c1621c589b5564daaa7bccd3276c34348529ba749890de50dde077731f749183[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
c1621c589b5564daaa7bccd3276c34348529ba749890de50dde077731f749183.zip
Size 13.1MB
Sample260811-qa5zystdlh
SHA256 ba35528557e156f228b986b34c74569171736d07d38b9c05fead7fa2607b9ebe
MD5 180fa76a635d6274e2ccfdc2700ee91d
SHA1 97a3f10f69bc0406d1220f9633d6d2fe470d0499
SHA512 c88b4ffaed7f419513c50f4ed83a07ad0027f0dc73ac26042c58ba94beb09a1970a5a5d9a45681de7b1dc7ccf0c26f216bd6c6801aab751bf00d0245dfe8ba18
SSDEEP 393216:5cUkHvRZ88tGkyZP5bY/R6ZGvzH9Hh/0lTVF3RM:aHpnGkE21vzH9Hh/gTVI
TLSH
T13FD6337AB3659F2D4D9D800870AAA014B7F583357AF4E99B4E290B4FF275B9D0E001B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/c1621c589b5564daaa7bccd3276c34348529ba749890de50dde077731f749183	suspicious_telegram_bot

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/c1621c589b5564daaa7bccd3276c34348529ba749890de50dde077731f749183

File Explorer

c1621c589b5564daaa7bccd3276c34348529ba749890de50dde077731f749183.zip

.zip 13.1MB
c1621c589b5564daaa7bccd3276c34348529ba749890de50dde077731f749183

.exe 30.2MB

c1621c589b5564daaa7bccd3276c34348529ba749890de50dde077731f749183.zip

SHA256 ba35528557e156f228b986b34c74569171736d07d38b9c05fead7fa2607b9ebe
MD5 180fa76a635d6274e2ccfdc2700ee91d
SHA1 97a3f10f69bc0406d1220f9633d6d2fe470d0499
SHA512 c88b4ffaed7f419513c50f4ed83a07ad0027f0dc73ac26042c58ba94beb09a1970a5a5d9a45681de7b1dc7ccf0c26f216bd6c6801aab751bf00d0245dfe8ba18
SSDEEP 393216:5cUkHvRZ88tGkyZP5bY/R6ZGvzH9Hh/0lTVF3RM:aHpnGkE21vzH9Hh/gTVI
TLSH
T13FD6337AB3659F2D4D9D800870AAA014B7F583357AF4E99B4E290B4FF275B9D0E001B7
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

c1621c589b5564daaa7bccd3276c34348529ba749890de50dde077731f749183

IMPHASH 1554b51f4134de89b1033d08170086c9
SHA256 c1621c589b5564daaa7bccd3276c34348529ba749890de50dde077731f749183
MD5 cdc7090ab0330cc6bc915434dce90827
SHA1 e0a66c04c8ef9bdf262bbc9c7e07881586e45456
SHA512 37e8d811834eed8da2fb254304b8315b9486caa13bec064a943ee61e378c8cd98c6c7778546951e16a20e374e354605c692f4a76f6be7a9bdc8aa4d5b78a4944
SSDEEP 786432:3UQfYO/CtpaM1mrrZBiT/BCmSJZW8Qk69s:3UPhE
TLSH
T1DA678D40E797ABA4C8860431205FBB3BA7385D198319CBF3D7D46E75A8737C1197AB0A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detect suspicious telegram bot

Detect suspicious telegram bot.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Password

infected

PE Signature issue

Digest

a0:f9:fe:4b:0c:ca:d6:90:14:69:b6:81:7c:f0:50:d1:0a:6d:e7:51:be:f7:3b:cc:71:1e:b7:46:0d:1b:b6:82

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=53481265A,CN=PURSLANE,O=PURSLANE,ST=North West,C=SG,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Aug 10, 2026

SERIALNUMBER=53481265A,CN=PURSLANE,O=PURSLANE,ST=North West,C=SG,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025347

Subject

SERIALNUMBER=53481265A,CN=PURSLANE,O=PURSLANE,ST=North West,C=SG,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13025347

Serial Number

79:1e:01:e2:77:1b:0f:0b:68:94:6e:42:93:0d:86:a1

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 5, 2026 - Feb 22, 2028

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

Major OS version

Entry point

20474812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalFree TerminateProcess CreateNamedPipeW CreateEventW ConnectNamedPipe GetOverlappedResult CreateToolhelp32Snapshot GetSystemDirectoryW Process32NextW GetLastError LoadLibraryExA GetTimeZoneInformationForYear FormatMessageW GetProcessHeap HeapFree QueryFullProcessImageNameW OpenProcess GetCurrentProcess GetNamedPipeClientProcessId Process32FirstW GetExitCodeProcess SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW FreeLibraryAndExitThread ExitThread InitializeCriticalSectionAndSpinCount RaiseException RtlUnwind GetCPInfo HeapFree AddVectoredExceptionHandler SetThreadStackGuarantee GetLastError GetProcessHeap HeapAlloc HeapReAlloc Sleep GlobalAlloc GlobalLock GlobalUnlock GlobalSize GetCurrentThread AcquireSRWLockExclusive TlsGetValue TlsSetValue WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcessId CreateMutexA CloseHandle ReleaseMutex GetCurrentProcess lstrlenW WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared GlobalFree MultiByteToWideChar CreateEventA SwitchToThread SetEvent GetCurrentThreadId SetThreadPriority WaitForMultipleObjectsEx ReleaseSemaphore GetSystemInfo SetErrorMode SetThreadErrorMode FormatMessageW GetFileType GetNamedPipeInfo ReadFile WriteFile TryAcquireSRWLockExclusive CreateFileMappingW MapViewOfFile DuplicateHandle VirtualProtect UnmapViewOfFile FindClose WaitForSingleObject VerSetConditionMask VerifyVersionInfoW RtlCaptureContext GetLogicalDrives SetFileTime GetLogicalProcessorInformationEx CreateFileW GetConsoleMode SetConsoleMode GetStdHandle PostQueuedCompletionStatus WakeAllConditionVariable SetFilePointerEx GetFileInformationByHandleEx SleepConditionVariableSRW GetExitCodeProcess LocalFree LocalAlloc ProcessIdToSessionId ConnectNamedPipe FlushFileBuffers FindNextFileW OpenProcess lstrcmpiW QueryPerformanceFrequency GetModuleHandleExA DeviceIoControl GetNativeSystemInfo TerminateProcess WTSGetActiveConsoleSessionId VirtualAllocEx WriteProcessMemory GetModuleHandleA QueueUserAPC ResumeThread FileTimeToSystemTime SetThreadExecutionState GetUserPreferredUILanguages SetEnvironmentVariableW LoadLibraryExW SetDllDirectoryW SetLastError CreateMutexW CreateSemaphoreA SetConsoleCtrlHandler GlobalMemoryStatusEx K32GetPerformanceInfo SetHandleInformation LoadLibraryExA GetModuleHandleW GetQueuedCompletionStatusEx GetOverlappedResult CancelIoEx CreateIoCompletionPort SetFileCompletionNotificationModes LoadLibraryW GetLogicalProcessorInformation CreateNamedPipeW FreeEnvironmentStringsW ExpandEnvironmentStringsW CreatePipe InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateProcessW WakeConditionVariable FreeLibrary OpenFileMappingW InitOnceBeginInitialize TlsAlloc InitOnceComplete TlsFree WriteConsoleW QueryPerformanceCounter GetCurrentDirectoryW GetEnvironmentVariableW GetEnvironmentStringsW GetTempPathW GetModuleFileNameW GetCommandLineW GetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW CreateDirectoryW FindFirstFileW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW CreateThread ReadFileEx SleepEx WriteFileEx WaitForMultipleObjects CreateEventW CancelIo ExitProcess GetSystemTimeAsFileTime DeleteFileW MoveFileExW RemoveDirectoryW CreateSymbolicLinkW CopyFileExW GetTickCount64 GetProcessTimes GetSystemTimes GetProcessIoCounters GetComputerNameExW VirtualQuery FormatMessageA CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileSize GetFileTime SetFilePointer InitializeSRWLock ResetEvent InitializeCriticalSectionEx DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateSemaphoreW InitializeConditionVariable SleepConditionVariableCS TryEnterCriticalSection GetConsoleScreenBufferInfo SetConsoleTextAttribute CreateJobObjectW AssignProcessToJobObject SetInformationJobObject InitializeCriticalSection GetModuleHandleExW GetProcessAffinityMask MoveFileExA GetCommandLineA ReadConsoleW GetConsoleOutputCP FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringW GetFileSizeEx IsValidCodePage GetACP LCMapStringEx DecodePointer EncodePointer GetLocaleInfoEx GetOEMCP HeapSize HeapQueryInformation GetStringTypeW GetTimeZoneInformation SetStdHandle SetEndOfFile GetStartupInfoW IsDebuggerPresent InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent FindFirstFileExW GetProcessId

advapi32

CreateProcessAsUserW ConvertSidToStringSidW OpenProcessToken ConvertStringSidToSidW SetNamedSecurityInfoW SetEntriesInAclW GetNamedSecurityInfoW GetTokenInformation SetSecurityDescriptorDacl CreateWellKnownSid GetLengthSid InitializeSecurityDescriptor IsWellKnownSid RegQueryInfoKeyW CreateProcessWithTokenW ImpersonateLoggedOnUser DuplicateTokenEx RegDeleteKeyW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle LookupAccountSidW RegEnumValueW AdjustTokenPrivileges LookupPrivilegeValueW CopySid GetLengthSid IsValidSid DuplicateToken EqualSid LogonUserW CreateProcessWithLogonW CreateProcessAsUserW RegEnumKeyExW GetTokenInformation OpenProcessToken RegDeleteTreeW GetUserNameW SystemFunction036 RegSetValueExW RegQueryValueExW RegDeleteValueW RegCloseKey RegOpenKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl FreeSid AllocateAndInitializeSid SetEntriesInAclW InitializeSecurityDescriptor SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RevertToSelf ImpersonateAnonymousToken

oleaut32

GetErrorInfo SysFreeString SysStringLen SysStringLen SysFreeString GetErrorInfo

ole32

CoInitializeEx PropVariantClear RevokeDragDrop RegisterDragDrop CoInitializeEx CoUninitialize CoCreateInstance CoTaskMemFree ReleaseStgMedium OleIsCurrentClipboard OleGetClipboard OleSetClipboard OleUninitialize CoTaskMemAlloc OleInitialize CoUninitialize CoCreateInstance CoTaskMemFree StringFromGUID2

shell32

SHAppBarMessage ShellExecuteA SHAddToRecentDocs Shell_NotifyIconGetRect DragFinish DragQueryFileW SHGetKnownFolderPath Shell_NotifyIconW SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

shlwapi

SHCreateMemStream

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock CreateEnvironmentBlock DestroyEnvironmentBlock GetUserProfileDirectoryW

sas

SendSAS

newdev

UpdateDriverForPlugAndPlayDevicesW

wtsapi32

WTSEnumerateSessionsA WTSQuerySessionInformationW WTSFreeMemory

user32

DestroyAcceleratorTable CreateAcceleratorTableW CheckMenuItem PostQuitMessage MessageBoxW SystemParametersInfoA GetActiveWindow GetMenuItemInfoW GetMenuBarInfo MapWindowPoints OffsetRect GetWindowDC PostThreadMessageW FillRect MapVirtualKeyW PeekMessageW DrawTextW CreateMenu CreatePopupMenu AppendMenuW ValidateRect DrawIconEx SetMenuItemInfoW TrackPopupMenu GetRawInputData MsgWaitForMultipleObjectsEx GetCursorPos DestroyIcon DestroyMenu AttachThreadInput GetSystemMetrics LockWorkStation GetCursorInfo EnumDisplaySettingsW RegisterClassExW SystemParametersInfoW ChangeDisplaySettingsExW DefWindowProcA BlockInput LoadCursorA RegisterClassExA CreateWindowExA ToUnicodeEx RemoveMenu DrawMenuBar SetMenu SetCursor SendMessageW ChangeWindowMessageFilterEx RegisterClassW RedrawWindow RegisterRawInputDevices ShowWindow EnumDisplayDevicesW PostThreadMessageA EnumDisplaySettingsExW ClientToScreen IsWindow RegisterTouchWindow CreateIcon GetClientRect DefWindowProcW CloseTouchInputHandle GetAsyncKeyState ExitWindowsEx RegisterWindowMessageA GetMenu AdjustWindowRectEx GetMessageW SetPropW GetSystemMenu EnableMenuItem GetClipCursor ClipCursor ShowCursor ScreenToClient GetTouchInputInfo SetWindowsHookExA LoadCursorW KillTimer SetTimer ReleaseCapture SetForegroundWindow SetWindowTextW OpenInputDesktop SetThreadDesktop CloseDesktop GetThreadDesktop GetUserObjectInformationA PeekMessageA SendMessageA SetCapture wsprintfW GetClipboardSequenceNumber GetClipboardOwner SetClipboardViewer ChangeClipboardChain RegisterClipboardFormatA CountClipboardFormats GetClipboardFormatNameA EmptyClipboard GetUpdateRect UnhookWindowsHookEx GetMessageA DestroyWindow RemoveClipboardFormatListener TranslateMessage DispatchMessageA GetDesktopWindow DispatchMessageW OpenClipboard AddClipboardFormatListener SetClipboardData CreateWindowExW PostMessageW CallNextHookEx ReleaseDC GetIconInfo SetWindowLongW AllowSetForegroundWindow IsClipboardFormatAvailable TrackMouseEvent GetClipboardData RegisterClipboardFormatW GetMonitorInfoA GetDC GetWindowRect IsWindowVisible EnumDisplayMonitors PostMessageA GetWindowPlacement FindWindowExA GetKeyState VkKeyScanExW MapVirtualKeyExW GetKeyboardLayout GetWindowThreadProcessId GetForegroundWindow SendInput GetKeyboardState MonitorFromRect SetWindowPlacement GetMonitorInfoW InvalidateRgn SetWindowPos MonitorFromWindow IsProcessDPIAware GetWindowLongW CloseClipboard

gdi32

CreateDIBSection CreateDCW SetTextColor SetBkMode CreateSolidBrush SelectObject CreateCompatibleDC GetBitmapBits GetObjectA BitBlt GetDeviceCaps CreateCompatibleBitmap CreateRectRgn DeleteDC GetDIBits CreateDIBitmap DeleteObject

iphlpapi

GetAdaptersAddresses SendARP GetBestInterface

ws2_32

freeaddrinfo getaddrinfo WSASocketW WSACleanup getsockname getsockopt WSAGetLastError recvfrom ioctlsocket sendto getpeername WSASend accept listen send recv connect WSAStartup WSAIoctl socket shutdown bind closesocket setsockopt

pdh

PdhOpenQueryA PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhAddEnglishCounterA PdhCollectQueryData PdhCollectQueryDataEx PdhRemoveCounter PdhCloseQuery

crypt32

CertOpenStore CertGetEnhancedKeyUsage CertVerifyTimeValidity CertVerifyCertificateChainPolicy CertDuplicateCertificateChain CertGetCertificateChain CertFreeCertificateContext CertCloseStore CertAddCertificateContextToStore CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain

secur32

QueryContextAttributesW FreeCredentialsHandle DecryptMessage AcquireCredentialsHandleA FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext DeleteSecurityContext ApplyControlToken EncryptMessage

ntdll

RtlGetNtVersionNumbers NtQuerySystemInformation RtlGetVersion NtDeviceIoControlFile RtlNtStatusToDosError NtCreateFile NtWriteFile NtCancelIoFileEx NtReadFile

winspool.drv

InstallPrinterDriverFromPackageW AddPrinterW UploadPrinterDriverPackageW EnumPrinterDriversW GetDefaultPrinterW EnumPrintersW EnumPortsW OpenPrinterW XcvDataW ClosePrinter SetPrinterW DeletePrinter DeletePrinterDriverExW DeletePrinterDriverPackageW

setupapi

SetupDiEnumDeviceInfo SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiSetDeviceRegistryPropertyW SetupDiCallClassInstaller SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiGetDeviceInfoListDetailW SetupDiSetClassInstallParamsW SetupDiGetDeviceInstallParamsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsExW

cfgmgr32

CM_Get_DevNode_Status

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass

dwmapi

DwmEnableBlurBehindWindow

bcrypt

BCryptGenRandom BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice

psapi

GetModuleFileNameExW GetProcessMemoryInfo

powrprof

CallNtPowerInformation

Name

.text

Size

20.0MB

Virtual Size

20.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

483KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

814KB

Virtual Size

814KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c1621c589b5564daaa7bccd3276c34348529ba749890de50dde077731f749183.zip

c1621c589b5564daaa7bccd3276c34348529ba749890de50dde077731f749183

PE Signature issue

kernel32

advapi32

oleaut32

ole32

shell32

shlwapi

userenv

sas

newdev

wtsapi32

user32

gdi32

iphlpapi

ws2_32

pdh

crypt32

secur32

ntdll

winspool.drv

setupapi

cfgmgr32

comctl32

dwmapi

bcrypt

dxgi

d3d11

psapi

powrprof

generic