558e36d8e9f85102ef0f25d179e32ba2701f9fd6c2bdc59d36127cd6867e52db[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
558e36d8e9f85102ef0f25d179e32ba2701f9fd6c2bdc59d36127cd6867e52db.zip
Size 2.7MB
Sample260809-t3cewsvthw
SHA256 67f550926ff88c7f0ba7787764b5287f2fcbb4205ba052717e805462483aa650
MD5 f46119df66184f1bff5335eb5b9da0d4
SHA1 9b3713205dc241bc6d1a9961a4dbe4ba16d3ab00
SHA512 65b2d26e48009ce40a06a858411d93f63a65f0ae1afd85e5723ba12b78b00b9239ae264f563030513e4d721ccd6b270bd510902e2d372efd991e84ad6e3300c1
SSDEEP 49152:9+XtWZoKH4iaIGUAh3qUTfaGifIRLUnApaxNw90a+aW2MiDPnzIkgz+OyyV9uyd:9CW2YkI7lUTfrd8AQNMn+al9zIkBOJ
TLSH
T138D5330A63426E98B33D60A903484938B39FD649B70655EEFBC17E0389B8DF3CDD5586
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Custom signature

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/558e36d8e9f85102ef0f25d179e32ba2701f9fd6c2bdc59d36127cd6867e52db	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/558e36d8e9f85102ef0f25d179e32ba2701f9fd6c2bdc59d36127cd6867e52db

File Explorer

558e36d8e9f85102ef0f25d179e32ba2701f9fd6c2bdc59d36127cd6867e52db.zip

.zip 2.7MB
558e36d8e9f85102ef0f25d179e32ba2701f9fd6c2bdc59d36127cd6867e52db

.exe 6.5MB

558e36d8e9f85102ef0f25d179e32ba2701f9fd6c2bdc59d36127cd6867e52db.zip

SHA256 67f550926ff88c7f0ba7787764b5287f2fcbb4205ba052717e805462483aa650
MD5 f46119df66184f1bff5335eb5b9da0d4
SHA1 9b3713205dc241bc6d1a9961a4dbe4ba16d3ab00
SHA512 65b2d26e48009ce40a06a858411d93f63a65f0ae1afd85e5723ba12b78b00b9239ae264f563030513e4d721ccd6b270bd510902e2d372efd991e84ad6e3300c1
SSDEEP 49152:9+XtWZoKH4iaIGUAh3qUTfaGifIRLUnApaxNw90a+aW2MiDPnzIkgz+OyyV9uyd:9CW2YkI7lUTfrd8AQNMn+al9zIkBOJ
TLSH
T138D5330A63426E98B33D60A903484938B39FD649B70655EEFBC17E0389B8DF3CDD5586
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

558e36d8e9f85102ef0f25d179e32ba2701f9fd6c2bdc59d36127cd6867e52db

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 558e36d8e9f85102ef0f25d179e32ba2701f9fd6c2bdc59d36127cd6867e52db
MD5 10c51581efa22b34e8146a233a238da9
SHA1 1881ed3ba9bf269cce66c1604e8208a11a56f016
SHA512 b0bd99d59216dfb9394fc602e92722ce6f7bf21e9fd7792747fafbaa1193e3437a072ff106c2b37100b5bf8d8c8d5c39eeb0ba0c841993e46ba139cacf8a0396
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8N:T6BJUoROZfIA8Xf8xumvBh8huTEEm+
TLSH
T12A665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

558e36d8e9f85102ef0f25d179e32ba2701f9fd6c2bdc59d36127cd6867e52db.zip

558e36d8e9f85102ef0f25d179e32ba2701f9fd6c2bdc59d36127cd6867e52db

kernel32

generic