
__current_exception_context
memcmp
memmove
memset
__C_specific_handler
_CxxThrowException
__current_exception
__std_exception_copy
api-ms-win-crt-stdio-l1-1-0
fread
fsetpos
ungetc
setvbuf
fgetpos
fwrite
_fseeki64
__p__commode
fgetc
_set_fmode
fclose
fflush
fputc
_get_stream_buffer_pointers
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
_set_new_mode
api-ms-win-crt-string-l1-1-0
wcsncpy_s
wcslen
strlen
tolower
towlower
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-runtime-l1-1-0
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_set_app_type
_initialize_onexit_table
terminate
_crt_atexit
_get_narrow_winmain_command_line
_initialize_narrow_environment
abort
_configure_narrow_argv
exit
_exit
_register_onexit_function
_seh_filter_exe
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35721,
count=10, id=260, version=35721,
count=31, id=261, version=35721,
count=6, id=257, version=35721,
count=8, id=257, version=33145,
count=5, id=257, version=35728,
count=187, id=1, productName=Unmarked objects,
count=1, id=265, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,