8ea2edd9670bc0f9d70f98aa0e35a5ee5cf13bf9c6fdd229326f8cb9d1cd5aed[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
8ea2edd9670bc0f9d70f98aa0e35a5ee5cf13bf9c6fdd229326f8cb9d1cd5aed.zip
Size 2.7MB
Sample260710-wfd2bagv8x
SHA256 0b7532ffd9b01ec1d8524a77f9c67095bb52afdd048027bad5a66d5c85167c3c
MD5 f2eeb1fb4b1348340c5e24e99b07f1a4
SHA1 e56aee7ec814aa2ca1a3370b6bd595efa10e69f0
SHA512 a1e20e44a32582ce3516e99307b12b9fb11e100ec8c665b0cfa894b4d13f279c4e2528210df7860d7e70c0dd27ba5364c8b40a9589af30e8d0086b22035de031
SSDEEP 49152:aCAbApM5MPi5ZHAf2X5RQDCwml/q9YiP9/MdefE5+9qoIVMxZy1s:aCAbP5MaZHXpRQD8ly6iP9UOkzVMxZy+
TLSH
T1F9D53315E7D8988C4DF910B1EAC39562538F0E5143028F25A37B8B7EAC52B3E9127DDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/8ea2edd9670bc0f9d70f98aa0e35a5ee5cf13bf9c6fdd229326f8cb9d1cd5aed	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/8ea2edd9670bc0f9d70f98aa0e35a5ee5cf13bf9c6fdd229326f8cb9d1cd5aed

File Explorer

8ea2edd9670bc0f9d70f98aa0e35a5ee5cf13bf9c6fdd229326f8cb9d1cd5aed.zip

.zip 2.7MB
8ea2edd9670bc0f9d70f98aa0e35a5ee5cf13bf9c6fdd229326f8cb9d1cd5aed

.exe 6.5MB

8ea2edd9670bc0f9d70f98aa0e35a5ee5cf13bf9c6fdd229326f8cb9d1cd5aed.zip

SHA256 0b7532ffd9b01ec1d8524a77f9c67095bb52afdd048027bad5a66d5c85167c3c
MD5 f2eeb1fb4b1348340c5e24e99b07f1a4
SHA1 e56aee7ec814aa2ca1a3370b6bd595efa10e69f0
SHA512 a1e20e44a32582ce3516e99307b12b9fb11e100ec8c665b0cfa894b4d13f279c4e2528210df7860d7e70c0dd27ba5364c8b40a9589af30e8d0086b22035de031
SSDEEP 49152:aCAbApM5MPi5ZHAf2X5RQDCwml/q9YiP9/MdefE5+9qoIVMxZy1s:aCAbP5MaZHXpRQD8ly6iP9UOkzVMxZy+
TLSH
T1F9D53315E7D8988C4DF910B1EAC39562538F0E5143028F25A37B8B7EAC52B3E9127DDE
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

8ea2edd9670bc0f9d70f98aa0e35a5ee5cf13bf9c6fdd229326f8cb9d1cd5aed

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 8ea2edd9670bc0f9d70f98aa0e35a5ee5cf13bf9c6fdd229326f8cb9d1cd5aed
MD5 2665954a230289aac52a3ef194939dad
SHA1 3fbfb4f2607cd6bdf91b19246261cfa8ec0b68b8
SHA512 15c7498cab1a41f024464f5fbae5aa0d1b0224eb00ca0107bf0deef7b144b1c1ae922a07a889e96cbd0d8fc2f0856e154a90c65c3d8aae24359e5804b0deed9f
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f80:T6BJUoROZfIA8Xf8xumvBh8huTEEmz
TLSH
T117665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

8ea2edd9670bc0f9d70f98aa0e35a5ee5cf13bf9c6fdd229326f8cb9d1cd5aed.zip

8ea2edd9670bc0f9d70f98aa0e35a5ee5cf13bf9c6fdd229326f8cb9d1cd5aed

kernel32

generic