9dfc5f6a06f53692b2a8957ee8bd3be221287a74a0a5df82f755b39295fea49c[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
9dfc5f6a06f53692b2a8957ee8bd3be221287a74a0a5df82f755b39295fea49c.zip
Size 2.7MB
Sample260804-wf87fsef29
SHA256 c56d275f180ad29bac07736940b29456eed18bb16edd8919e0dbb38606fc2c18
MD5 c8ed2f71d4a5a8b6418b99bd7bf5ce06
SHA1 9e5c80ed442c1b313525d8d0652b3bf3c0ec99ab
SHA512 33e5dfa681bc67233acdcc2a4833a0b69956b6536834bd76243ca0e5a6541b9ea4b64f0849bf486fabed20acdc70e546077077eae33385782f88c7c3e9f21f1b
SSDEEP 49152:yBiexlov+Nug09cJYD7lDCj34DFzndvhPlMFR20JBQDdvczJFTY+:yox+Nug09cJy7NCj4DhzPlP0JmhmD
TLSH
T100D533527463337CE058D4A18DE596500FCCAF75FF386AAE89B7A1CCDC984172A9CA34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/9dfc5f6a06f53692b2a8957ee8bd3be221287a74a0a5df82f755b39295fea49c	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/9dfc5f6a06f53692b2a8957ee8bd3be221287a74a0a5df82f755b39295fea49c

File Explorer

9dfc5f6a06f53692b2a8957ee8bd3be221287a74a0a5df82f755b39295fea49c.zip

.zip 2.7MB
9dfc5f6a06f53692b2a8957ee8bd3be221287a74a0a5df82f755b39295fea49c

.exe 6.5MB

9dfc5f6a06f53692b2a8957ee8bd3be221287a74a0a5df82f755b39295fea49c.zip

SHA256 c56d275f180ad29bac07736940b29456eed18bb16edd8919e0dbb38606fc2c18
MD5 c8ed2f71d4a5a8b6418b99bd7bf5ce06
SHA1 9e5c80ed442c1b313525d8d0652b3bf3c0ec99ab
SHA512 33e5dfa681bc67233acdcc2a4833a0b69956b6536834bd76243ca0e5a6541b9ea4b64f0849bf486fabed20acdc70e546077077eae33385782f88c7c3e9f21f1b
SSDEEP 49152:yBiexlov+Nug09cJYD7lDCj34DFzndvhPlMFR20JBQDdvczJFTY+:yox+Nug09cJy7NCj4DhzPlP0JmhmD
TLSH
T100D533527463337CE058D4A18DE596500FCCAF75FF386AAE89B7A1CCDC984172A9CA34
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

9dfc5f6a06f53692b2a8957ee8bd3be221287a74a0a5df82f755b39295fea49c

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 9dfc5f6a06f53692b2a8957ee8bd3be221287a74a0a5df82f755b39295fea49c
MD5 17be6b57df3fbf6efc38e26157069d16
SHA1 a820fe942633673c00b341ca50fdb7305d21ae0f
SHA512 37ef2c9d28a661d3f964cc3bbb4784583ab402f1e14c6088d264d763689208a562b42f4eec551e8c08d2196cc762f96bb1dfd13cedb97c587c41306bb6d33669
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8I:T6BJUoROZfIA8Xf8xumvBh8huTEEmP
TLSH
T197665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

9dfc5f6a06f53692b2a8957ee8bd3be221287a74a0a5df82f755b39295fea49c.zip

9dfc5f6a06f53692b2a8957ee8bd3be221287a74a0a5df82f755b39295fea49c

kernel32

generic