3c242d4ce140e99abcb6ce18983f0dc1ad6bc3c810877171e118496644483a9b[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
3c242d4ce140e99abcb6ce18983f0dc1ad6bc3c810877171e118496644483a9b.zip
Size 2.7MB
Sample260809-sx2bdshk6x
SHA256 1d4dddd19b1e2dff00315e8d13aa1f97922130db7da8bb283bf1aa1f8b4a9df5
MD5 e3297b517337f03a5957231b5aaf1176
SHA1 45917b2d24121dac1148ea7d7a6598ddf4337b1a
SHA512 e954a68c0b5cfa8a18bfe3039c6fe738e1351a38b44ef23d1aac064364500f9ad2adb21c0626d59ff71db1a6dcb36a3ec431c38a9cc9a214bf0d53f3b8c49df0
SSDEEP 49152:VuNdsTbzgLCaF4zIG/dPn02tf+J0J5t/tAvuAO6kMOj2K2xXbAsrGa9DQOB9lYrr:V2qg+aQz7t42/+4M1K2OsPQOTluP5xb
TLSH
T11BD533330BECD78A90A0F547A80C4F686256F3826FC6D9D5EBDC01F91733C95E491A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/3c242d4ce140e99abcb6ce18983f0dc1ad6bc3c810877171e118496644483a9b	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3c242d4ce140e99abcb6ce18983f0dc1ad6bc3c810877171e118496644483a9b

File Explorer

3c242d4ce140e99abcb6ce18983f0dc1ad6bc3c810877171e118496644483a9b.zip

.zip 2.7MB
3c242d4ce140e99abcb6ce18983f0dc1ad6bc3c810877171e118496644483a9b

.exe 6.5MB

3c242d4ce140e99abcb6ce18983f0dc1ad6bc3c810877171e118496644483a9b.zip

SHA256 1d4dddd19b1e2dff00315e8d13aa1f97922130db7da8bb283bf1aa1f8b4a9df5
MD5 e3297b517337f03a5957231b5aaf1176
SHA1 45917b2d24121dac1148ea7d7a6598ddf4337b1a
SHA512 e954a68c0b5cfa8a18bfe3039c6fe738e1351a38b44ef23d1aac064364500f9ad2adb21c0626d59ff71db1a6dcb36a3ec431c38a9cc9a214bf0d53f3b8c49df0
SSDEEP 49152:VuNdsTbzgLCaF4zIG/dPn02tf+J0J5t/tAvuAO6kMOj2K2xXbAsrGa9DQOB9lYrr:V2qg+aQz7t42/+4M1K2OsPQOTluP5xb
TLSH
T11BD533330BECD78A90A0F547A80C4F686256F3826FC6D9D5EBDC01F91733C95E491A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

3c242d4ce140e99abcb6ce18983f0dc1ad6bc3c810877171e118496644483a9b

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 3c242d4ce140e99abcb6ce18983f0dc1ad6bc3c810877171e118496644483a9b
MD5 0f21f152be728355a0aa5a95e36958ad
SHA1 bd3c4a554782ad4cf3762641fac0025827b6a085
SHA512 c53ed10ad531cf8114f4e2a4e4b6a320e78ff091048e80c859d466b4962d3303d21c0f2187c5e70576d8c187ae97a874531f7d97e1edc9787f31070f78f1ad78
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8h:T6BJUoROZfIA8Xf8xumvBh8huTEEm4
TLSH
T1C1665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

3c242d4ce140e99abcb6ce18983f0dc1ad6bc3c810877171e118496644483a9b.zip

3c242d4ce140e99abcb6ce18983f0dc1ad6bc3c810877171e118496644483a9b

kernel32

generic