f32d53df7ad68722ae6354f8fc614f537e00021d06804adfc6b77adf95ee9394[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
f32d53df7ad68722ae6354f8fc614f537e00021d06804adfc6b77adf95ee9394.zip
Size 2.7MB
Sample260809-t2vvva1hpf
SHA256 6e13e90dc1fee38be607aaa36748db0e80adfccf268889599e18bdeeb5e96fbe
MD5 d3b481c49180ef43554fae699c539112
SHA1 4c74b35e558f949e4f58c0daa19d4fd2d4ddd62f
SHA512 94f4220f1dc037d65dc17d94c716048bf4340879496f05ef95933e73d3540e8861566c627540543f35d3b8a5d3754483775c584f6da1b494909210f77c24c7e5
SSDEEP 49152:ZgtzJwRhuFHjPoprquAYphPFmI+pmVa7ZsuCniYnCW5BxYbb/MAoqRB0T28AEVaO:Zgrsh1rquDZbKsrKWKbIciK8aD6
TLSH
T1F4D53375CA15407BF43597E061A7E5B5FAB0BFB58C21CB2AA80613CF8705EA8C5F281D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/f32d53df7ad68722ae6354f8fc614f537e00021d06804adfc6b77adf95ee9394	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f32d53df7ad68722ae6354f8fc614f537e00021d06804adfc6b77adf95ee9394

File Explorer

f32d53df7ad68722ae6354f8fc614f537e00021d06804adfc6b77adf95ee9394.zip

.zip 2.7MB
f32d53df7ad68722ae6354f8fc614f537e00021d06804adfc6b77adf95ee9394

.exe 6.5MB

f32d53df7ad68722ae6354f8fc614f537e00021d06804adfc6b77adf95ee9394.zip

SHA256 6e13e90dc1fee38be607aaa36748db0e80adfccf268889599e18bdeeb5e96fbe
MD5 d3b481c49180ef43554fae699c539112
SHA1 4c74b35e558f949e4f58c0daa19d4fd2d4ddd62f
SHA512 94f4220f1dc037d65dc17d94c716048bf4340879496f05ef95933e73d3540e8861566c627540543f35d3b8a5d3754483775c584f6da1b494909210f77c24c7e5
SSDEEP 49152:ZgtzJwRhuFHjPoprquAYphPFmI+pmVa7ZsuCniYnCW5BxYbb/MAoqRB0T28AEVaO:Zgrsh1rquDZbKsrKWKbIciK8aD6
TLSH
T1F4D53375CA15407BF43597E061A7E5B5FAB0BFB58C21CB2AA80613CF8705EA8C5F281D
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

f32d53df7ad68722ae6354f8fc614f537e00021d06804adfc6b77adf95ee9394

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 f32d53df7ad68722ae6354f8fc614f537e00021d06804adfc6b77adf95ee9394
MD5 1492a62277f746d39794b4a56ebf1649
SHA1 1fc2a90c623d7d63522d1618214bb464f247928b
SHA512 2ecf22d7ea6f099ae9f2bfda281360ddde49f160ee0ebc7dbf324e9692ccfaddda3966dac1b91a50f39acf8c53517a492c796b9feec63361fe0b929a283f94c4
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8i:T6BJUoROZfIA8Xf8xumvBh8huTEEmD
TLSH
T1F0665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

f32d53df7ad68722ae6354f8fc614f537e00021d06804adfc6b77adf95ee9394.zip

f32d53df7ad68722ae6354f8fc614f537e00021d06804adfc6b77adf95ee9394

kernel32

generic