45bd861441f8c8da42d907bbc831b6a7d739d5da6c239a7815a8c9838e8181ad[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
45bd861441f8c8da42d907bbc831b6a7d739d5da6c239a7815a8c9838e8181ad.zip
Size 2.7MB
Sample260720-syn3fsew8p
SHA256 9916ff96df3da7d479be074246334b9fbdfeebc73cc013dbfdece605cb825260
MD5 749d4848383a50649e1358237f4dd4b0
SHA1 144eac2bca73e51be1de0cebbe2399714d25b729
SHA512 0a307c713f5a9e3992afe199e7108d0775709a10bcc3fa9281ab07cdcbce28eff739f78a5ce9ecf737118e37e95f53b664db26ec6e059e1375d67affea99c798
SSDEEP 49152:JPWuNaOFZ2QM16Fc7klIZNnTPMnaApdF7NZEuQCCiGmEpsQm7Lj6qpEuxjWnVwLx:JZoGt1cNNTUaAtxmqmmEpTm7LjvpVSG1
TLSH
T174D53326F0A60DB973856DE5707B22F88239E973A9F2E4C5C783753A1C432E5D534632
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/45bd861441f8c8da42d907bbc831b6a7d739d5da6c239a7815a8c9838e8181ad	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/45bd861441f8c8da42d907bbc831b6a7d739d5da6c239a7815a8c9838e8181ad

File Explorer

45bd861441f8c8da42d907bbc831b6a7d739d5da6c239a7815a8c9838e8181ad.zip

.zip 2.7MB
45bd861441f8c8da42d907bbc831b6a7d739d5da6c239a7815a8c9838e8181ad

.exe 6.5MB

45bd861441f8c8da42d907bbc831b6a7d739d5da6c239a7815a8c9838e8181ad.zip

SHA256 9916ff96df3da7d479be074246334b9fbdfeebc73cc013dbfdece605cb825260
MD5 749d4848383a50649e1358237f4dd4b0
SHA1 144eac2bca73e51be1de0cebbe2399714d25b729
SHA512 0a307c713f5a9e3992afe199e7108d0775709a10bcc3fa9281ab07cdcbce28eff739f78a5ce9ecf737118e37e95f53b664db26ec6e059e1375d67affea99c798
SSDEEP 49152:JPWuNaOFZ2QM16Fc7klIZNnTPMnaApdF7NZEuQCCiGmEpsQm7Lj6qpEuxjWnVwLx:JZoGt1cNNTUaAtxmqmmEpTm7LjvpVSG1
TLSH
T174D53326F0A60DB973856DE5707B22F88239E973A9F2E4C5C783753A1C432E5D534632
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

45bd861441f8c8da42d907bbc831b6a7d739d5da6c239a7815a8c9838e8181ad

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 45bd861441f8c8da42d907bbc831b6a7d739d5da6c239a7815a8c9838e8181ad
MD5 243a6f8fc9947c87953bec2aae1bd604
SHA1 61dc333078ef47bb4410ccdad625d9d9ac5021e0
SHA512 b8a5cd9c9fd6582adca4934349ded725dcc601a3e106264b60a86e886e287697bf24dfd037268eb2254b26603fea6020c80b4b300e109fbaa07f6038c1d16161
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8P:T6BJUoROZfIA8Xf8xumvBh8huTEEmu
TLSH
T10E665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

45bd861441f8c8da42d907bbc831b6a7d739d5da6c239a7815a8c9838e8181ad.zip

45bd861441f8c8da42d907bbc831b6a7d739d5da6c239a7815a8c9838e8181ad

kernel32

generic