Overview

overview

10

Static

static

10

50d24bf9b2...cc.exe

windows10-2004-x64

10

50d24bf9b2...cc.exe

windows11-ltsc_2024-x64

10

Resubmissions

17/07/2026, 03:35

260717-d5ed9sav2p10

06/07/2026, 08:09

260706-j16wlsfy3r7

Sharing

Copy URL Twitter E-mail

General

  • Target
    50d24bf9b26c3aaa840f4a1a6e2376837fe78d25c37c24eeaa2541bc9c11c1cc
  • Size 13.4MB
  • Sample260717-d5ed9sav2p
  • SHA256 50d24bf9b26c3aaa840f4a1a6e2376837fe78d25c37c24eeaa2541bc9c11c1cc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
pyinstallerstealertelegramsessionhijacker

Malware Config

Targets

    • Target
      50d24bf9b26c3aaa840f4a1a6e2376837fe78d25c37c24eeaa2541bc9c11c1cc
    • Size 13.4MB
    • SHA256 50d24bf9b26c3aaa840f4a1a6e2376837fe78d25c37c24eeaa2541bc9c11c1cc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    pyinstallertelegramsessionhijacker

    • Telegram session hijacker PyInstaller payload

      Detects the final PE payload that decrypts Telegram Desktop tdata, rebuilds Telethon sessions, transfers Stars, replaces cryptocurrency addresses, and sends messages in bulk.

      telegramsessionhijacker

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks