4c6c508048af3f2aaf756650b046fd149db56ce8452c32970edf9a2db013c19c[.]zip

General

Target
4c6c508048af3f2aaf756650b046fd149db56ce8452c32970edf9a2db013c19c.zip
Size 1.1MB
Sample260817-wxaefsch93
SHA256 c5fd650725f2a238a800cd9291748f42509f4a57d3ffdda07983f3066fd64b70
MD5 60487c311f278b77325c385a34d7034a
SHA1 111601e314f7831c3cf31a0d4df78b08b018f1f1
SHA512 641e3539b573b6f5bad4d638b6069d97d0993fd50a4c452da92240c38fd49c56cb843025142b3cdd14351ffb87db265396e5c16432399d15ae8bc2a0d994248a
SSDEEP 24576:7KkozNv7xFqGA0+/LAwbAvu7Gi3YlN0zfoWia:7KzzBlFqVvJbAM3Y/aoWn
TLSH
T1083533B9C0810E1F04EF421A7EED41F28F5F4ECA48ADA67F6064F5DC725B16804C66AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/4c6c508048af3f2aaf756650b046fd149db56ce8452c32970edf9a2db013c19c	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4c6c508048af3f2aaf756650b046fd149db56ce8452c32970edf9a2db013c19c

4c6c508048af3f2aaf756650b046fd149db56ce8452c32970edf9a2db013c19c.zip

.zip 1.1MB
4c6c508048af3f2aaf756650b046fd149db56ce8452c32970edf9a2db013c19c

.exe 2.2MB

SHA256 c5fd650725f2a238a800cd9291748f42509f4a57d3ffdda07983f3066fd64b70
MD5 60487c311f278b77325c385a34d7034a
SHA1 111601e314f7831c3cf31a0d4df78b08b018f1f1
SHA512 641e3539b573b6f5bad4d638b6069d97d0993fd50a4c452da92240c38fd49c56cb843025142b3cdd14351ffb87db265396e5c16432399d15ae8bc2a0d994248a
SSDEEP 24576:7KkozNv7xFqGA0+/LAwbAvu7Gi3YlN0zfoWia:7KzzBlFqVvJbAM3Y/aoWn
TLSH
T1083533B9C0810E1F04EF421A7EED41F28F5F4ECA48ADA67F6064F5DC725B16804C66AE
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

SHA256 4c6c508048af3f2aaf756650b046fd149db56ce8452c32970edf9a2db013c19c
MD5 23a4a517885d264db4891b6932418338
SHA1 a2aa814e660c8f51d4dfba9f526d0f3675e77754
SHA512 711f9372dcdb4f3db81c5b8ad3b1db90ae25491e81c6eead6eba9a3e7c5eac749b6ba76e8f6c27a1bf10d24a2f0207506a167f4c5fbfeb256219d599b410e281
SSDEEP 49152:61Km8DBOtaxOfkuq9/vJwq5NmKP/bk7ktyJM:rDxCkuMJwq5sgb
TLSH
T156A5AF02FB8294B2E48206B495BB6B7F4D3EAA144334C9D3D7D029758D312D16B3B7E9
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Minor OS version

0

Major OS version

6

Entry point

302975

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths