33d37423e9705d5acc04d829fb429743248c8c78c9ed3b2a93a6e30cca563152[.]zip

General

Target
33d37423e9705d5acc04d829fb429743248c8c78c9ed3b2a93a6e30cca563152.zip
Size 373KB
Sample260818-1dpr9abe95
SHA256 11a7450f219625c89995ee40c3a3e9b8cc150d5977f2ddea75bf8dc3137ecf2e
MD5 31f77f33bd903e281bf5e8b44b99139e
SHA1 8ab5f7e4f12ac6b53087ec573a6c1462712d0f02
SHA512 517c734d29e2dcf8314b06839748e10b8e1f16e8284097a017502d906b1903deb8094148e0aff35a2955120ce5b3c6874284f43b94179569a88b945d8dcf0f88
SSDEEP 6144:7Irze8vB8/IatAxIRjNXMsVeJtgrCSx5rH/S7j+9gAwXAHWzPtP0BG3exD4uTO85:8rzeGBitpN0vgd3bK7j+mrlSGCLO87NL
TLSH
T1B78423006E896D81D06F3EE58805ACC6A7926C413EBE263C74B6D7AF5639CF35580DB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/33d37423e9705d5acc04d829fb429743248c8c78c9ed3b2a93a6e30cca563152	suspicious_telegram_bot

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/33d37423e9705d5acc04d829fb429743248c8c78c9ed3b2a93a6e30cca563152	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/33d37423e9705d5acc04d829fb429743248c8c78c9ed3b2a93a6e30cca563152

File Explorer

33d37423e9705d5acc04d829fb429743248c8c78c9ed3b2a93a6e30cca563152.zip

.zip 373KB
33d37423e9705d5acc04d829fb429743248c8c78c9ed3b2a93a6e30cca563152

.exe 820KB

33d37423e9705d5acc04d829fb429743248c8c78c9ed3b2a93a6e30cca563152.zip

SHA256 11a7450f219625c89995ee40c3a3e9b8cc150d5977f2ddea75bf8dc3137ecf2e
MD5 31f77f33bd903e281bf5e8b44b99139e
SHA1 8ab5f7e4f12ac6b53087ec573a6c1462712d0f02
SHA512 517c734d29e2dcf8314b06839748e10b8e1f16e8284097a017502d906b1903deb8094148e0aff35a2955120ce5b3c6874284f43b94179569a88b945d8dcf0f88
SSDEEP 6144:7Irze8vB8/IatAxIRjNXMsVeJtgrCSx5rH/S7j+9gAwXAHWzPtP0BG3exD4uTO85:8rzeGBitpN0vgd3bK7j+mrlSGCLO87NL
TLSH
T1B78423006E896D81D06F3EE58805ACC6A7926C413EBE263C74B6D7AF5639CF35580DB1
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

33d37423e9705d5acc04d829fb429743248c8c78c9ed3b2a93a6e30cca563152

SHA256 33d37423e9705d5acc04d829fb429743248c8c78c9ed3b2a93a6e30cca563152
MD5 e2c170a1899eca338e3ec113f82696b3
SHA1 9c48e55b05e7d1bfcf528016db5e95bd3916af59
SHA512 dbb575e851aa362a5abd4d584b5bbfad5dc1ace41a6b2365583425a91c336883db617b856c4f2eeee00e45f0c4cc13399386ec393b8f8cbc02efddf458b764a4
SSDEEP 12288:nU1k28aHOA93TnRB5xAeJRYzx/uXbpb7ykox5r6f5y82XpdC8t:n+LHOA93TnRyIYF/EJy2zIPt
TLSH
T107053925F5A4C331D073C0B5C9E2AA9EEA3234924B3089CB5385877D6E677D2D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detect suspicious telegram bot

Detect suspicious telegram bot.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

6

Entry point

834080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing