2ae0986b6941f793567a91003162e994a67e10be583152a5dddd0b662d823b8b[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
2ae0986b6941f793567a91003162e994a67e10be583152a5dddd0b662d823b8b.zip
Size 2.7MB
Sample260818-ty1a6axtcs
SHA256 8598cc58e1b0a683af36dd36e9285261894d9238ac125f9164a4b5e74ed14698
MD5 50d96a62b6ce8cb9581ec95bf098860c
SHA1 dd2c3309308c97bf693651c664aaa16687563afc
SHA512 0788029322f36b5c3368ca4133414d113ace94c444ed42d7a898535e4720a7c66147a6ffc00616adcf6aa6044d023bfac27ca546cafd214bcc1442f2ca63202a
SSDEEP 49152:Wc+oEgLC1mhLWIXW2/c1yIzyG2a69U5gOyntSOXS0BzP1pltSRlefo:7EgOIfmJ1yIuR9lOynAGfV3Gn
TLSH
T1A9D5333F050ABBD08F56F4F686613998DE747148257F87F279DB08C92213EEE4246EA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/2ae0986b6941f793567a91003162e994a67e10be583152a5dddd0b662d823b8b	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2ae0986b6941f793567a91003162e994a67e10be583152a5dddd0b662d823b8b

File Explorer

2ae0986b6941f793567a91003162e994a67e10be583152a5dddd0b662d823b8b.zip

.zip 2.7MB
2ae0986b6941f793567a91003162e994a67e10be583152a5dddd0b662d823b8b

.exe 6.5MB

2ae0986b6941f793567a91003162e994a67e10be583152a5dddd0b662d823b8b.zip

SHA256 8598cc58e1b0a683af36dd36e9285261894d9238ac125f9164a4b5e74ed14698
MD5 50d96a62b6ce8cb9581ec95bf098860c
SHA1 dd2c3309308c97bf693651c664aaa16687563afc
SHA512 0788029322f36b5c3368ca4133414d113ace94c444ed42d7a898535e4720a7c66147a6ffc00616adcf6aa6044d023bfac27ca546cafd214bcc1442f2ca63202a
SSDEEP 49152:Wc+oEgLC1mhLWIXW2/c1yIzyG2a69U5gOyntSOXS0BzP1pltSRlefo:7EgOIfmJ1yIuR9lOynAGfV3Gn
TLSH
T1A9D5333F050ABBD08F56F4F686613998DE747148257F87F279DB08C92213EEE4246EA1
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

2ae0986b6941f793567a91003162e994a67e10be583152a5dddd0b662d823b8b

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 2ae0986b6941f793567a91003162e994a67e10be583152a5dddd0b662d823b8b
MD5 05408adb79e9b40a70e0378952f2ee25
SHA1 e21475cb17bb42ffbe406b425c5d8744dc39d927
SHA512 b49e4427d2e89e09f017d9cc112139cef9b6df32fde4a86d1ea9e19d925b2749584a20d2d90434cc57860b8ac5a665826c6e7066a0222e357ffd79294d05fb01
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8j:T6BJUoROZfIA8Xf8xumvBh8huTEEmI
TLSH
T1B7665C13EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2ae0986b6941f793567a91003162e994a67e10be583152a5dddd0b662d823b8b.zip

2ae0986b6941f793567a91003162e994a67e10be583152a5dddd0b662d823b8b

kernel32

generic