fd889b237d65be29826fb628dd8ded6bf43c661440a63f47997453657361b548[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
fd889b237d65be29826fb628dd8ded6bf43c661440a63f47997453657361b548.zip
Size 2.7MB
Sample260805-wlsfwsdk8s
SHA256 d1c8203d77ad962763b8dc17625d19884dd18361ccb53c93dab47d02d6203489
MD5 777a03e7a1804f3aa0915b125381f5d5
SHA1 ba9ad41d20a0e987676477a21f1017b35309d0db
SHA512 6e1b139ce4ce9ca80ff086df1f58d95d26945186bca0e382355723313507d319e51fe8ff138767b7b26b37d5672fe1b28b2b5779a0a3e6293884fb0ab7184367
SSDEEP 49152:341kg9lJ1ywRE7n1m29TJ64M6y59XPjgXaCZefZAHqrYJwX3QdAbXEXb2:341kqlJ1ywET8/PzwXakwaJwX3Q8Xwb2
TLSH
T11DD5337F16A1032F2BBB807655719BE86C4DE80DD50807FF88F8DAA63B4D1F615AD418
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/fd889b237d65be29826fb628dd8ded6bf43c661440a63f47997453657361b548	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fd889b237d65be29826fb628dd8ded6bf43c661440a63f47997453657361b548

File Explorer

fd889b237d65be29826fb628dd8ded6bf43c661440a63f47997453657361b548.zip

.zip 2.7MB
fd889b237d65be29826fb628dd8ded6bf43c661440a63f47997453657361b548

.exe 6.5MB

fd889b237d65be29826fb628dd8ded6bf43c661440a63f47997453657361b548.zip

SHA256 d1c8203d77ad962763b8dc17625d19884dd18361ccb53c93dab47d02d6203489
MD5 777a03e7a1804f3aa0915b125381f5d5
SHA1 ba9ad41d20a0e987676477a21f1017b35309d0db
SHA512 6e1b139ce4ce9ca80ff086df1f58d95d26945186bca0e382355723313507d319e51fe8ff138767b7b26b37d5672fe1b28b2b5779a0a3e6293884fb0ab7184367
SSDEEP 49152:341kg9lJ1ywRE7n1m29TJ64M6y59XPjgXaCZefZAHqrYJwX3QdAbXEXb2:341kqlJ1ywET8/PzwXakwaJwX3Q8Xwb2
TLSH
T11DD5337F16A1032F2BBB807655719BE86C4DE80DD50807FF88F8DAA63B4D1F615AD418
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

fd889b237d65be29826fb628dd8ded6bf43c661440a63f47997453657361b548

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 fd889b237d65be29826fb628dd8ded6bf43c661440a63f47997453657361b548
MD5 2fff88bbb5942641f4d7750a5b2e717a
SHA1 22f7c8e0ea14d2a3b2949f892221b4c331325940
SHA512 b6aab474f2d13112611db770236e45994f6f3c450d2a6c29758dbeb7f7e8f87b1a94d6c9861395a495958f16ea8cbd2aca3c5b930b9d162b549acf1b12055a57
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8V:T6BJUoROZfIA8Xf8xumvBh8huTEEm11Y
TLSH
T130665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

fd889b237d65be29826fb628dd8ded6bf43c661440a63f47997453657361b548.zip

fd889b237d65be29826fb628dd8ded6bf43c661440a63f47997453657361b548

kernel32

generic