f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.zip
Size 13.1MB
Sample260808-phancawfnd
SHA256 c02662c29ce7fbe7f50b3ffdc1ef538ddae2cd85013e6e3e5128371e5a49d0b2
MD5 3f33299e521d66437356f0c315b92370
SHA1 98bc65e45ba5ee7a68ec7255a73538186de61ef3
SHA512 0fabaabfe70c95475447dda32df09c2e8927ff042c0f0abe4218b242907202205822a1662cc13529ce2c0bcd39d6fe54ce831ad14f2a0e4c89026e4478572754
SSDEEP 393216:7eD5GJJSL1NuWRL2QyhP7KZuQQMJftmlJf:CH1bh2Qy57KZuQO
TLSH
T175D633C5149E4598DD023943CFDC8E97F2E36BAB3EABDB56D2471F7469A8210C362870
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e	suspicious_telegram_bot

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e

File Explorer

f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.zip

.zip 13.1MB
f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e

.exe 30.2MB

f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.zip

SHA256 c02662c29ce7fbe7f50b3ffdc1ef538ddae2cd85013e6e3e5128371e5a49d0b2
MD5 3f33299e521d66437356f0c315b92370
SHA1 98bc65e45ba5ee7a68ec7255a73538186de61ef3
SHA512 0fabaabfe70c95475447dda32df09c2e8927ff042c0f0abe4218b242907202205822a1662cc13529ce2c0bcd39d6fe54ce831ad14f2a0e4c89026e4478572754
SSDEEP 393216:7eD5GJJSL1NuWRL2QyhP7KZuQQMJftmlJf:CH1bh2Qy57KZuQO
TLSH
T175D633C5149E4598DD023943CFDC8E97F2E36BAB3EABDB56D2471F7469A8210C362870
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e

IMPHASH 1554b51f4134de89b1033d08170086c9
SHA256 f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e
MD5 1d4e31eeaabfea203505a503e7aa8e96
SHA1 31283d0ab182d3ca2ac7dee39bf1d67cdaa26a38
SHA512 beca7aec9028be5059370c9d92f4f4e866b3627e94681caccab7c58c8d1c0029b77f08f7677edb8252c61e07a194021746fea5d820c112ba3a34fb676e7b8e2f
SSDEEP 786432:WmtwijsbokVM1mrrZBiT/BCmDJZW8QWfbH:Wmrk0
TLSH
T132678D40E797ABA4C8860431205FBB3BA7385D198319CBF3D7D46E75A8737C1197AB0A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detect suspicious telegram bot

Detect suspicious telegram bot.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Password

infected

PE Signature issue

Digest

52:d7:56:9c:31:69:bb:65:97:a6:a4:21:1e:14:16:ff:53:cf:99:e0:01:20:14:cd:78:ea:65:dc:a0:1c:2e:65

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=53481265A,CN=PURSLANE,O=PURSLANE,ST=North West,C=SG,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Aug 6, 2026

SERIALNUMBER=53481265A,CN=PURSLANE,O=PURSLANE,ST=North West,C=SG,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025347

Subject

SERIALNUMBER=53481265A,CN=PURSLANE,O=PURSLANE,ST=North West,C=SG,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025347

Serial Number

79:1e:01:e2:77:1b:0f:0b:68:94:6e:42:93:0d:86:a1

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 5, 2026 - Feb 22, 2028

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

Major OS version

Entry point

20474812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalFree TerminateProcess CreateNamedPipeW CreateEventW ConnectNamedPipe GetOverlappedResult CreateToolhelp32Snapshot GetSystemDirectoryW Process32NextW GetLastError LoadLibraryExA GetTimeZoneInformationForYear FormatMessageW GetProcessHeap HeapFree QueryFullProcessImageNameW OpenProcess GetCurrentProcess GetNamedPipeClientProcessId Process32FirstW GetExitCodeProcess SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW FreeLibraryAndExitThread ExitThread InitializeCriticalSectionAndSpinCount RaiseException RtlUnwind GetCPInfo HeapFree AddVectoredExceptionHandler SetThreadStackGuarantee GetLastError GetProcessHeap HeapAlloc HeapReAlloc Sleep GlobalAlloc GlobalLock GlobalUnlock GlobalSize GetCurrentThread AcquireSRWLockExclusive TlsGetValue TlsSetValue WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcessId CreateMutexA CloseHandle ReleaseMutex GetCurrentProcess lstrlenW WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared GlobalFree MultiByteToWideChar CreateEventA SwitchToThread SetEvent GetCurrentThreadId SetThreadPriority WaitForMultipleObjectsEx ReleaseSemaphore GetSystemInfo SetErrorMode SetThreadErrorMode FormatMessageW GetFileType GetNamedPipeInfo ReadFile WriteFile TryAcquireSRWLockExclusive CreateFileMappingW MapViewOfFile DuplicateHandle VirtualProtect UnmapViewOfFile FindClose WaitForSingleObject VerSetConditionMask VerifyVersionInfoW RtlCaptureContext GetLogicalDrives SetFileTime GetLogicalProcessorInformationEx CreateFileW GetConsoleMode SetConsoleMode GetStdHandle PostQueuedCompletionStatus WakeAllConditionVariable SetFilePointerEx GetFileInformationByHandleEx SleepConditionVariableSRW GetExitCodeProcess LocalFree LocalAlloc ProcessIdToSessionId ConnectNamedPipe FlushFileBuffers FindNextFileW OpenProcess lstrcmpiW QueryPerformanceFrequency GetModuleHandleExA DeviceIoControl GetNativeSystemInfo TerminateProcess WTSGetActiveConsoleSessionId VirtualAllocEx WriteProcessMemory GetModuleHandleA QueueUserAPC ResumeThread FileTimeToSystemTime SetThreadExecutionState GetUserPreferredUILanguages SetEnvironmentVariableW LoadLibraryExW SetDllDirectoryW SetLastError CreateMutexW CreateSemaphoreA SetConsoleCtrlHandler GlobalMemoryStatusEx K32GetPerformanceInfo SetHandleInformation LoadLibraryExA GetModuleHandleW GetQueuedCompletionStatusEx GetOverlappedResult CancelIoEx CreateIoCompletionPort SetFileCompletionNotificationModes LoadLibraryW GetLogicalProcessorInformation CreateNamedPipeW FreeEnvironmentStringsW ExpandEnvironmentStringsW CreatePipe InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateProcessW WakeConditionVariable FreeLibrary OpenFileMappingW InitOnceBeginInitialize TlsAlloc InitOnceComplete TlsFree WriteConsoleW QueryPerformanceCounter GetCurrentDirectoryW GetEnvironmentVariableW GetEnvironmentStringsW GetTempPathW GetModuleFileNameW GetCommandLineW GetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW CreateDirectoryW FindFirstFileW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW CreateThread ReadFileEx SleepEx WriteFileEx WaitForMultipleObjects CreateEventW CancelIo ExitProcess GetSystemTimeAsFileTime DeleteFileW MoveFileExW RemoveDirectoryW CreateSymbolicLinkW CopyFileExW GetTickCount64 GetProcessTimes GetSystemTimes GetProcessIoCounters GetComputerNameExW VirtualQuery FormatMessageA CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileSize GetFileTime SetFilePointer InitializeSRWLock ResetEvent InitializeCriticalSectionEx DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateSemaphoreW InitializeConditionVariable SleepConditionVariableCS TryEnterCriticalSection GetConsoleScreenBufferInfo SetConsoleTextAttribute CreateJobObjectW AssignProcessToJobObject SetInformationJobObject InitializeCriticalSection GetModuleHandleExW GetProcessAffinityMask MoveFileExA GetCommandLineA ReadConsoleW GetConsoleOutputCP FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringW GetFileSizeEx IsValidCodePage GetACP LCMapStringEx DecodePointer EncodePointer GetLocaleInfoEx GetOEMCP HeapSize HeapQueryInformation GetStringTypeW GetTimeZoneInformation SetStdHandle SetEndOfFile GetStartupInfoW IsDebuggerPresent InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent FindFirstFileExW GetProcessId

advapi32

CreateProcessAsUserW ConvertSidToStringSidW OpenProcessToken ConvertStringSidToSidW SetNamedSecurityInfoW SetEntriesInAclW GetNamedSecurityInfoW GetTokenInformation SetSecurityDescriptorDacl CreateWellKnownSid GetLengthSid InitializeSecurityDescriptor IsWellKnownSid RegQueryInfoKeyW CreateProcessWithTokenW ImpersonateLoggedOnUser DuplicateTokenEx RegDeleteKeyW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle LookupAccountSidW RegEnumValueW AdjustTokenPrivileges LookupPrivilegeValueW CopySid GetLengthSid IsValidSid DuplicateToken EqualSid LogonUserW CreateProcessWithLogonW CreateProcessAsUserW RegEnumKeyExW GetTokenInformation OpenProcessToken RegDeleteTreeW GetUserNameW SystemFunction036 RegSetValueExW RegQueryValueExW RegDeleteValueW RegCloseKey RegOpenKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl FreeSid AllocateAndInitializeSid SetEntriesInAclW InitializeSecurityDescriptor SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RevertToSelf ImpersonateAnonymousToken

oleaut32

GetErrorInfo SysFreeString SysStringLen SysStringLen SysFreeString GetErrorInfo

ole32

CoInitializeEx PropVariantClear RevokeDragDrop RegisterDragDrop CoInitializeEx CoUninitialize CoCreateInstance CoTaskMemFree ReleaseStgMedium OleIsCurrentClipboard OleGetClipboard OleSetClipboard OleUninitialize CoTaskMemAlloc OleInitialize CoUninitialize CoCreateInstance CoTaskMemFree StringFromGUID2

shell32

SHAppBarMessage ShellExecuteA SHAddToRecentDocs Shell_NotifyIconGetRect DragFinish DragQueryFileW SHGetKnownFolderPath Shell_NotifyIconW SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

shlwapi

SHCreateMemStream

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock CreateEnvironmentBlock DestroyEnvironmentBlock GetUserProfileDirectoryW

sas

SendSAS

newdev

UpdateDriverForPlugAndPlayDevicesW

wtsapi32

WTSEnumerateSessionsA WTSQuerySessionInformationW WTSFreeMemory

user32

DestroyAcceleratorTable CreateAcceleratorTableW CheckMenuItem PostQuitMessage MessageBoxW SystemParametersInfoA GetActiveWindow GetMenuItemInfoW GetMenuBarInfo MapWindowPoints OffsetRect GetWindowDC PostThreadMessageW FillRect MapVirtualKeyW PeekMessageW DrawTextW CreateMenu CreatePopupMenu AppendMenuW ValidateRect DrawIconEx SetMenuItemInfoW TrackPopupMenu GetRawInputData MsgWaitForMultipleObjectsEx GetCursorPos DestroyIcon DestroyMenu AttachThreadInput GetSystemMetrics LockWorkStation GetCursorInfo EnumDisplaySettingsW RegisterClassExW SystemParametersInfoW ChangeDisplaySettingsExW DefWindowProcA BlockInput LoadCursorA RegisterClassExA CreateWindowExA ToUnicodeEx RemoveMenu DrawMenuBar SetMenu SetCursor SendMessageW ChangeWindowMessageFilterEx RegisterClassW RedrawWindow RegisterRawInputDevices ShowWindow EnumDisplayDevicesW PostThreadMessageA EnumDisplaySettingsExW ClientToScreen IsWindow RegisterTouchWindow CreateIcon GetClientRect DefWindowProcW CloseTouchInputHandle GetAsyncKeyState ExitWindowsEx RegisterWindowMessageA GetMenu AdjustWindowRectEx GetMessageW SetPropW GetSystemMenu EnableMenuItem GetClipCursor ClipCursor ShowCursor ScreenToClient GetTouchInputInfo SetWindowsHookExA LoadCursorW KillTimer SetTimer ReleaseCapture SetForegroundWindow SetWindowTextW OpenInputDesktop SetThreadDesktop CloseDesktop GetThreadDesktop GetUserObjectInformationA PeekMessageA SendMessageA SetCapture wsprintfW GetClipboardSequenceNumber GetClipboardOwner SetClipboardViewer ChangeClipboardChain RegisterClipboardFormatA CountClipboardFormats GetClipboardFormatNameA EmptyClipboard GetUpdateRect UnhookWindowsHookEx GetMessageA DestroyWindow RemoveClipboardFormatListener TranslateMessage DispatchMessageA GetDesktopWindow DispatchMessageW OpenClipboard AddClipboardFormatListener SetClipboardData CreateWindowExW PostMessageW CallNextHookEx ReleaseDC GetIconInfo SetWindowLongW AllowSetForegroundWindow IsClipboardFormatAvailable TrackMouseEvent GetClipboardData RegisterClipboardFormatW GetMonitorInfoA GetDC GetWindowRect IsWindowVisible EnumDisplayMonitors PostMessageA GetWindowPlacement FindWindowExA GetKeyState VkKeyScanExW MapVirtualKeyExW GetKeyboardLayout GetWindowThreadProcessId GetForegroundWindow SendInput GetKeyboardState MonitorFromRect SetWindowPlacement GetMonitorInfoW InvalidateRgn SetWindowPos MonitorFromWindow IsProcessDPIAware GetWindowLongW CloseClipboard

gdi32

CreateDIBSection CreateDCW SetTextColor SetBkMode CreateSolidBrush SelectObject CreateCompatibleDC GetBitmapBits GetObjectA BitBlt GetDeviceCaps CreateCompatibleBitmap CreateRectRgn DeleteDC GetDIBits CreateDIBitmap DeleteObject

iphlpapi

GetAdaptersAddresses SendARP GetBestInterface

ws2_32

freeaddrinfo getaddrinfo WSASocketW WSACleanup getsockname getsockopt WSAGetLastError recvfrom ioctlsocket sendto getpeername WSASend accept listen send recv connect WSAStartup WSAIoctl socket shutdown bind closesocket setsockopt

pdh

PdhOpenQueryA PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhAddEnglishCounterA PdhCollectQueryData PdhCollectQueryDataEx PdhRemoveCounter PdhCloseQuery

crypt32

CertOpenStore CertGetEnhancedKeyUsage CertVerifyTimeValidity CertVerifyCertificateChainPolicy CertDuplicateCertificateChain CertGetCertificateChain CertFreeCertificateContext CertCloseStore CertAddCertificateContextToStore CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain

secur32

QueryContextAttributesW FreeCredentialsHandle DecryptMessage AcquireCredentialsHandleA FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext DeleteSecurityContext ApplyControlToken EncryptMessage

ntdll

RtlGetNtVersionNumbers NtQuerySystemInformation RtlGetVersion NtDeviceIoControlFile RtlNtStatusToDosError NtCreateFile NtWriteFile NtCancelIoFileEx NtReadFile

winspool.drv

InstallPrinterDriverFromPackageW AddPrinterW UploadPrinterDriverPackageW EnumPrinterDriversW GetDefaultPrinterW EnumPrintersW EnumPortsW OpenPrinterW XcvDataW ClosePrinter SetPrinterW DeletePrinter DeletePrinterDriverExW DeletePrinterDriverPackageW

setupapi

SetupDiEnumDeviceInfo SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiSetDeviceRegistryPropertyW SetupDiCallClassInstaller SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiGetDeviceInfoListDetailW SetupDiSetClassInstallParamsW SetupDiGetDeviceInstallParamsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsExW

cfgmgr32

CM_Get_DevNode_Status

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass

dwmapi

DwmEnableBlurBehindWindow

bcrypt

BCryptGenRandom BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice

psapi

GetModuleFileNameExW GetProcessMemoryInfo

powrprof

CallNtPowerInformation

Name

.text

Size

20.0MB

Virtual Size

20.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

483KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

814KB

Virtual Size

814KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e.zip

f689be165cd1cfeb3ab53cd59bef114854b5b3d273de8ea9e66241ed7980ee4e

PE Signature issue

kernel32

advapi32

oleaut32

ole32

shell32

shlwapi

userenv

sas

newdev

wtsapi32

user32

gdi32

iphlpapi

ws2_32

pdh

crypt32

secur32

ntdll

winspool.drv

setupapi

cfgmgr32

comctl32

dwmapi

bcrypt

dxgi

d3d11

psapi

powrprof

generic