b8738a4eddaa9c553003f3ea20c17a31dc90e5fe703f427962acd59af0029ed3.zip
- SHA256 74ac8a5dd075366bf1857d796a9c779e0da864812180051b0da819300555eb24
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
b8738a4eddaa9c553003f3ea20c17a31dc90e5fe703f427962acd59af0029ed3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
b8738a4eddaa9c553003f3ea20c17a31dc90e5fe703f427962acd59af0029ed3.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target b8738a4eddaa9c553003f3ea20c17a31dc90e5fe703f427962acd59af0029ed3.zip
- Size 12.9MB
- Sample260808-pg3yha1saz
- SHA256 74ac8a5dd075366bf1857d796a9c779e0da864812180051b0da819300555eb24
- MD5 86d412a1bafb84db66e3975948559806
- SHA1 02d8c0f037c213fa8bce0c62e592a526098c9ec7
- SHA512 d5a179e6c23d17a3d7d20cedaf48fc17e4085bcadcccaf445ef8c8e18d0a42643945c297a1319459c6382f6dbd0d5094ddf1dcab98f126b0619c734433ea067c
- SSDEEP 393216:d+XhfHEjb9wryAAFW3rjPpKEHcxGAfBgqqh+MGP3:WapwryAUyrpTcoegZh+b3
- TLSH T143D633F13AC174ACF9A4E0A4533AC963D65CB355CB3446ED5C3D69CE85078A3E82EA70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/b8738a4eddaa9c553003f3ea20c17a31dc90e5fe703f427962acd59af0029ed3 suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/b8738a4eddaa9c553003f3ea20c17a31dc90e5fe703f427962acd59af0029ed3
File Explorer
-
b8738a4eddaa9c553003f3ea20c17a31dc90e5fe703f427962acd59af0029ed3.zip.zip 12.9MB
-
b8738a4eddaa9c553003f3ea20c17a31dc90e5fe703f427962acd59af0029ed3.exe 33.2MB
b8738a4eddaa9c553003f3ea20c17a31dc90e5fe703f427962acd59af0029ed3
- IMPHASH f4757f61f2855da75a2b269b01ff2338
- SHA256 b8738a4eddaa9c553003f3ea20c17a31dc90e5fe703f427962acd59af0029ed3
- MD5 1b6162e3819caa7e8ef5897e28de3513
- SHA1 ff8e808816556f69a8d9929f4c00ce60933f9257
- SHA512 5d37a3a5036b9aa4478daaa130a0a0773e1fe6c46fa6023171320f4fccf2c5aafd8090d85d312ac689da6ef276adc07fda4a37ef1132bd9d5f4acf9c35cfe18c
- SSDEEP 196608:FENtRK920hVUQxVlddYyJ8HKa8gPqF8p:4RkVU+dKqNb2p
- TLSH T193770703F29185D8D4ADC8B9831BA633EB71BC9D4435726B6BE44F122F1AF50A71CB49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
27814160
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
zeroclaw.pdb
kernel32
SetConsoleCursorPosition
SetConsoleCursorInfo
GetConsoleCursorInfo
ReadConsoleInputW
GetNumberOfConsoleInputEvents
WaitForMultipleObjects
CreateSemaphoreW
lstrlenW
WaitForSingleObjectEx
ReleaseSemaphore
Sleep
GetConsoleMode
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetCurrentProcess
CreateMutexA
WideCharToMultiByte
ReleaseMutex
GetConsoleOutputCP
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
HeapAlloc
GetCurrentThread
SleepEx
QueryPerformanceFrequency
FormatMessageW
QueryPerformanceCounter
SetHandleInformation
CreateThread
ReadConsoleW
GetSystemTimePreciseAsFileTime
ExitProcess
CreateEventW
TerminateProcess
GetExitCodeProcess
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
DuplicateHandle
CreateWaitableTimerExW
SetWaitableTimer
GetUserPreferredUILanguages
ReadProcessMemory
VirtualQueryEx
LoadLibraryExW
GlobalMemoryStatusEx
K32GetPerformanceInfo
GetModuleHandleExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetSystemInfo
GetSystemTimes
GetProcessIoCounters
FreeLibraryAndExitThread
SetThreadStackGuarantee
GetStringTypeW
SetStdHandle
AddVectoredExceptionHandler
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
OpenProcess
GetProcessTimes
GetStdHandle
GetCPInfo
LocalFree
GetOEMCP
IsValidCodePage
LCMapStringW
SetConsoleCtrlHandler
GetProcessId
UnregisterWaitEx
RegisterWaitForSingleObject
GetACP
CompareStringW
CloseHandle
VirtualProtect
GetBinaryTypeW
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcAddress
ExitThread
RtlPcToFileHeader
GetCommandLineA
SetLastError
GetModuleHandleA
GetTimeZoneInformationForYear
SystemTimeToFileTime
InitializeCriticalSectionEx
EncodePointer
FindClose
FlsFree
FlsSetValue
FlsGetValue
CreateNamedPipeW
GetFinalPathNameByHandleW
CreateFileW
FlsAlloc
GetFileInformationByHandle
GetFileInformationByHandleEx
SetFileTime
GetLastError
GetTimeZoneInformation
RtlUnwindEx
GetOverlappedResult
WriteFile
PostQueuedCompletionStatus
ReadFile
GetStartupInfoW
GetQueuedCompletionStatusEx
SetUnhandledExceptionFilter
InitializeSListHead
RaiseException
OutputDebugStringA
OutputDebugStringW
ConnectNamedPipe
CreateIoCompletionPort
SetFileCompletionNotificationModes
FormatMessageA
CancelIoEx
ReadDirectoryChangesW
CancelIo
HeapReAlloc
HeapFree
GetProcessHeap
SwitchToThread
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetCurrentProcessId
SetEnvironmentVariableW
GetCommandLineW
LoadLibraryA
FreeEnvironmentStringsW
ReadFileEx
WriteFileEx
GetModuleHandleW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCurrentDirectoryW
GetFullPathNameW
SetFileInformationByHandle
FindFirstFileExW
SetConsoleMode
FlushFileBuffers
CreateDirectoryW
GetFileAttributesW
GetModuleFileNameW
GetComputerNameExW
GetTempPathW
RemoveDirectoryW
DeleteFileW
CopyFileExW
MoveFileExW
CreateSymbolicLinkW
DeviceIoControl
GetFileType
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetFilePointerEx
FindNextFileW
InitializeCriticalSection
SetFileAttributesW
CreateHardLinkW
AreFileApisANSI
HeapCreate
GetDiskFreeSpaceW
LockFile
GetTickCount
MapViewOfFile
CreateFileMappingW
GetSystemTime
GetSystemTimeAsFileTime
FreeLibrary
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
CreateFileA
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WakeByAddressSingle
WaitOnAddress
ntdll
RtlGetVersion
NtQueryInformationProcess
RtlNtStatusToDosError
NtCancelIoFileEx
NtDeviceIoControlFile
NtCreateNamedPipeFile
NtWriteFile
NtReadFile
NtCreateFile
NtOpenFile
shell32
CommandLineToArgvW
SHGetKnownFolderPath
pdh
PdhCollectQueryData
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhEnumObjectsA
PdhOpenQueryA
PdhRemoveCounter
PdhCloseQuery
psapi
GetModuleFileNameExW
GetProcessMemoryInfo
advapi32
GetTokenInformation
SystemFunction036
GetLengthSid
CopySid
OpenProcessToken
IsValidSid
powrprof
CallNtPowerInformation
userenv
GetUserProfileDirectoryW
ole32
CoTaskMemFree
oleaut32
GetErrorInfo
bcryptprimitives
ProcessPrng
ws2_32
listen
WSAPoll
bind
closesocket
getpeername
recv
getsockopt
freeaddrinfo
getaddrinfo
WSAGetLastError
socket
ioctlsocket
accept
WSAIoctl
setsockopt
WSASocketW
send
WSAStartup
WSACleanup
recvfrom
shutdown
WSASend
sendto
getsockname
select
connect
user32
GetWindowThreadProcessId
GetForegroundWindow
GetKeyboardLayout
ToUnicodeEx
bcrypt
BCryptGenRandom
crypt32
CertGetEnhancedKeyUsage
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CertVerifyTimeValidity
CertFreeCertificateContext
CertCloseStore
Name
.text
Size
26.9MB
Virtual Size
26.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5.6MB
Virtual Size
5.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
89KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
458KB
Virtual Size
458KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
223KB
Virtual Size
223KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ