38b3fa1070504e1e76eaf1f3a4e185b0a1651822600aec49f0cad27e2bc00b5d[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
38b3fa1070504e1e76eaf1f3a4e185b0a1651822600aec49f0cad27e2bc00b5d.zip
Size 2.7MB
Sample260814-vb858aep3v
SHA256 0bef0feb76d5555101934cbf7093b53fb3d104d1a64b0ff4c1205ec5791cd9ff
MD5 a7a03e34f743a14754ea75f6c7968c44
SHA1 42c07eb1132df78e3358e97b20331a2916007a64
SHA512 11d5e6f77c2a9749a53fc6af8a7f54a514ac8371bd78e3dba9827ad1e2816c4574c61e39b3f6642415d86b7ca5ed059bca7d784b94eb2b9a81d2a1031a29266c
SSDEEP 49152:9GK7/2rn1XC8XJbETCPioNGs5ON5oyDiqXwhVDWvKvUc7r6By2d5fv:xj2r1zXJbyocNuqXEVDWvKvUc7r65v
TLSH
T188D5331F0F1E4F71495DB2E972ADAC888366EA66D1CA37D58C775D2903098CFE21321B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/38b3fa1070504e1e76eaf1f3a4e185b0a1651822600aec49f0cad27e2bc00b5d	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/38b3fa1070504e1e76eaf1f3a4e185b0a1651822600aec49f0cad27e2bc00b5d

File Explorer

38b3fa1070504e1e76eaf1f3a4e185b0a1651822600aec49f0cad27e2bc00b5d.zip

.zip 2.7MB
38b3fa1070504e1e76eaf1f3a4e185b0a1651822600aec49f0cad27e2bc00b5d

.exe 6.5MB

38b3fa1070504e1e76eaf1f3a4e185b0a1651822600aec49f0cad27e2bc00b5d.zip

SHA256 0bef0feb76d5555101934cbf7093b53fb3d104d1a64b0ff4c1205ec5791cd9ff
MD5 a7a03e34f743a14754ea75f6c7968c44
SHA1 42c07eb1132df78e3358e97b20331a2916007a64
SHA512 11d5e6f77c2a9749a53fc6af8a7f54a514ac8371bd78e3dba9827ad1e2816c4574c61e39b3f6642415d86b7ca5ed059bca7d784b94eb2b9a81d2a1031a29266c
SSDEEP 49152:9GK7/2rn1XC8XJbETCPioNGs5ON5oyDiqXwhVDWvKvUc7r6By2d5fv:xj2r1zXJbyocNuqXEVDWvKvUc7r65v
TLSH
T188D5331F0F1E4F71495DB2E972ADAC888366EA66D1CA37D58C775D2903098CFE21321B
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

38b3fa1070504e1e76eaf1f3a4e185b0a1651822600aec49f0cad27e2bc00b5d

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 38b3fa1070504e1e76eaf1f3a4e185b0a1651822600aec49f0cad27e2bc00b5d
MD5 091eaf730ce4e729179537bd4f81e421
SHA1 174b27892f31fbfd7bd7830bb3904828a18b1696
SHA512 346e509458d64fa6a59793eec26ab177704642ea11d833d0e748f55709fe4b09604872f12c61d9ba8bda32ec346eecb8a7854b3167369f05c5427918273f5e33
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8l:T6BJUoROZfIA8Xf8xumvBh8huTEEmKZ
TLSH
T170665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

38b3fa1070504e1e76eaf1f3a4e185b0a1651822600aec49f0cad27e2bc00b5d.zip

38b3fa1070504e1e76eaf1f3a4e185b0a1651822600aec49f0cad27e2bc00b5d

kernel32

generic