1692e2f084f2db8d0ecfe576c929ad00471f6b8f5061f104914ff916fdf94ef3[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
1692e2f084f2db8d0ecfe576c929ad00471f6b8f5061f104914ff916fdf94ef3.zip
Size 2.7MB
Sample260807-tphprazane
SHA256 4b004e00452654676eb3d958bf3528f33012b1c404db2398292eba10686efc30
MD5 908e551c58961e05530133964e62056b
SHA1 ef1de1f58c0dc219d318a2242e81ff1000523e2d
SHA512 0fdaaf1cdd7f3e94c11a9ec1a86ff1fa2630c5fd36c156f1c918a55273783b3b51283474b9dd47ce9543dfc2500860f1e765ccd3d9c824e4109bfe0f137f82ca
SSDEEP 49152:dOlYT+torIsYTOGOhuKTQIWgDO/r4SuFcwj97GvIsTOmAcNtyJs:klY3zVuKTgl4FcwZyvIm39
TLSH
T1A9D5337422E9CDDFB9C290BD77AB0FAEE11492D7617D1C8C95B122E1D346FD182090AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/1692e2f084f2db8d0ecfe576c929ad00471f6b8f5061f104914ff916fdf94ef3	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1692e2f084f2db8d0ecfe576c929ad00471f6b8f5061f104914ff916fdf94ef3

File Explorer

1692e2f084f2db8d0ecfe576c929ad00471f6b8f5061f104914ff916fdf94ef3.zip

.zip 2.7MB
1692e2f084f2db8d0ecfe576c929ad00471f6b8f5061f104914ff916fdf94ef3

.exe 6.5MB

1692e2f084f2db8d0ecfe576c929ad00471f6b8f5061f104914ff916fdf94ef3.zip

SHA256 4b004e00452654676eb3d958bf3528f33012b1c404db2398292eba10686efc30
MD5 908e551c58961e05530133964e62056b
SHA1 ef1de1f58c0dc219d318a2242e81ff1000523e2d
SHA512 0fdaaf1cdd7f3e94c11a9ec1a86ff1fa2630c5fd36c156f1c918a55273783b3b51283474b9dd47ce9543dfc2500860f1e765ccd3d9c824e4109bfe0f137f82ca
SSDEEP 49152:dOlYT+torIsYTOGOhuKTQIWgDO/r4SuFcwj97GvIsTOmAcNtyJs:klY3zVuKTgl4FcwZyvIm39
TLSH
T1A9D5337422E9CDDFB9C290BD77AB0FAEE11492D7617D1C8C95B122E1D346FD182090AB
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

1692e2f084f2db8d0ecfe576c929ad00471f6b8f5061f104914ff916fdf94ef3

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 1692e2f084f2db8d0ecfe576c929ad00471f6b8f5061f104914ff916fdf94ef3
MD5 24d168ce8983d64f7ba6112bc36181ec
SHA1 160ab1ed66f95d8a2404ed2a4d5e7787c1433880
SHA512 4de540465a4c7aec57a8de032a83b1c993bc9f0d600d453bdd030f9ef11cd446da9fec2a5b12e4c8f1fefe8f457e6d60e444605a3e308e600e078c129bd09442
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8A:T6BJUoROZfIA8Xf8xumvBh8huTEEmpF
TLSH
T1D3665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

1692e2f084f2db8d0ecfe576c929ad00471f6b8f5061f104914ff916fdf94ef3.zip

1692e2f084f2db8d0ecfe576c929ad00471f6b8f5061f104914ff916fdf94ef3

kernel32

generic