81b791a7bc8a8ee55a7c8453448283ae098f3b8af780702ea7cd2d315b2982ec[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
81b791a7bc8a8ee55a7c8453448283ae098f3b8af780702ea7cd2d315b2982ec.zip
Size 2.7MB
Sample260818-ty322sxtct
SHA256 520399b0f8be3bef88e6a04369ace253169c597ce809008c0c1e3d57a06518a8
MD5 28d7b88b74dddae55a83b308fc6d7349
SHA1 4ad098d746bade83327a91767c4d1f8822c7a845
SHA512 d1bf2f0495cfcb89d0758da975485ba2aac946bcd209a039b25c3ca9d24886aec9b3ef25efeea4d51a010cb0f7d2cbe8e977ffd44b1fd4f514be48f25e781cf7
SSDEEP 49152:AqKXJpAkjd8gGqn9OhD/8dG1WH4WTm9rgHNNVUTHjoWlxo+tXC+q:AqCpAQVsZEdG1y4WKct8vomXZq
TLSH
T14DD533FFD8207EB398AB7475070045AE8B0D62D607BE7EA05EB42FF0B4D9027A592745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/81b791a7bc8a8ee55a7c8453448283ae098f3b8af780702ea7cd2d315b2982ec	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/81b791a7bc8a8ee55a7c8453448283ae098f3b8af780702ea7cd2d315b2982ec

File Explorer

81b791a7bc8a8ee55a7c8453448283ae098f3b8af780702ea7cd2d315b2982ec.zip

.zip 2.7MB
81b791a7bc8a8ee55a7c8453448283ae098f3b8af780702ea7cd2d315b2982ec

.exe 6.5MB

81b791a7bc8a8ee55a7c8453448283ae098f3b8af780702ea7cd2d315b2982ec.zip

SHA256 520399b0f8be3bef88e6a04369ace253169c597ce809008c0c1e3d57a06518a8
MD5 28d7b88b74dddae55a83b308fc6d7349
SHA1 4ad098d746bade83327a91767c4d1f8822c7a845
SHA512 d1bf2f0495cfcb89d0758da975485ba2aac946bcd209a039b25c3ca9d24886aec9b3ef25efeea4d51a010cb0f7d2cbe8e977ffd44b1fd4f514be48f25e781cf7
SSDEEP 49152:AqKXJpAkjd8gGqn9OhD/8dG1WH4WTm9rgHNNVUTHjoWlxo+tXC+q:AqCpAQVsZEdG1y4WKct8vomXZq
TLSH
T14DD533FFD8207EB398AB7475070045AE8B0D62D607BE7EA05EB42FF0B4D9027A592745
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

81b791a7bc8a8ee55a7c8453448283ae098f3b8af780702ea7cd2d315b2982ec

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 81b791a7bc8a8ee55a7c8453448283ae098f3b8af780702ea7cd2d315b2982ec
MD5 1a838e92dac31b382d242dfa332070f2
SHA1 0275a053d047e27bd84be333812bb8c966de7744
SHA512 4959e0f42a97a8207f29d3ade998b1936d9690181ce68074e0e145477d81234d942fb8038aeb17080f9020ed4516e5accc8bf973e50ace8ebf606558b1f90779
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8p:T6BJUoROZfIA8Xf8xumvBh8huTEEmg
TLSH
T1BE665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

81b791a7bc8a8ee55a7c8453448283ae098f3b8af780702ea7cd2d315b2982ec.zip

81b791a7bc8a8ee55a7c8453448283ae098f3b8af780702ea7cd2d315b2982ec

kernel32

generic