7051c71b5d3a9147c9491898c8184317170a08aaa213f2484ba22e17a5fa3d88[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
7051c71b5d3a9147c9491898c8184317170a08aaa213f2484ba22e17a5fa3d88.zip
Size 2.7MB
Sample260727-rabxjsbc96
SHA256 b1d01f06316e4fda319683b5a9bfaf9193eb27114267928592f110a270703ae8
MD5 247b1359720d63455ebe39f9ab60e8cd
SHA1 2d1f4f4505c0b839e566efe1cf2e84a8270c5d9e
SHA512 644c05e888a27c413b8d4deb8eedccede5296d2dfd584ae4a87209a9df7442388b5fc65eda7e1481df10a61106f4ef670b0023daaf048353471fa58413a297e5
SSDEEP 49152:v+wpf/ItuPlN8aMhAgsJ7fOTdyBR+J46WXYx5Cs19eIeC5VG90HffpRiMfy4/u:WwR9PpUAgsJDOTFJEX4vex+GKHffHPu
TLSH
T13BD53326C7612170CEA998CA36EDEA590E3B9C824D30CEDCAEFDF5D29315DDEB010546
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/7051c71b5d3a9147c9491898c8184317170a08aaa213f2484ba22e17a5fa3d88	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/7051c71b5d3a9147c9491898c8184317170a08aaa213f2484ba22e17a5fa3d88

File Explorer

7051c71b5d3a9147c9491898c8184317170a08aaa213f2484ba22e17a5fa3d88.zip

.zip 2.7MB
7051c71b5d3a9147c9491898c8184317170a08aaa213f2484ba22e17a5fa3d88

.exe 6.5MB

7051c71b5d3a9147c9491898c8184317170a08aaa213f2484ba22e17a5fa3d88.zip

SHA256 b1d01f06316e4fda319683b5a9bfaf9193eb27114267928592f110a270703ae8
MD5 247b1359720d63455ebe39f9ab60e8cd
SHA1 2d1f4f4505c0b839e566efe1cf2e84a8270c5d9e
SHA512 644c05e888a27c413b8d4deb8eedccede5296d2dfd584ae4a87209a9df7442388b5fc65eda7e1481df10a61106f4ef670b0023daaf048353471fa58413a297e5
SSDEEP 49152:v+wpf/ItuPlN8aMhAgsJ7fOTdyBR+J46WXYx5Cs19eIeC5VG90HffpRiMfy4/u:WwR9PpUAgsJDOTFJEX4vex+GKHffHPu
TLSH
T13BD53326C7612170CEA998CA36EDEA590E3B9C824D30CEDCAEFDF5D29315DDEB010546
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

7051c71b5d3a9147c9491898c8184317170a08aaa213f2484ba22e17a5fa3d88

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 7051c71b5d3a9147c9491898c8184317170a08aaa213f2484ba22e17a5fa3d88
MD5 053925a93a6b001ce6449ce3701ed780
SHA1 268430072484529b2d5662b62a4631a14b1e6831
SHA512 73c783ff6e42e7aa33ccdedbab700aaff4a1210d9383728e0879f92b4d7868c0e558fcf50b563e8a70f97aad81506c67bbdd052d66bf15948e3961d12c5e9dda
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8r:T6BJUoROZfIA8Xf8xumvBh8huTEEmu
TLSH
T1F4665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

7051c71b5d3a9147c9491898c8184317170a08aaa213f2484ba22e17a5fa3d88.zip

7051c71b5d3a9147c9491898c8184317170a08aaa213f2484ba22e17a5fa3d88

kernel32

generic