1b21fe0eed5eade492c27cd6567e10e87809c654d348d90295c492a5a86f49a3[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
1b21fe0eed5eade492c27cd6567e10e87809c654d348d90295c492a5a86f49a3.zip
Size 2.7MB
Sample260727-rahp4abc97
SHA256 40b2b42be44d0d90e48f2bfadee6352bd91969621075be6f16c415991dc9c57e
MD5 e7ff015ff04bb0f5c1f3a02d18fb4930
SHA1 e82cdc8238cb5b3df9c550bbf3673e93ac8cb678
SHA512 c81168d9cea2d95aa0fc75cb4c5e5ef233c5ca54e11d7e5575509693294e107b6b8cc3c9ea92e593937bcc09c06b4a84a30909470835ea9fc44371b7ba285e2e
SSDEEP 49152:DxXhcmw0bFm9gNsDnWdqlDHQ9xBbTvKvFqfRvH1TI3l7EApR5DgqDbSivO4LaMmm:DTe2FImMDHQLmv69hIV7R5s3kJmm
TLSH
T163D533953DBDC0A529B02D0E9D49E098B6EE74F331E7B5C89AF58F0AB99010CED43D85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/1b21fe0eed5eade492c27cd6567e10e87809c654d348d90295c492a5a86f49a3	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1b21fe0eed5eade492c27cd6567e10e87809c654d348d90295c492a5a86f49a3

File Explorer

1b21fe0eed5eade492c27cd6567e10e87809c654d348d90295c492a5a86f49a3.zip

.zip 2.7MB
1b21fe0eed5eade492c27cd6567e10e87809c654d348d90295c492a5a86f49a3

.exe 6.5MB

1b21fe0eed5eade492c27cd6567e10e87809c654d348d90295c492a5a86f49a3.zip

SHA256 40b2b42be44d0d90e48f2bfadee6352bd91969621075be6f16c415991dc9c57e
MD5 e7ff015ff04bb0f5c1f3a02d18fb4930
SHA1 e82cdc8238cb5b3df9c550bbf3673e93ac8cb678
SHA512 c81168d9cea2d95aa0fc75cb4c5e5ef233c5ca54e11d7e5575509693294e107b6b8cc3c9ea92e593937bcc09c06b4a84a30909470835ea9fc44371b7ba285e2e
SSDEEP 49152:DxXhcmw0bFm9gNsDnWdqlDHQ9xBbTvKvFqfRvH1TI3l7EApR5DgqDbSivO4LaMmm:DTe2FImMDHQLmv69hIV7R5s3kJmm
TLSH
T163D533953DBDC0A529B02D0E9D49E098B6EE74F331E7B5C89AF58F0AB99010CED43D85
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

1b21fe0eed5eade492c27cd6567e10e87809c654d348d90295c492a5a86f49a3

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 1b21fe0eed5eade492c27cd6567e10e87809c654d348d90295c492a5a86f49a3
MD5 24e8e731b246128e4f7ab4e48f17cc0d
SHA1 229a9d46e1a4eb4e953cb1077a5d69c81943573d
SHA512 2faef5c2c556f09f7256dba8657a2b012c2aa33b17e733cda7287ff062a455a6af1c86b15e49ef7a13ef06402481ca392b1e01842b10ff9335ee0748ed395f5f
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8K:T6BJUoROZfIA8Xf8xumvBh8huTEEmj
TLSH
T1E1665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

1b21fe0eed5eade492c27cd6567e10e87809c654d348d90295c492a5a86f49a3.zip

1b21fe0eed5eade492c27cd6567e10e87809c654d348d90295c492a5a86f49a3

kernel32

generic