26b80bb7133c9695e6c749e7fa90bbf6ea6483f8dc2b64e0b4d48d8aa1a1e83e[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
26b80bb7133c9695e6c749e7fa90bbf6ea6483f8dc2b64e0b4d48d8aa1a1e83e.zip
Size 2.7MB
Sample260817-y34atsyfjg
SHA256 5714d3b6013fa4ebfead04ecbdbe79ca9bc8b40d2d9eb5bcb02af026616bc05f
MD5 a0a852e30f4efe012037ce516b97da29
SHA1 a13f3bffbb543b69a165d9a5f8bff9c4d6e1f2b2
SHA512 ec61b47c78b81bd096d1894609264f8e6833a4a796d612c25f16048f75c42731b9363284eddc0eb0127014d70872df71d588a6d2d894845a54fa2c4ebf4465a6
SSDEEP 49152:GbXKsm2wSUYCjGd4USOBRmvn29btW6MhTLfHpYBQX5X+htqfHVjJI74u18vuFoC+:Gb42wSUYSGd4USODmv0bMhTL6BQXEhtS
TLSH
T118D53314D9A4CFFD0F93793F5B807C45045B95B36F2309A188B7580AE0E96FB58AA833
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/26b80bb7133c9695e6c749e7fa90bbf6ea6483f8dc2b64e0b4d48d8aa1a1e83e	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/26b80bb7133c9695e6c749e7fa90bbf6ea6483f8dc2b64e0b4d48d8aa1a1e83e

File Explorer

26b80bb7133c9695e6c749e7fa90bbf6ea6483f8dc2b64e0b4d48d8aa1a1e83e.zip

.zip 2.7MB
26b80bb7133c9695e6c749e7fa90bbf6ea6483f8dc2b64e0b4d48d8aa1a1e83e

.exe 6.5MB

26b80bb7133c9695e6c749e7fa90bbf6ea6483f8dc2b64e0b4d48d8aa1a1e83e.zip

SHA256 5714d3b6013fa4ebfead04ecbdbe79ca9bc8b40d2d9eb5bcb02af026616bc05f
MD5 a0a852e30f4efe012037ce516b97da29
SHA1 a13f3bffbb543b69a165d9a5f8bff9c4d6e1f2b2
SHA512 ec61b47c78b81bd096d1894609264f8e6833a4a796d612c25f16048f75c42731b9363284eddc0eb0127014d70872df71d588a6d2d894845a54fa2c4ebf4465a6
SSDEEP 49152:GbXKsm2wSUYCjGd4USOBRmvn29btW6MhTLfHpYBQX5X+htqfHVjJI74u18vuFoC+:Gb42wSUYSGd4USODmv0bMhTL6BQXEhtS
TLSH
T118D53314D9A4CFFD0F93793F5B807C45045B95B36F2309A188B7580AE0E96FB58AA833
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

26b80bb7133c9695e6c749e7fa90bbf6ea6483f8dc2b64e0b4d48d8aa1a1e83e

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 26b80bb7133c9695e6c749e7fa90bbf6ea6483f8dc2b64e0b4d48d8aa1a1e83e
MD5 10b6e5a1476b650f6ecc7ddb9aebff60
SHA1 d97d360f2582119d5d9b507f4776eb07ec8dc02c
SHA512 dd5a50428f3ea0e53c107bfb2424597f7c1afaf6cb38c9c96ffad92e4c729c9d0323242f25d1a5aee420bbca6370c52f0fae449661af24e1172167fd24c8c417
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8y:T6BJUoROZfIA8Xf8xumvBh8huTEEmj
TLSH
T173665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

26b80bb7133c9695e6c749e7fa90bbf6ea6483f8dc2b64e0b4d48d8aa1a1e83e.zip

26b80bb7133c9695e6c749e7fa90bbf6ea6483f8dc2b64e0b4d48d8aa1a1e83e

kernel32

generic