0217c576405a99b3eff88adfd899e7eab2e2530cb793b459f12b7b0446e14ce0[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
0217c576405a99b3eff88adfd899e7eab2e2530cb793b459f12b7b0446e14ce0.zip
Size 2.7MB
Sample260727-ralrratfmc
SHA256 2f26f6a5d86d65e0239b57c84f54db3ff3d605924bdcaf5a819e034e502ea9eb
MD5 7cf16719f0d751eeb9fbd0cff3a6ecec
SHA1 c068b4bd38d130091487f57ab3c941cb8f80d4f1
SHA512 d3755640dfc73960a640cf402d2036e8da524d6b33704254ec605f66c476d128efdcdf091b49ca381e28ae495786ff360ac58cc3267fc41a2d69f02c5c2e4266
SSDEEP 49152:mGyfny3At7vdispDC0ih53MYvCetPhmbQOY6sU9RinSGeRxwyX56uAdPyb7bpKEh:m7PoAx0kD/ih53Mv8PkblrsUPiSF+e5p
TLSH
T1ACD533A7E0AE1FC4650C907A8383F5967BC8B72DC3D2B772258BAD7147236F496C4498
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/0217c576405a99b3eff88adfd899e7eab2e2530cb793b459f12b7b0446e14ce0	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0217c576405a99b3eff88adfd899e7eab2e2530cb793b459f12b7b0446e14ce0

File Explorer

0217c576405a99b3eff88adfd899e7eab2e2530cb793b459f12b7b0446e14ce0.zip

.zip 2.7MB
0217c576405a99b3eff88adfd899e7eab2e2530cb793b459f12b7b0446e14ce0

.exe 6.5MB

0217c576405a99b3eff88adfd899e7eab2e2530cb793b459f12b7b0446e14ce0.zip

SHA256 2f26f6a5d86d65e0239b57c84f54db3ff3d605924bdcaf5a819e034e502ea9eb
MD5 7cf16719f0d751eeb9fbd0cff3a6ecec
SHA1 c068b4bd38d130091487f57ab3c941cb8f80d4f1
SHA512 d3755640dfc73960a640cf402d2036e8da524d6b33704254ec605f66c476d128efdcdf091b49ca381e28ae495786ff360ac58cc3267fc41a2d69f02c5c2e4266
SSDEEP 49152:mGyfny3At7vdispDC0ih53MYvCetPhmbQOY6sU9RinSGeRxwyX56uAdPyb7bpKEh:m7PoAx0kD/ih53Mv8PkblrsUPiSF+e5p
TLSH
T1ACD533A7E0AE1FC4650C907A8383F5967BC8B72DC3D2B772258BAD7147236F496C4498
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

0217c576405a99b3eff88adfd899e7eab2e2530cb793b459f12b7b0446e14ce0

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 0217c576405a99b3eff88adfd899e7eab2e2530cb793b459f12b7b0446e14ce0
MD5 02e9b604e9192680b90b819af6231c0d
SHA1 b21c7e7975aeec33c086d73dcf1e3b3cdcb4efeb
SHA512 bba1ee7a97fc99c0db2f52d908bb22bbe9d0476de62c559b1412ddb2a87dadd44147e8495c8090599e7f95e8b1440f9674432a36cfe46d595f24798a5bde11b0
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8l:T6BJUoROZfIA8Xf8xumvBh8huTEEm8
TLSH
T17A665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

0217c576405a99b3eff88adfd899e7eab2e2530cb793b459f12b7b0446e14ce0.zip

0217c576405a99b3eff88adfd899e7eab2e2530cb793b459f12b7b0446e14ce0

kernel32

generic