39f5c126be838cc05854dbcc8cc58fd5bd8ecc03829f3aad6a183a38c7908bbe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
39f5c126be838cc05854dbcc8cc58fd5bd8ecc03829f3aad6a183a38c7908bbe.zip
Size 2.7MB
Sample260809-sym56atvcz
SHA256 3d41ecf3e80780d1ba68389335e59d4b3e9e1d26bc740ceffafe4adeb1702535
MD5 d82bfa672e4ebad1ce9a4e8511e7f311
SHA1 25fce51387bea6cee3bb300e23e13c5de58c7965
SHA512 bff5c66b79dd3463f8c19fce919501f50f7c1a507521e155ad09dc375071d362097823a629a25c3726a299795229dd00449a8b69f9f657adca064fc96532c70e
SSDEEP 49152:XY3BnyBrge50dTf8sxeX+fSiAns3Sx2i/BLItgzN/toMCB/26ZS+xythvt61FHyS:An+rg/d8ONqidCIiuGtoMCBRb2vtSyRU
TLSH
T15DD533C1697BE2FC5CDB16738B4E3BABDAB95A0440254228CFCE571F584C1E912BB907
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/39f5c126be838cc05854dbcc8cc58fd5bd8ecc03829f3aad6a183a38c7908bbe	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/39f5c126be838cc05854dbcc8cc58fd5bd8ecc03829f3aad6a183a38c7908bbe

File Explorer

39f5c126be838cc05854dbcc8cc58fd5bd8ecc03829f3aad6a183a38c7908bbe.zip

.zip 2.7MB
39f5c126be838cc05854dbcc8cc58fd5bd8ecc03829f3aad6a183a38c7908bbe

.exe 6.5MB

39f5c126be838cc05854dbcc8cc58fd5bd8ecc03829f3aad6a183a38c7908bbe.zip

SHA256 3d41ecf3e80780d1ba68389335e59d4b3e9e1d26bc740ceffafe4adeb1702535
MD5 d82bfa672e4ebad1ce9a4e8511e7f311
SHA1 25fce51387bea6cee3bb300e23e13c5de58c7965
SHA512 bff5c66b79dd3463f8c19fce919501f50f7c1a507521e155ad09dc375071d362097823a629a25c3726a299795229dd00449a8b69f9f657adca064fc96532c70e
SSDEEP 49152:XY3BnyBrge50dTf8sxeX+fSiAns3Sx2i/BLItgzN/toMCB/26ZS+xythvt61FHyS:An+rg/d8ONqidCIiuGtoMCBRb2vtSyRU
TLSH
T15DD533C1697BE2FC5CDB16738B4E3BABDAB95A0440254228CFCE571F584C1E912BB907
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

39f5c126be838cc05854dbcc8cc58fd5bd8ecc03829f3aad6a183a38c7908bbe

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 39f5c126be838cc05854dbcc8cc58fd5bd8ecc03829f3aad6a183a38c7908bbe
MD5 29bc1f92f91aa68cdab94f3aea092721
SHA1 3c61c6de40db3b6e4f8952be2714d90675f0def1
SHA512 0a267b0681d6a4f8bfb29dc07a32c39371b53774e3f66879597faa30c719ae444116f8a309470b311a59c76e2c8441860c7b19395fbd84dab7ff955d840d9364
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8/:T6BJUoROZfIA8Xf8xumvBh8huTEEmA
TLSH
T19D665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

39f5c126be838cc05854dbcc8cc58fd5bd8ecc03829f3aad6a183a38c7908bbe.zip

39f5c126be838cc05854dbcc8cc58fd5bd8ecc03829f3aad6a183a38c7908bbe

kernel32

generic