dd54fe6f1aafcf13166a0b2b3ec061a4f278da566a14e954a5d799b3b0b63869[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
dd54fe6f1aafcf13166a0b2b3ec061a4f278da566a14e954a5d799b3b0b63869.zip
Size 2.7MB
Sample260807-tpryeszaqa
SHA256 4a35f1ae453ffecff213488527cf0b854bbf972f3243663c9ee9d916b42d7b19
MD5 ce5a88198086d6bffe4ee60dc3a32b38
SHA1 6cbcdb3fbeab4e06a2754ef9096a82c06d758cb2
SHA512 e6f3cc18d950316908e437befb2fb5bb24cc56d6845031a197be27162a5f9ba825229ebe4ceac9c256ef1f80999935f8a0db335c10f311944d70fa0f7787bb55
SSDEEP 49152:0Vp/7h4WfrQ/peta3N7m4gRpjCpQtuZl+DiR2YKOw2nip02Tiaf:2pFpQ/Itaxm46JCituZlaiR7wMip0G
TLSH
T118D5339CDACB5204CFFF8FD3850688CA746546E4488A6FABC24CD5BAF6255BDAD40331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/dd54fe6f1aafcf13166a0b2b3ec061a4f278da566a14e954a5d799b3b0b63869	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/dd54fe6f1aafcf13166a0b2b3ec061a4f278da566a14e954a5d799b3b0b63869

File Explorer

dd54fe6f1aafcf13166a0b2b3ec061a4f278da566a14e954a5d799b3b0b63869.zip

.zip 2.7MB
dd54fe6f1aafcf13166a0b2b3ec061a4f278da566a14e954a5d799b3b0b63869

.exe 6.5MB

dd54fe6f1aafcf13166a0b2b3ec061a4f278da566a14e954a5d799b3b0b63869.zip

SHA256 4a35f1ae453ffecff213488527cf0b854bbf972f3243663c9ee9d916b42d7b19
MD5 ce5a88198086d6bffe4ee60dc3a32b38
SHA1 6cbcdb3fbeab4e06a2754ef9096a82c06d758cb2
SHA512 e6f3cc18d950316908e437befb2fb5bb24cc56d6845031a197be27162a5f9ba825229ebe4ceac9c256ef1f80999935f8a0db335c10f311944d70fa0f7787bb55
SSDEEP 49152:0Vp/7h4WfrQ/peta3N7m4gRpjCpQtuZl+DiR2YKOw2nip02Tiaf:2pFpQ/Itaxm46JCituZlaiR7wMip0G
TLSH
T118D5339CDACB5204CFFF8FD3850688CA746546E4488A6FABC24CD5BAF6255BDAD40331
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

dd54fe6f1aafcf13166a0b2b3ec061a4f278da566a14e954a5d799b3b0b63869

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 dd54fe6f1aafcf13166a0b2b3ec061a4f278da566a14e954a5d799b3b0b63869
MD5 123c3c3854d821b320d592a6f0b3207d
SHA1 e5de1cc44d71e7d3d0cf69b9e33bf450d60d76c4
SHA512 7d49150f70d461fe53592f6b310c9c78fa5832c23eec8ae499ccf67651719cba5ce321fb894e8177ce60cad254ba8b24e60fba81503dc9a3f030abf5dc93aaf9
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8D:T6BJUoROZfIA8Xf8xumvBh8huTEEmu
TLSH
T15A665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dd54fe6f1aafcf13166a0b2b3ec061a4f278da566a14e954a5d799b3b0b63869.zip

dd54fe6f1aafcf13166a0b2b3ec061a4f278da566a14e954a5d799b3b0b63869

kernel32

generic