e423a046a3ba0d044bbf08606ae129e34fe8ae9da39090beed0c63a87084f44b[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
e423a046a3ba0d044bbf08606ae129e34fe8ae9da39090beed0c63a87084f44b.zip
Size 2.7MB
Sample260814-vb5sssysaz
SHA256 d67cf035022e6f497409d3550798e7176aded95ff264bc1b3f2f33db4785b705
MD5 6434a6c4739d2356cf973ba37f2daaae
SHA1 4be15c7f17ca6aa2b922613aabc497d9a335d14e
SHA512 a3eb3039b485be7ddd6dd44dcbdc3b57b6f36231c11da7f2b0126d2b572d49719c42665c4610dfe69f6c7db8a17a34a028327d6ebb1117d9bcd802ec83635808
SSDEEP 49152:GBtHRv4R7fO8vl66xX+MY46GZ8nDAPPKY+g+X0pTZ1F4h/w0eSdd4nopuK:GDxv49nDxX+MYjGGubdZd9SYnoj
TLSH
T16FD533B818A251C0A419C4664FB5313B6B879C7725F6E3561FE0D381B05B2BB3891FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/e423a046a3ba0d044bbf08606ae129e34fe8ae9da39090beed0c63a87084f44b	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e423a046a3ba0d044bbf08606ae129e34fe8ae9da39090beed0c63a87084f44b

File Explorer

e423a046a3ba0d044bbf08606ae129e34fe8ae9da39090beed0c63a87084f44b.zip

.zip 2.7MB
e423a046a3ba0d044bbf08606ae129e34fe8ae9da39090beed0c63a87084f44b

.exe 6.5MB

e423a046a3ba0d044bbf08606ae129e34fe8ae9da39090beed0c63a87084f44b.zip

SHA256 d67cf035022e6f497409d3550798e7176aded95ff264bc1b3f2f33db4785b705
MD5 6434a6c4739d2356cf973ba37f2daaae
SHA1 4be15c7f17ca6aa2b922613aabc497d9a335d14e
SHA512 a3eb3039b485be7ddd6dd44dcbdc3b57b6f36231c11da7f2b0126d2b572d49719c42665c4610dfe69f6c7db8a17a34a028327d6ebb1117d9bcd802ec83635808
SSDEEP 49152:GBtHRv4R7fO8vl66xX+MY46GZ8nDAPPKY+g+X0pTZ1F4h/w0eSdd4nopuK:GDxv49nDxX+MYjGGubdZd9SYnoj
TLSH
T16FD533B818A251C0A419C4664FB5313B6B879C7725F6E3561FE0D381B05B2BB3891FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

e423a046a3ba0d044bbf08606ae129e34fe8ae9da39090beed0c63a87084f44b

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 e423a046a3ba0d044bbf08606ae129e34fe8ae9da39090beed0c63a87084f44b
MD5 0bd58ab1e84dd292a03cc9fcbbbb48fd
SHA1 df077497a93bdb44607105edf7ef03ad7b93acb6
SHA512 c0370a6ba0099538d08ef02cbc908ccf3e78da8e7b257dc193528f2e2164bc012474596a0202e187085e461c603456ce36d4119390dc1e95da5bf7904ab44b97
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8m:T6BJUoROZfIA8Xf8xumvBh8huTEEmaS
TLSH
T1AE665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

e423a046a3ba0d044bbf08606ae129e34fe8ae9da39090beed0c63a87084f44b.zip

e423a046a3ba0d044bbf08606ae129e34fe8ae9da39090beed0c63a87084f44b

kernel32

generic