ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.zip
- SHA256 678e71b6e4b28a7d8845f760ff7d21157bb85dd58b3bc72c0bdf8bc7bf25b743
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.zip
- Size 798KB
- Sample260803-s567lsbf73
- SHA256 678e71b6e4b28a7d8845f760ff7d21157bb85dd58b3bc72c0bdf8bc7bf25b743
- MD5 0e7361eb044c6fbc7805dd558ebe8115
- SHA1 eeb125d125b1b6c658d9c82b47b0067a28634142
- SHA512 c76a047927ef9406c73bae457f4a10f0c1961c549121f035908edcad9bbe047d3c15810ff8872e477318f7d71590fdb0af71f8d9adf51661da2257e81aade790
- SSDEEP 24576:4zkWj2U4tG4xmn7BAbV0yCccE7/Tnm8KYoM:U2736lciBcx/TaYoM
- TLSH T1DC05234A7A92353D8C12D41AB7BBDD21CD5CFAF4304A8BD567D2F22581136E10EDA1D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705 suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705
File Explorer
-
ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.zip.zip 798KB
-
ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe 1.5MB
ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705
- IMPHASH 71f0ce4b4a611533f190a0019a98d5f6
- SHA256 ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705
- MD5 1cc9b59964c70bcd40515c2ea4472d07
- SHA1 f1f7d32c8538a5642d607633df94bcdc483dd5ee
- SHA512 47af4e3d9564f1ae412b19d76db40096ea545db20d1cb6ddea6a5c639557a0b23bbb6e4c691d0f0a44189e17f47e68fc1ceb3fafa1283793767810a22fc9d941
- SSDEEP 24576:goD4x3upiG+uD8wjTc6QZwFvzI8H6MvGmEfTQuFfTeUCI:goDsWihuDhTc6QZwFUG67mErQcq
- TLSH T13E757B43E69585EAC45EC0788357A632FA33B88E4630B6EF2BD45B313E66B905F0D705
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
ntdll
NtCreateNamedPipeFile
NtQueryInformationProcess
NtQuerySystemInformation
RtlGetVersion
NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
NtOpenFile
NtReadFile
NtWriteFile
RtlNtStatusToDosError
advapi32
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
CopySid
GetLengthSid
GetTokenInformation
IsValidSid
OpenProcessToken
SystemFunction036
kernel32
AddVectoredExceptionHandler
CompareStringOrdinal
CreateToolhelp32Snapshot
FormatMessageW
FreeEnvironmentStringsW
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
K32GetPerformanceInfo
Module32FirstW
Module32NextW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
ReadProcessMemory
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
lstrlenW
CancelIo
CloseHandle
CreateEventW
CreateFileMappingA
CreateFileW
CreateIoCompletionPort
CreateProcessW
CreateThread
CreateWaitableTimerExW
DuplicateHandle
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FreeLibrary
GetComputerNameExW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetLogicalDrives
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessIoCounters
GetProcessTimes
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimePreciseAsFileTime
GetSystemTimes
GetTempPathW
GetWindowsDirectoryW
GlobalMemoryStatusEx
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
LoadLibraryExA
LocalFree
MapViewOfFile
OpenProcess
PostQueuedCompletionStatus
ReadFile
ReadFileEx
SetFileCompletionNotificationModes
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetThreadStackGuarantee
SetWaitableTimer
Sleep
SleepEx
SwitchToThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnmapViewOfFile
VirtualQueryEx
WaitForMultipleObjects
WaitForSingleObject
WriteConsoleW
WriteFileEx
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwindEx
VirtualProtect
VirtualQuery
__C_specific_handler
ole32
CoTaskMemFree
oleaut32
GetErrorInfo
SysFreeString
SysStringLen
pdh
PdhAddEnglishCounterW
PdhCloseQuery
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhOpenQueryA
PdhRemoveCounter
powrprof
CallNtPowerInformation
psapi
GetModuleFileNameExW
GetProcessMemoryInfo
shell32
CommandLineToArgvW
SHGetKnownFolderPath
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
bcrypt
BCryptGenRandom
bcryptprimitives
ProcessPrng
crypt32
CertAddCertificateContextToStore
CertCloseStore
CertDuplicateCertificateChain
CertDuplicateCertificateContext
CertDuplicateStore
CertEnumCertificatesInStore
CertFreeCertificateChain
CertFreeCertificateContext
CertGetCertificateChain
CertOpenStore
CertVerifyCertificateChainPolicy
secur32
AcceptSecurityContext
AcquireCredentialsHandleA
ApplyControlToken
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextW
QueryContextAttributesW
ws2_32
WSACleanup
WSAGetLastError
WSAIoctl
WSASend
WSASocketW
WSAStartup
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
ioctlsocket
recv
send
setsockopt
shutdown
msvcrt
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_fpreset
_initterm
abort
atexit
calloc
exit
fprintf
free
malloc
memcmp
memcpy
memmove
memset
signal
strlen
strncmp
vfprintf
wcslen
Name
.text
Size
999KB
Virtual Size
998KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
465KB
Virtual Size
465KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ