96ed8923a5c682d2064b8bf403700d9bd9455665b94afd9779c957495f4f43e9[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
96ed8923a5c682d2064b8bf403700d9bd9455665b94afd9779c957495f4f43e9.zip
Size 2.7MB
Sample260714-ps3rwacz4p
SHA256 d26178380d2fdac54dee08fae6e6b43f763261bdeb8f1e5269b08a9261a4c573
MD5 ca6d178f28672fa9b5a8d319a2b36086
SHA1 8bba7d657a0f067554c11e10a608627720341e85
SHA512 9816734867275855fbdc75bc5d992e3ccf92b70dfb6e2f784ca5a51ff6b50396def6df164dbd0ca5c5dfe62ff0fa57c842981ca6d2a91488913612e7216265c1
SSDEEP 49152:L737TAZIG8UQvZurVf52iH873HNecvq5mwgkT7Bwvap/NPQ6HTJItZwePtevG:LPT+HBqqxc6Y3tecvMmJC7BwvaZxZCws
TLSH
T190D53324D325CA988DD76357AF29226EB744AFEE3334D77DE122E66377E218C050B118
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/96ed8923a5c682d2064b8bf403700d9bd9455665b94afd9779c957495f4f43e9	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/96ed8923a5c682d2064b8bf403700d9bd9455665b94afd9779c957495f4f43e9

File Explorer

96ed8923a5c682d2064b8bf403700d9bd9455665b94afd9779c957495f4f43e9.zip

.zip 2.7MB
96ed8923a5c682d2064b8bf403700d9bd9455665b94afd9779c957495f4f43e9

.exe 6.5MB

96ed8923a5c682d2064b8bf403700d9bd9455665b94afd9779c957495f4f43e9.zip

SHA256 d26178380d2fdac54dee08fae6e6b43f763261bdeb8f1e5269b08a9261a4c573
MD5 ca6d178f28672fa9b5a8d319a2b36086
SHA1 8bba7d657a0f067554c11e10a608627720341e85
SHA512 9816734867275855fbdc75bc5d992e3ccf92b70dfb6e2f784ca5a51ff6b50396def6df164dbd0ca5c5dfe62ff0fa57c842981ca6d2a91488913612e7216265c1
SSDEEP 49152:L737TAZIG8UQvZurVf52iH873HNecvq5mwgkT7Bwvap/NPQ6HTJItZwePtevG:LPT+HBqqxc6Y3tecvMmJC7BwvaZxZCws
TLSH
T190D53324D325CA988DD76357AF29226EB744AFEE3334D77DE122E66377E218C050B118
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

96ed8923a5c682d2064b8bf403700d9bd9455665b94afd9779c957495f4f43e9

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 96ed8923a5c682d2064b8bf403700d9bd9455665b94afd9779c957495f4f43e9
MD5 14279cbf12f4cacdfb4b1f2b6a493dfd
SHA1 56aa43124ac5a74ce12911fe552e79529c32c409
SHA512 9b7e7981601ccec236d90b84373b7b6e414bcdbb0f942363a48303c625d9ea68981d5950b2c64f8de374ae6262c43d246ef9ba1b71bcae723b43b2e5efb56180
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8q:T6BJUoROZfIA8Xf8xumvBh8huTEEm1P
TLSH
T1BA665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

96ed8923a5c682d2064b8bf403700d9bd9455665b94afd9779c957495f4f43e9.zip

96ed8923a5c682d2064b8bf403700d9bd9455665b94afd9779c957495f4f43e9

kernel32

generic