be8a28b8daf564ddcb0e2b68dbf2f4ff6b81a6edc4685c08f91902a8faffc081.zip
- SHA256 13c3752aa654942c84115d2b6d2a25e0f4e16c124618d83b49e8ccbaa17c0ff2
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
be8a28b8daf564ddcb0e2b68dbf2f4ff6b81a6edc4685c08f91902a8faffc081.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
be8a28b8daf564ddcb0e2b68dbf2f4ff6b81a6edc4685c08f91902a8faffc081.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target be8a28b8daf564ddcb0e2b68dbf2f4ff6b81a6edc4685c08f91902a8faffc081.zip
- Size 8.5MB
- Sample260803-t867fscd22
- SHA256 13c3752aa654942c84115d2b6d2a25e0f4e16c124618d83b49e8ccbaa17c0ff2
- MD5 672ac19f307f3ce342d44d4bd8862a8a
- SHA1 b279bf84c9d914913d76675b93f9a2378d964819
- SHA512 ab5b4f5d41aa16bbdc923e85c1f156773f6724e441b62fee053fbe7bed8e0228b06ceec3f6c94587156bde259e0d815ce143fb85328f3f8fe2bf61f9ed6e70f4
- SSDEEP 196608:MJuPUCQFXnE6o7Eug5DOuysb9A2OmR0mwgv:MJcUC1EuOhyRS0mwk
- TLSH T1FD963339DB4DDC8682B44F12C1531AC7D6542FBA16AA1F7A496F50B0E8F530C0BB9B93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/be8a28b8daf564ddcb0e2b68dbf2f4ff6b81a6edc4685c08f91902a8faffc081 suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/be8a28b8daf564ddcb0e2b68dbf2f4ff6b81a6edc4685c08f91902a8faffc081
File Explorer
-
be8a28b8daf564ddcb0e2b68dbf2f4ff6b81a6edc4685c08f91902a8faffc081.zip.zip 8.5MB
-
be8a28b8daf564ddcb0e2b68dbf2f4ff6b81a6edc4685c08f91902a8faffc081.exe 21.7MB
be8a28b8daf564ddcb0e2b68dbf2f4ff6b81a6edc4685c08f91902a8faffc081
- IMPHASH 70c30f068e0ee1d4b32b9b2a7b027bd6
- SHA256 be8a28b8daf564ddcb0e2b68dbf2f4ff6b81a6edc4685c08f91902a8faffc081
- MD5 1e33167de6bfe332c2897fcba079f004
- SHA1 9f0a4a8e361bab1762e180765e3f80f3be270ca0
- SHA512 d03e86e4bb6c4011fa1cecd30dfdcc869b64c6687f800b2e63571a4b74a9465383c27b1d38c4a12ba05658bbfbebcf3231b6289362e45834cb0640f3c8868d5c
- SSDEEP 393216:uhQlDS1LyLgsGUZ37x+51CPwDv3uFh2U2lvz538KRvt77cL2p:4yDSlyQUtK
- TLSH T18E378C4173904066F976E27588170607F771BCA5671097C731ACF2A92F73BE22EBA6C8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
14240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shell32
SHFileOperationW
SHGetFolderPathW
CommandLineToArgvW
kernel32
FlsSetValue
WriteConsoleW
HeapReAlloc
CreateDirectoryW
SetConsoleCtrlHandler
AddDllDirectory
GetCommandLineW
GetFullPathNameW
GetStdHandle
WriteFile
GetShortPathNameW
TerminateProcess
GetModuleFileNameW
SetEnvironmentVariableW
K32GetModuleFileNameExW
GetEnvironmentVariableW
GetTempPathW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetModuleHandleA
OpenProcess
Sleep
GetLastError
CloseHandle
GetProcAddress
GetCurrentProcessId
CreateProcessW
WideCharToMultiByte
GetSystemTimeAsFileTime
FormatMessageA
QueryPerformanceCounter
SetDllDirectoryW
LoadLibraryExW
GetExitCodeProcess
GetCurrentThreadId
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
HeapSize
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCurrentProcess
ExitProcess
FreeLibrary
GetModuleHandleExW
IsProcessorFeaturePresent
GetCommandLineA
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
MultiByteToWideChar
HeapAlloc
HeapFree
VirtualProtect
LCMapStringW
GetFileType
GetStringTypeW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
Name
.text
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21.6MB
Virtual Size
21.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=148, id=261, version=33145,
count=12, id=260, version=33145,
count=6, id=259, version=33145,
count=2, id=253, version=35403,
count=9, id=259, version=35403,
count=16, id=260, version=35403,
count=39, id=261, version=35403,
count=5, id=257, version=33145,
count=115, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=1, id=264, version=35730,
count=1, id=258, version=35730,