0dbcf50d3b6cc779f25144fbdf0f07f21a74480e56f6ec67365ba3fca721618c[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
0dbcf50d3b6cc779f25144fbdf0f07f21a74480e56f6ec67365ba3fca721618c.zip
Size 2.7MB
Sample260807-vszccaszf1
SHA256 884213dd8e754bbf2f75fedc68888241480cbbeeb94413112b4db6a32edb2bf8
MD5 2561946f70d424f165ebe1d34233977e
SHA1 1409b5985edd311c043ffcbfdfc872b6e5a2229f
SHA512 b4d2718e41ce6a3f65773f21a7ec3cc7911f8c47c70d912c9a1ea15e94be96248904e6f6e49157fa51380004c568f2e9e07257f7f8ca5e09cd382ed9dbf17880
SSDEEP 49152:m01PaNPRVJoIqiOp1cNx0uK+87p6bOwxdyEORkS7OZFnv+wv9zlxLoee5BjYUHQ:m01yJTvsp1YE+Ep6RxdylR/7KFnHlxL5
TLSH
T134D533446DB5BAC09C6CBF77287985A27825DC5E256010D39824E87F2CF2D8C39A7CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/0dbcf50d3b6cc779f25144fbdf0f07f21a74480e56f6ec67365ba3fca721618c	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0dbcf50d3b6cc779f25144fbdf0f07f21a74480e56f6ec67365ba3fca721618c

File Explorer

0dbcf50d3b6cc779f25144fbdf0f07f21a74480e56f6ec67365ba3fca721618c.zip

.zip 2.7MB
0dbcf50d3b6cc779f25144fbdf0f07f21a74480e56f6ec67365ba3fca721618c

.exe 6.5MB

0dbcf50d3b6cc779f25144fbdf0f07f21a74480e56f6ec67365ba3fca721618c.zip

SHA256 884213dd8e754bbf2f75fedc68888241480cbbeeb94413112b4db6a32edb2bf8
MD5 2561946f70d424f165ebe1d34233977e
SHA1 1409b5985edd311c043ffcbfdfc872b6e5a2229f
SHA512 b4d2718e41ce6a3f65773f21a7ec3cc7911f8c47c70d912c9a1ea15e94be96248904e6f6e49157fa51380004c568f2e9e07257f7f8ca5e09cd382ed9dbf17880
SSDEEP 49152:m01PaNPRVJoIqiOp1cNx0uK+87p6bOwxdyEORkS7OZFnv+wv9zlxLoee5BjYUHQ:m01yJTvsp1YE+Ep6RxdylR/7KFnHlxL5
TLSH
T134D533446DB5BAC09C6CBF77287985A27825DC5E256010D39824E87F2CF2D8C39A7CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

0dbcf50d3b6cc779f25144fbdf0f07f21a74480e56f6ec67365ba3fca721618c

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 0dbcf50d3b6cc779f25144fbdf0f07f21a74480e56f6ec67365ba3fca721618c
MD5 1049f40f0176991d48bfd7138612f560
SHA1 0566ec4a4cc33453587a3910fc8de098b98c1588
SHA512 8b682470e4a31daad1225604d077be32fd5b007436441f72fd569b66c1197117f055cb2fb539f80c001e678f6a9a0e45317a010ab7cac0e3365baf9bc4acbcf7
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f89:T6BJUoROZfIA8Xf8xumvBh8huTEEmyl
TLSH
T1FB665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

0dbcf50d3b6cc779f25144fbdf0f07f21a74480e56f6ec67365ba3fca721618c.zip

0dbcf50d3b6cc779f25144fbdf0f07f21a74480e56f6ec67365ba3fca721618c

kernel32

generic