33804043dde436e9934caf659b3e77c49661385274132fd7611d39d57228c907[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
33804043dde436e9934caf659b3e77c49661385274132fd7611d39d57228c907.zip
Size 2.7MB
Sample260803-wcb3jsdb37
SHA256 5a4151b03a1cc65bc423bdc31bc093529e3488b0a159289915796b67611b95a3
MD5 2e4f9c95703f92e8ec57fb4ddc0e6a7b
SHA1 9b1c2ed7be3db97e70f710bed54fab8752c366c6
SHA512 1d42b7b6b3531f5a37841c595604ff9fbcfc49d0c22a07e4ac2530c11671af67a9decfe4531a8dc6d9fd0e6a4c67f6597e83a3ebf5d2fb751fbe29254de4e0ac
SSDEEP 49152:awkA1rYoVvr3MnxnhwHl7fPZZ7fWpn+aJYSulHC9XG8vlN75NCZbRpABMRD+JJC:U4rY0yjkZZLWpn+aSSulHsG8vlN756Rp
TLSH
T121D533BB689CC9A02D7560977601E16447B93FCDA3899F521F243E9C1978FEF8E0252C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/33804043dde436e9934caf659b3e77c49661385274132fd7611d39d57228c907	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/33804043dde436e9934caf659b3e77c49661385274132fd7611d39d57228c907

File Explorer

33804043dde436e9934caf659b3e77c49661385274132fd7611d39d57228c907.zip

.zip 2.7MB
33804043dde436e9934caf659b3e77c49661385274132fd7611d39d57228c907

.exe 6.5MB

33804043dde436e9934caf659b3e77c49661385274132fd7611d39d57228c907.zip

SHA256 5a4151b03a1cc65bc423bdc31bc093529e3488b0a159289915796b67611b95a3
MD5 2e4f9c95703f92e8ec57fb4ddc0e6a7b
SHA1 9b1c2ed7be3db97e70f710bed54fab8752c366c6
SHA512 1d42b7b6b3531f5a37841c595604ff9fbcfc49d0c22a07e4ac2530c11671af67a9decfe4531a8dc6d9fd0e6a4c67f6597e83a3ebf5d2fb751fbe29254de4e0ac
SSDEEP 49152:awkA1rYoVvr3MnxnhwHl7fPZZ7fWpn+aJYSulHC9XG8vlN75NCZbRpABMRD+JJC:U4rY0yjkZZLWpn+aSSulHsG8vlN756Rp
TLSH
T121D533BB689CC9A02D7560977601E16447B93FCDA3899F521F243E9C1978FEF8E0252C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

33804043dde436e9934caf659b3e77c49661385274132fd7611d39d57228c907

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 33804043dde436e9934caf659b3e77c49661385274132fd7611d39d57228c907
MD5 1ca4b21289a8dceb5fa7e1ac637da78b
SHA1 d9a30beb1db7c7cc48057737ab40630f7b570650
SHA512 2d79001983534125dd7e654ee524ec6cd8a2c60fd32e01096a8cbc7aebf6db36ad449144844eb913cf5816b08db29cc0c6e5a8374cf474fa0c7a7cc2b537b53f
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8D:T6BJUoROZfIA8Xf8xumvBh8huTEEm4
TLSH
T18C665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

33804043dde436e9934caf659b3e77c49661385274132fd7611d39d57228c907.zip

33804043dde436e9934caf659b3e77c49661385274132fd7611d39d57228c907

kernel32

generic