0f22b1cb6983bc4477e8dd0fdc8f33cd9af55f827c13a9a29761cd745c456c13[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
0f22b1cb6983bc4477e8dd0fdc8f33cd9af55f827c13a9a29761cd745c456c13.zip
Size 2.7MB
Sample260723-rs1cvsbd92
SHA256 cfed17601561a432f46c76421809f9c744cdc23d086cb59be6fdb2d879e9d101
MD5 f23f4ec8619c170c528a2a57abd5a24c
SHA1 e960427a21d73975e9604579975a51ec8573afcc
SHA512 b08ee5eb534dbab897c70d70be1f954915646b73e67894fabe0434a8ca5bb89f6b04f2eddc9fb7c0c2aee9bdc44fed45bc9ee99d1d176b857f89e31906f43901
SSDEEP 49152:lxvYgi7Hk7n2VSYbgcfC/9MdElTvAuO6O0Fx0XBf+zl4L3dLRYkEAODs:ni7H22V5bgT9vWuOmLWJGkEAOI
TLSH
T13BD533D559CD6AE2B841B984F6BC0C21CD586BEDF3F29022A22C5F9856C7CB4CC84D57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/0f22b1cb6983bc4477e8dd0fdc8f33cd9af55f827c13a9a29761cd745c456c13	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0f22b1cb6983bc4477e8dd0fdc8f33cd9af55f827c13a9a29761cd745c456c13

File Explorer

0f22b1cb6983bc4477e8dd0fdc8f33cd9af55f827c13a9a29761cd745c456c13.zip

.zip 2.7MB
0f22b1cb6983bc4477e8dd0fdc8f33cd9af55f827c13a9a29761cd745c456c13

.exe 6.5MB

0f22b1cb6983bc4477e8dd0fdc8f33cd9af55f827c13a9a29761cd745c456c13.zip

SHA256 cfed17601561a432f46c76421809f9c744cdc23d086cb59be6fdb2d879e9d101
MD5 f23f4ec8619c170c528a2a57abd5a24c
SHA1 e960427a21d73975e9604579975a51ec8573afcc
SHA512 b08ee5eb534dbab897c70d70be1f954915646b73e67894fabe0434a8ca5bb89f6b04f2eddc9fb7c0c2aee9bdc44fed45bc9ee99d1d176b857f89e31906f43901
SSDEEP 49152:lxvYgi7Hk7n2VSYbgcfC/9MdElTvAuO6O0Fx0XBf+zl4L3dLRYkEAODs:ni7H22V5bgT9vWuOmLWJGkEAOI
TLSH
T13BD533D559CD6AE2B841B984F6BC0C21CD586BEDF3F29022A22C5F9856C7CB4CC84D57
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

0f22b1cb6983bc4477e8dd0fdc8f33cd9af55f827c13a9a29761cd745c456c13

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 0f22b1cb6983bc4477e8dd0fdc8f33cd9af55f827c13a9a29761cd745c456c13
MD5 3271be154798968e92e0ce3963fcf294
SHA1 9636ae3e31f603c99c578ebd216e4b706f9ecac6
SHA512 5feaada928407b44cf1601b20952214ce1f4abfdfd2af7cc745f7c24865f08aae57d61bb1e830280b30be7a4a6f4d2cafd4f12d18117c8d92007b6b8ebcdc517
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8U:T6BJUoROZfIA8Xf8xumvBh8huTEEmP
TLSH
T156665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

0f22b1cb6983bc4477e8dd0fdc8f33cd9af55f827c13a9a29761cd745c456c13.zip

0f22b1cb6983bc4477e8dd0fdc8f33cd9af55f827c13a9a29761cd745c456c13

kernel32

generic