e181855f2027ed54b03965e151d2f4d1a06dc5f66d5b60bf8da8aa962c6d3e0c.zip
- SHA256 b94c5d0810bf73feb038ad8063b90ae70879d164e7809308768b44dba6105ab2
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
e181855f2027ed54b03965e151d2f4d1a06dc5f66d5b60bf8da8aa962c6d3e0c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
e181855f2027ed54b03965e151d2f4d1a06dc5f66d5b60bf8da8aa962c6d3e0c.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target e181855f2027ed54b03965e151d2f4d1a06dc5f66d5b60bf8da8aa962c6d3e0c.zip
- Size 2.1MB
- Sample260809-rtc9qagm5y
- SHA256 b94c5d0810bf73feb038ad8063b90ae70879d164e7809308768b44dba6105ab2
- MD5 3694cc3b8a41536b46b052dba1a5653e
- SHA1 17c413bc90f19ddaa8b2e91a89f043d619384a14
- SHA512 441d58d39647563f9989db94c013863525171a09abf99a686dbd8db91d0eefd9dba3609ab30daee8f21bb068c82a9bcad9d753f012025ec85754b64f1b02b2af
- SSDEEP 49152:SiiXsuVpPPsYhzDa+EZ3rz4WqMkCt+VXieH:JkVpPPzhLYIWBkCt+VyeH
- TLSH T13AA533586DFBC557AF216BD038BC39F8510EEC178933A7A8E57D081A23D61D0E2A2D71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/e181855f2027ed54b03965e151d2f4d1a06dc5f66d5b60bf8da8aa962c6d3e0c suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/e181855f2027ed54b03965e151d2f4d1a06dc5f66d5b60bf8da8aa962c6d3e0c
File Explorer
-
e181855f2027ed54b03965e151d2f4d1a06dc5f66d5b60bf8da8aa962c6d3e0c.zip.zip 2.1MB
-
e181855f2027ed54b03965e151d2f4d1a06dc5f66d5b60bf8da8aa962c6d3e0c.exe 3.0MB
e181855f2027ed54b03965e151d2f4d1a06dc5f66d5b60bf8da8aa962c6d3e0c
- IMPHASH 34dbfccf6ce3d99b527d9b6d0668caa3
- SHA256 e181855f2027ed54b03965e151d2f4d1a06dc5f66d5b60bf8da8aa962c6d3e0c
- MD5 30e3b2e9b73b6d94416a84b39e3612ea
- SHA1 6d0345977a4bc06e52613f5d51078048423827fc
- SHA512 d9948384356185aaba23087f9b84317f8c43d6124a021cfc4b91ae2e9d5ad0caa5233c7e5aeeeea7a9c062d48c525a9bbdc90e58480de8943fd9669bc7578b54
- SSDEEP 98304:YemayLuC6dtabXAQb84gi4zgcBvCHVaoj+:YeLqXAQb8TNEcBvCHVaoj+
- TLSH T1EEE5E11AE76400ECD0ABC1B8C91A5A07E775744523306BDF56D096E67FA3BE12E7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
1170968
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
bcrypt
BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptDecrypt
BCryptDestroyKey
wininet
InternetOpenUrlA
InternetConnectA
HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA
InternetReadFile
InternetCloseHandle
InternetOpenA
kernel32
Sleep
GetTempPathA
GetSystemInfo
SetFileAttributesA
GetTickCount
ReadFile
CreateFileW
CloseHandle
GetFileSize
LoadLibraryA
DeleteFileA
GetProcAddress
LocalFree
FreeLibrary
CopyFileW
SizeofResource
Process32First
WriteFile
TerminateProcess
FindResourceA
WaitForSingleObject
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
CopyFileA
CreateFileA
LockResource
Process32Next
LoadResource
CreateProcessA
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
GetComputerNameA
LoadLibraryExA
GetModuleFileNameA
GetCurrentProcess
GetEnvironmentVariableA
CreateMutexA
GetLastError
ExitProcess
GetDiskFreeSpaceExA
IsDebuggerPresent
CheckRemoteDebuggerPresent
ExpandEnvironmentStringsA
GetLocalTime
FlushFileBuffers
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetUserDefaultLCID
WideCharToMultiByte
GetModuleHandleW
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcessId
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
HeapReAlloc
DeleteFileW
WaitForSingleObjectEx
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
LCMapStringW
CompareStringW
VirtualProtect
FlsFree
FlsSetValue
IsValidLocale
EnumSystemLocalesW
ReadConsoleW
GetTimeZoneInformation
SetStdHandle
IsValidCodePage
GetACP
GetCommandLineA
GetOEMCP
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
GetSystemTimeAsFileTime
RtlUnwind
FlsGetValue
FlsAlloc
GetConsoleMode
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileInformationByHandle
SetFileInformationByHandle
GetFileInformationByHandleEx
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetFileType
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
GetFileSizeEx
SetFilePointerEx
GetConsoleOutputCP
GetLocaleInfoW
user32
EnumDisplayDevicesA
GetDesktopWindow
ReleaseDC
PeekMessageA
GetSystemMetrics
GetDC
gdi32
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetDIBits
DeleteDC
DeleteObject
GetObjectA
BitBlt
advapi32
RegCloseKey
GetCurrentHwProfileA
RegQueryValueExA
GetUserNameA
RegOpenKeyExA
RegSetValueExA
shell32
ShellExecuteA
SHGetFolderPathA
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
238KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
21KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=192, id=261, version=33145,
count=18, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=17, id=260, version=35207,
count=84, id=261, version=35207,
count=15, id=257, version=33145,
count=229, id=1, productName=Unmarked objects,
count=1, id=260, version=35219,
count=11, id=265, version=35219,
count=1, id=255, version=35219,
count=1, id=151,
count=1, id=258, version=35219,