71c28b552ebeb08555263694e5d82df0eb896278f464c3d0a193a0d19e2aa10c[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
71c28b552ebeb08555263694e5d82df0eb896278f464c3d0a193a0d19e2aa10c.zip
Size 2.7MB
Sample260719-qpyt7aew2w
SHA256 5e988b424d2127dbf4aaaa79ac3247b8851d76fe553425ccda547ebae39e3933
MD5 f7f19d075ab15b8900284de77866d211
SHA1 d2ab0205ff0e0e0b3f4073f36f36dd367d8dd52e
SHA512 3a59da67197bc68753cebce0183eda6f107f6d6655792d40de038d61e5397fde98e3ba432f0a293d98943b5815063da42d9443a52535495f13093ac3a293169e
SSDEEP 49152:BSBUoPeLRwqyQCqKIxsTJMDGw2Gm8eoPEcvW4HU3dACTVM2llMg0SWrWv11+TtIE:BPfRPPSsyJMDGq5vP03vpFlZWrWv11aN
TLSH
T198D533D91F3AACF1021B0521982F2A5FECB9AB2A35FD4AF3B17504FA549B34444F19B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/71c28b552ebeb08555263694e5d82df0eb896278f464c3d0a193a0d19e2aa10c	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/71c28b552ebeb08555263694e5d82df0eb896278f464c3d0a193a0d19e2aa10c

File Explorer

71c28b552ebeb08555263694e5d82df0eb896278f464c3d0a193a0d19e2aa10c.zip

.zip 2.7MB
71c28b552ebeb08555263694e5d82df0eb896278f464c3d0a193a0d19e2aa10c

.exe 6.5MB

71c28b552ebeb08555263694e5d82df0eb896278f464c3d0a193a0d19e2aa10c.zip

SHA256 5e988b424d2127dbf4aaaa79ac3247b8851d76fe553425ccda547ebae39e3933
MD5 f7f19d075ab15b8900284de77866d211
SHA1 d2ab0205ff0e0e0b3f4073f36f36dd367d8dd52e
SHA512 3a59da67197bc68753cebce0183eda6f107f6d6655792d40de038d61e5397fde98e3ba432f0a293d98943b5815063da42d9443a52535495f13093ac3a293169e
SSDEEP 49152:BSBUoPeLRwqyQCqKIxsTJMDGw2Gm8eoPEcvW4HU3dACTVM2llMg0SWrWv11+TtIE:BPfRPPSsyJMDGq5vP03vpFlZWrWv11aN
TLSH
T198D533D91F3AACF1021B0521982F2A5FECB9AB2A35FD4AF3B17504FA549B34444F19B4
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

71c28b552ebeb08555263694e5d82df0eb896278f464c3d0a193a0d19e2aa10c

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 71c28b552ebeb08555263694e5d82df0eb896278f464c3d0a193a0d19e2aa10c
MD5 0162dbca06b45eca21ed4f2f8d8160e4
SHA1 1794f0420cce368248775f05c8eb9b8faa4e9645
SHA512 87b2db2f8357ea64e37f0199b7a1405175380d98c860b6c97a067376d6d9b8eb6ab6dec5de4f66ad781cdbdaf490054bd065d21242b162e716a4fedcefcfccb3
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f82:T6BJUoROZfIA8Xf8xumvBh8huTEEmh
TLSH
T17F665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

71c28b552ebeb08555263694e5d82df0eb896278f464c3d0a193a0d19e2aa10c.zip

71c28b552ebeb08555263694e5d82df0eb896278f464c3d0a193a0d19e2aa10c

kernel32

generic