f52c6fc339e0f0dc796f3ec827f0de57d69702e7c9ab649f3e8f89d943bccc16[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
f52c6fc339e0f0dc796f3ec827f0de57d69702e7c9ab649f3e8f89d943bccc16.zip
Size 2.7MB
Sample260807-tp6fta11ft
SHA256 505df15b80fe4918cceb35a1284f37219723f7da57f6223b8f8560915597d57b
MD5 214fa65fe10f5fa3ad2703c6e6d5f768
SHA1 c29baf7c02f011926f5243094a4ce533f33a7802
SHA512 fd9c889cf93ea48cd96e63508c345651a7743ca6db1fd35c0e51fb33a03b7b80b61a3e058d43e08dfe486645add00d8c49d66f0f7064bf230e2c0fc994a2c8b9
SSDEEP 49152:EyApjr5U4nFCHKCuDLenzW48a15IclEBVf3a0qMAXSz67/LTksYFithHAodUdyMQ:EyApj/0qDKzxwclEfa0qMAXSGzTQQthf
TLSH
T19FD533945B37DB6EA4F24D48E9FE5A305D3A70DA18CDDAE0259F3084821E7FF4089AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/f52c6fc339e0f0dc796f3ec827f0de57d69702e7c9ab649f3e8f89d943bccc16	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f52c6fc339e0f0dc796f3ec827f0de57d69702e7c9ab649f3e8f89d943bccc16

File Explorer

f52c6fc339e0f0dc796f3ec827f0de57d69702e7c9ab649f3e8f89d943bccc16.zip

.zip 2.7MB
f52c6fc339e0f0dc796f3ec827f0de57d69702e7c9ab649f3e8f89d943bccc16

.exe 6.5MB

f52c6fc339e0f0dc796f3ec827f0de57d69702e7c9ab649f3e8f89d943bccc16.zip

SHA256 505df15b80fe4918cceb35a1284f37219723f7da57f6223b8f8560915597d57b
MD5 214fa65fe10f5fa3ad2703c6e6d5f768
SHA1 c29baf7c02f011926f5243094a4ce533f33a7802
SHA512 fd9c889cf93ea48cd96e63508c345651a7743ca6db1fd35c0e51fb33a03b7b80b61a3e058d43e08dfe486645add00d8c49d66f0f7064bf230e2c0fc994a2c8b9
SSDEEP 49152:EyApjr5U4nFCHKCuDLenzW48a15IclEBVf3a0qMAXSz67/LTksYFithHAodUdyMQ:EyApj/0qDKzxwclEfa0qMAXSGzTQQthf
TLSH
T19FD533945B37DB6EA4F24D48E9FE5A305D3A70DA18CDDAE0259F3084821E7FF4089AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

f52c6fc339e0f0dc796f3ec827f0de57d69702e7c9ab649f3e8f89d943bccc16

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 f52c6fc339e0f0dc796f3ec827f0de57d69702e7c9ab649f3e8f89d943bccc16
MD5 16b9c9a69b4f57bd9eeb706c2f549aa9
SHA1 8a99fe885df03edc1dd9340e13c947628abf1f56
SHA512 b47432e3bdbeb773a291d5a94501f867d14d45051902655f7782f4e512db7f61b5b233f545f5e57add283601e929044a1bf77cfd1ec5666da880f29b44d45035
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8L:T6BJUoROZfIA8Xf8xumvBh8huTEEmy
TLSH
T12C665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

f52c6fc339e0f0dc796f3ec827f0de57d69702e7c9ab649f3e8f89d943bccc16.zip

f52c6fc339e0f0dc796f3ec827f0de57d69702e7c9ab649f3e8f89d943bccc16

kernel32

generic