39f77fc105ecce149ce09a10a8f19bec54ef99b37444a522715a37ea698ecf26[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
39f77fc105ecce149ce09a10a8f19bec54ef99b37444a522715a37ea698ecf26.zip
Size 2.7MB
Sample260808-rnn42agn21
SHA256 905447af74a36e0982a3c9adad28e80b906f792b333ec5c6d6c9388ac34fb1c6
MD5 885af0fe08fc1db541e7b702c5cdd50b
SHA1 bfa60324629ca6ca5c0f0871402b5a35196ceec7
SHA512 570a6a66990538a30e0b138d3aa86ca50c37810f3f718ad2042524a80eefc8aadac2eb967f0176d6f8cc1ae674417e23bd6a798d404a7760f96ea67f9bd1623e
SSDEEP 49152:t5ZecbYaXoR8VSZJ+ljjBqgS5pHLv8ABrOQMJh+triAT3mdBQUmU3oT3lF2o5:L7bXYMSuvqgqrknQnrR2dVmU3oT3lx
TLSH
T143D533A7ACA314F55169FB5D32E923C0FED25415BA9ED4800E841FBB53E49A3049F38E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/39f77fc105ecce149ce09a10a8f19bec54ef99b37444a522715a37ea698ecf26	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/39f77fc105ecce149ce09a10a8f19bec54ef99b37444a522715a37ea698ecf26

File Explorer

39f77fc105ecce149ce09a10a8f19bec54ef99b37444a522715a37ea698ecf26.zip

.zip 2.7MB
39f77fc105ecce149ce09a10a8f19bec54ef99b37444a522715a37ea698ecf26

.exe 6.5MB

39f77fc105ecce149ce09a10a8f19bec54ef99b37444a522715a37ea698ecf26.zip

SHA256 905447af74a36e0982a3c9adad28e80b906f792b333ec5c6d6c9388ac34fb1c6
MD5 885af0fe08fc1db541e7b702c5cdd50b
SHA1 bfa60324629ca6ca5c0f0871402b5a35196ceec7
SHA512 570a6a66990538a30e0b138d3aa86ca50c37810f3f718ad2042524a80eefc8aadac2eb967f0176d6f8cc1ae674417e23bd6a798d404a7760f96ea67f9bd1623e
SSDEEP 49152:t5ZecbYaXoR8VSZJ+ljjBqgS5pHLv8ABrOQMJh+triAT3mdBQUmU3oT3lF2o5:L7bXYMSuvqgqrknQnrR2dVmU3oT3lx
TLSH
T143D533A7ACA314F55169FB5D32E923C0FED25415BA9ED4800E841FBB53E49A3049F38E
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

39f77fc105ecce149ce09a10a8f19bec54ef99b37444a522715a37ea698ecf26

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 39f77fc105ecce149ce09a10a8f19bec54ef99b37444a522715a37ea698ecf26
MD5 103cf3fc1463afe809ee891c7e7d808b
SHA1 74ccb375568fcfa19991315042462065f572b445
SHA512 e1237914a721d0325a5b0b167ce893f9ec90ba2c056a5c2b5045040613921691cba5ed594aa07b81e593802fb8f158f8e1357f0ceb2053ee2e51529866c28152
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8Y:T6BJUoROZfIA8Xf8xumvBh8huTEEm5P
TLSH
T17C665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

39f77fc105ecce149ce09a10a8f19bec54ef99b37444a522715a37ea698ecf26.zip

39f77fc105ecce149ce09a10a8f19bec54ef99b37444a522715a37ea698ecf26

kernel32

generic