614f8846e087459901dac294c5fec55f297e4f53e35137c161bb755e2d305d6a[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
614f8846e087459901dac294c5fec55f297e4f53e35137c161bb755e2d305d6a.zip
Size 2.7MB
Sample260809-t212vs1hph
SHA256 a1541d0c5b7898aa8a888af20afa7a56e25afa13a27d9e7867484cc6ffe57001
MD5 45cb248f68eeeaac4a13fa6bcc4c36ae
SHA1 b5c5244b971343299bfa4999e2b59b0a52d17f20
SHA512 578e8a0317cf6096c395224f7549250cd40e93a2c8a71bd61e0b3b25dc2770a55db308ee3d87ab3a9c6a70884d9ea494f076531dd5765411a32190b10d36ad39
SSDEEP 49152:1YX/seO7rcxFaKOLsAbqUAUn4Gzb68SNg/7D8ipdiuK21mweI4pIiZHrUFrBLl7+:V/7rqcpPq7gJMg/7Iip0zweI4XKrBWnv
TLSH
T1E4D533BCC705DA08E604821B3672C14EA65375E27F5CD2ADA6E5A3F8718F40E1EE6371
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/614f8846e087459901dac294c5fec55f297e4f53e35137c161bb755e2d305d6a	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/614f8846e087459901dac294c5fec55f297e4f53e35137c161bb755e2d305d6a

File Explorer

614f8846e087459901dac294c5fec55f297e4f53e35137c161bb755e2d305d6a.zip

.zip 2.7MB
614f8846e087459901dac294c5fec55f297e4f53e35137c161bb755e2d305d6a

.exe 6.5MB

614f8846e087459901dac294c5fec55f297e4f53e35137c161bb755e2d305d6a.zip

SHA256 a1541d0c5b7898aa8a888af20afa7a56e25afa13a27d9e7867484cc6ffe57001
MD5 45cb248f68eeeaac4a13fa6bcc4c36ae
SHA1 b5c5244b971343299bfa4999e2b59b0a52d17f20
SHA512 578e8a0317cf6096c395224f7549250cd40e93a2c8a71bd61e0b3b25dc2770a55db308ee3d87ab3a9c6a70884d9ea494f076531dd5765411a32190b10d36ad39
SSDEEP 49152:1YX/seO7rcxFaKOLsAbqUAUn4Gzb68SNg/7D8ipdiuK21mweI4pIiZHrUFrBLl7+:V/7rqcpPq7gJMg/7Iip0zweI4XKrBWnv
TLSH
T1E4D533BCC705DA08E604821B3672C14EA65375E27F5CD2ADA6E5A3F8718F40E1EE6371
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

614f8846e087459901dac294c5fec55f297e4f53e35137c161bb755e2d305d6a

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 614f8846e087459901dac294c5fec55f297e4f53e35137c161bb755e2d305d6a
MD5 2f29899ce099381f29dcc751f2affc64
SHA1 5566e74513e0f3918a2feace176a6a1bbf5e80ac
SHA512 8a1fafc13f5b7e3c9d52cd75e034c59724b71d463782f6b22152ece04182d4694a4c2e241e9e37f94899ffd33f50884e482d7e2c830d9249f51736d96c7839ff
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8v:T6BJUoROZfIA8Xf8xumvBh8huTEEmS
TLSH
T1FC665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

614f8846e087459901dac294c5fec55f297e4f53e35137c161bb755e2d305d6a.zip

614f8846e087459901dac294c5fec55f297e4f53e35137c161bb755e2d305d6a

kernel32

generic