fb51e4b6f7628844c9d6fd37e0a38178cf10dbe77fe351c6af5110fbc0b9ddc7[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
fb51e4b6f7628844c9d6fd37e0a38178cf10dbe77fe351c6af5110fbc0b9ddc7.zip
Size 2.7MB
Sample260729-tle5fsbb68
SHA256 c798a3024a60a6c1535acb207de7aaaf20b68686b7ebcd08505624d684753319
MD5 3b7306e16841bc9053e0a2fdb9837b0c
SHA1 61c4b87a27d7daab12ce5bb6e9d2f16c4e319f09
SHA512 6e72aceea9d1953f4640eb5ad95b2b596ab81b608c21cb5d943f0c9aa0a9a2a2e8129003d12c98824425417abfdfd5476bfcd661253c7db2e55c9493bb543e75
SSDEEP 49152:yu7cIJnh6cY+ANJVlWTbE21uXR8Kn9CTqKsN6M4Yj9hezUVtCKIHldA/vK:j7NJnYcYxNZjHXq1TWAQ9TVtCKInAq
TLSH
T130D533B5EA72D0F7D0ACBF645145DDB31628496E053850E9E3718A14F8E83D23EA3E6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/fb51e4b6f7628844c9d6fd37e0a38178cf10dbe77fe351c6af5110fbc0b9ddc7	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fb51e4b6f7628844c9d6fd37e0a38178cf10dbe77fe351c6af5110fbc0b9ddc7

File Explorer

fb51e4b6f7628844c9d6fd37e0a38178cf10dbe77fe351c6af5110fbc0b9ddc7.zip

.zip 2.7MB
fb51e4b6f7628844c9d6fd37e0a38178cf10dbe77fe351c6af5110fbc0b9ddc7

.exe 6.5MB

fb51e4b6f7628844c9d6fd37e0a38178cf10dbe77fe351c6af5110fbc0b9ddc7.zip

SHA256 c798a3024a60a6c1535acb207de7aaaf20b68686b7ebcd08505624d684753319
MD5 3b7306e16841bc9053e0a2fdb9837b0c
SHA1 61c4b87a27d7daab12ce5bb6e9d2f16c4e319f09
SHA512 6e72aceea9d1953f4640eb5ad95b2b596ab81b608c21cb5d943f0c9aa0a9a2a2e8129003d12c98824425417abfdfd5476bfcd661253c7db2e55c9493bb543e75
SSDEEP 49152:yu7cIJnh6cY+ANJVlWTbE21uXR8Kn9CTqKsN6M4Yj9hezUVtCKIHldA/vK:j7NJnYcYxNZjHXq1TWAQ9TVtCKInAq
TLSH
T130D533B5EA72D0F7D0ACBF645145DDB31628496E053850E9E3718A14F8E83D23EA3E6C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

fb51e4b6f7628844c9d6fd37e0a38178cf10dbe77fe351c6af5110fbc0b9ddc7

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 fb51e4b6f7628844c9d6fd37e0a38178cf10dbe77fe351c6af5110fbc0b9ddc7
MD5 07b92e1376f40294ab4369bd2a682d9a
SHA1 c9ed02854bf8db09c4b763fd37b841471d3353ee
SHA512 7cee1c36b03479ae6ba1705e82d394ba68a75017fbdd13b5561f56c02898a853c16bcd44e6ede168192d1b27cb6be11b81c613e0a3f18d1bfcf09a13fe01c94c
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8C:T6BJUoROZfIA8Xf8xumvBh8huTEEmH
TLSH
T1B4665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

fb51e4b6f7628844c9d6fd37e0a38178cf10dbe77fe351c6af5110fbc0b9ddc7.zip

fb51e4b6f7628844c9d6fd37e0a38178cf10dbe77fe351c6af5110fbc0b9ddc7

kernel32

generic