240a37aeee478deb3d5cedb5a9897415d075bec324d84021640f90e63276a63d[.]zip

General

Target
240a37aeee478deb3d5cedb5a9897415d075bec324d84021640f90e63276a63d.zip
Size 350KB
Sample260809-t24gzsbd46
SHA256 731e5463896988ca2b4821c74905d53f36109f3368bca1d6158fc1f8750d6194
MD5 b03d70d42940581abfa7119e2966a76e
SHA1 5ffd871e84b141d6b79aec391365ee3f51eed999
SHA512 3ee7508aab084756b20cd2d9868fe44d9ab55b96cca82233fbf38df05d4c6333b4bdc3be5157d250970dc8bfef8223bb8c55ec212dd66e3d4cf87e80e2bb04dc
SSDEEP 6144:cPXx0TFB79KrDq5ZHhhVWJXonvdPtCXqa95dmHquPNEoMKAG:cP2FB7MrDyZHPVWJ0MFl0Ll4KAG
TLSH
T16C7423567BAA10074720F26EC5F5CB82ECFE33D468480D417A576A82DBDDC5E883DE92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/240a37aeee478deb3d5cedb5a9897415d075bec324d84021640f90e63276a63d	suspicious_telegram_bot

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/240a37aeee478deb3d5cedb5a9897415d075bec324d84021640f90e63276a63d	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/240a37aeee478deb3d5cedb5a9897415d075bec324d84021640f90e63276a63d

File Explorer

240a37aeee478deb3d5cedb5a9897415d075bec324d84021640f90e63276a63d.zip

.zip 350KB
240a37aeee478deb3d5cedb5a9897415d075bec324d84021640f90e63276a63d

.exe 1.0MB

240a37aeee478deb3d5cedb5a9897415d075bec324d84021640f90e63276a63d.zip

SHA256 731e5463896988ca2b4821c74905d53f36109f3368bca1d6158fc1f8750d6194
MD5 b03d70d42940581abfa7119e2966a76e
SHA1 5ffd871e84b141d6b79aec391365ee3f51eed999
SHA512 3ee7508aab084756b20cd2d9868fe44d9ab55b96cca82233fbf38df05d4c6333b4bdc3be5157d250970dc8bfef8223bb8c55ec212dd66e3d4cf87e80e2bb04dc
SSDEEP 6144:cPXx0TFB79KrDq5ZHhhVWJXonvdPtCXqa95dmHquPNEoMKAG:cP2FB7MrDyZHPVWJ0MFl0Ll4KAG
TLSH
T16C7423567BAA10074720F26EC5F5CB82ECFE33D468480D417A576A82DBDDC5E883DE92
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

240a37aeee478deb3d5cedb5a9897415d075bec324d84021640f90e63276a63d

SHA256 240a37aeee478deb3d5cedb5a9897415d075bec324d84021640f90e63276a63d
MD5 e59c494a8c238833fa4babec9e12c8ae
SHA1 88724d0e02c08cd38408ca3d811396d352251ced
SHA512 0dd63ac8ee9d77d64f27ea2c90a009701b95ee4f413c65dbfc81c6da40eeb32b89a89560bf086b0b0f699d13d578f11657457c5e5f3d344d72c07bdaa41a856a
SSDEEP 24576:1WdT0X/UKrGzOfahXhcUt8Bb1/GcFrPOMs:090XM4GzOfahXhc04b1/rrPf
TLSH
T160352A47F2A364B8C12BC17487639F72B970B46942347DAE1AD8D7322E21F509B1FB25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

1053744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Sharing