783c0677d873aa840a92ec334ce5549ad6f69513d56f32c6728bc3aff667e23f[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
783c0677d873aa840a92ec334ce5549ad6f69513d56f32c6728bc3aff667e23f.zip
Size 2.7MB
Sample260820-xf8flatdme
SHA256 ba289ecb2e7fc7235c2f4889176cfd006f0eb2bc78f7304bacb85e39b088aa6d
MD5 d105a80ee8dd719ab550e56d09ab4d13
SHA1 b01c09cd22f60bd8225f6fb6b6b143357c8fb110
SHA512 4a8fc8bad33e212588b5c8285c2dda8a884983844f10bb9a92543aac8c6a8fb1c20d32fc14e4efa62db86ee3b0a7c72224a8e51c5a4af475c797df212386d8e8
SSDEEP 49152:M5ZW9+ppFRSe+7ifen26PAnzDT8Dp4IG1GigFOIzOk2YKoCbCY0ff9s:M5Zg+pp0ua2x0Dp4GibICRoCD0ds
TLSH
T1EFD533E658319016F763770B6392AD5B128F849E63721178F6A0ED5F638324F863ECE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/783c0677d873aa840a92ec334ce5549ad6f69513d56f32c6728bc3aff667e23f	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/783c0677d873aa840a92ec334ce5549ad6f69513d56f32c6728bc3aff667e23f

File Explorer

783c0677d873aa840a92ec334ce5549ad6f69513d56f32c6728bc3aff667e23f.zip

.zip 2.7MB
783c0677d873aa840a92ec334ce5549ad6f69513d56f32c6728bc3aff667e23f

.exe 6.5MB

783c0677d873aa840a92ec334ce5549ad6f69513d56f32c6728bc3aff667e23f.zip

SHA256 ba289ecb2e7fc7235c2f4889176cfd006f0eb2bc78f7304bacb85e39b088aa6d
MD5 d105a80ee8dd719ab550e56d09ab4d13
SHA1 b01c09cd22f60bd8225f6fb6b6b143357c8fb110
SHA512 4a8fc8bad33e212588b5c8285c2dda8a884983844f10bb9a92543aac8c6a8fb1c20d32fc14e4efa62db86ee3b0a7c72224a8e51c5a4af475c797df212386d8e8
SSDEEP 49152:M5ZW9+ppFRSe+7ifen26PAnzDT8Dp4IG1GigFOIzOk2YKoCbCY0ff9s:M5Zg+pp0ua2x0Dp4GibICRoCD0ds
TLSH
T1EFD533E658319016F763770B6392AD5B128F849E63721178F6A0ED5F638324F863ECE1
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

783c0677d873aa840a92ec334ce5549ad6f69513d56f32c6728bc3aff667e23f

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 783c0677d873aa840a92ec334ce5549ad6f69513d56f32c6728bc3aff667e23f
MD5 0dd86dfbdaae9c10a913205c729e3e0b
SHA1 49933d212f726dc3cf7440266d9b04d8ddb8bfa6
SHA512 2f9f807aa9e6c1ff6397de0ca84d8dc1a0ef5505d8c6717313468c46bac08b4732795a6ad0397baeb5ac73db61cd122f85fea2690b9bc87f2ac172501444bf43
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f81:T6BJUoROZfIA8Xf8xumvBh8huTEEmE
TLSH
T1F8665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

783c0677d873aa840a92ec334ce5549ad6f69513d56f32c6728bc3aff667e23f.zip

783c0677d873aa840a92ec334ce5549ad6f69513d56f32c6728bc3aff667e23f

kernel32

generic