24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8[.]zip

General

Target
24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.zip
Size 4.0MB
Sample260820-vafsaaee68
SHA256 21aef7add5312504f1cb5faf64f674ed880f985f5bc093f8e30fa6cd62173e6a
MD5 0b64b5e80064ae5919c112ac4b27a10a
SHA1 45cb4794a1fe0f66fb3416d33fa729519e5b7245
SHA512 e2fd9ef84ba915e1245f95ef9290bda2251001d9d64cff404f5a4bc59c3109aa70700ce71afb36233233d6edc1b9b3d4f2ad58630a13c42166328f08cd9bc0e8
SSDEEP 98304:QrQc9S3kybhCCWeMMSQOHS6MCsvJB867cbx4ZkCvuyBMqaHTUevk0:QkCafFpWeMMSQOyvP6b0kAiHTUH0
TLSH
T10D163331297416F2D97A042EE3D8AFC58434BAF5E96AF0E33F8465B9D0B67713E24016
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8

File Explorer

24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.zip

.zip 4.0MB
24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8

.exe 9.4MB

24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.zip

SHA256 21aef7add5312504f1cb5faf64f674ed880f985f5bc093f8e30fa6cd62173e6a
MD5 0b64b5e80064ae5919c112ac4b27a10a
SHA1 45cb4794a1fe0f66fb3416d33fa729519e5b7245
SHA512 e2fd9ef84ba915e1245f95ef9290bda2251001d9d64cff404f5a4bc59c3109aa70700ce71afb36233233d6edc1b9b3d4f2ad58630a13c42166328f08cd9bc0e8
SSDEEP 98304:QrQc9S3kybhCCWeMMSQOHS6MCsvJB867cbx4ZkCvuyBMqaHTUevk0:QkCafFpWeMMSQOyvP6b0kAiHTUH0
TLSH
T10D163331297416F2D97A042EE3D8AFC58434BAF5E96AF0E33F8465B9D0B67713E24016
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8

SHA256 24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8
MD5 d44a85470021670bc9fea8ae31e9bc3a
SHA1 c056e616dfb23ae26e342e1c5b45a5830461deaa
SHA512 9b261242c617eda86eeb161133ec042926b993ae4a8b717e5a5ea7901019d6703efeffddc138c25d6043cf09dbfb7fa964ab99fbd9f6d62446bb72efff89f803
SSDEEP 98304:Ni0MdnxV0CKFA0WvkFUjr1KDBGYklYKnmYhUwpz8tlU8QdmjJiML7EC:C30CKFAjvrlKDBGYgSFgelLKC
TLSH
T1EAA63840EEDB51F6F943197141ABB27F23341D098F28DB97EB417F6AE8776921832206
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

6

Entry point

493328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

397KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

186KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8.zip

24a5a23930e0f5f9d898d26b155508f21afc9c732c49a2e05a4059834f6005c8

generic