2a330f2b0e28af98ec03de378db5ff350264dff47d97b1902b0ff541aab853a1[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
2a330f2b0e28af98ec03de378db5ff350264dff47d97b1902b0ff541aab853a1.zip
Size 2.7MB
Sample260822-wrhtmsswaw
SHA256 693f62aa49c252b2b9eb819884b5cb5dd1b54fab1c7e75141219707d97c63301
MD5 55c877deb3e7ba8d54b41254e2eece68
SHA1 d68922ea311069c35f85543951b4398293990ce8
SHA512 2cda933e663a32944e47f3fd91e039119e2a612534627d14f78a02e3babedb76d25c365efe84a3b4cc0053125fde020b45cb9331da6b71e2aea09a5bf7b30ae5
SSDEEP 49152:+gL84xfl1/Y96puQmTbdxh5GRnvzEDhbHjWlfZcTy/SFbPc7gmOYhv/d4i:+ct1mQg5tivzEZjWlfZhSCpOYhnb
TLSH
T12AD533F36D88BBD347FB68FC99310148F43CA505988A5918EBB9DF80BC12C96D89957C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/2a330f2b0e28af98ec03de378db5ff350264dff47d97b1902b0ff541aab853a1	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2a330f2b0e28af98ec03de378db5ff350264dff47d97b1902b0ff541aab853a1

File Explorer

2a330f2b0e28af98ec03de378db5ff350264dff47d97b1902b0ff541aab853a1.zip

.zip 2.7MB
2a330f2b0e28af98ec03de378db5ff350264dff47d97b1902b0ff541aab853a1

.exe 6.5MB

2a330f2b0e28af98ec03de378db5ff350264dff47d97b1902b0ff541aab853a1.zip

SHA256 693f62aa49c252b2b9eb819884b5cb5dd1b54fab1c7e75141219707d97c63301
MD5 55c877deb3e7ba8d54b41254e2eece68
SHA1 d68922ea311069c35f85543951b4398293990ce8
SHA512 2cda933e663a32944e47f3fd91e039119e2a612534627d14f78a02e3babedb76d25c365efe84a3b4cc0053125fde020b45cb9331da6b71e2aea09a5bf7b30ae5
SSDEEP 49152:+gL84xfl1/Y96puQmTbdxh5GRnvzEDhbHjWlfZcTy/SFbPc7gmOYhv/d4i:+ct1mQg5tivzEZjWlfZhSCpOYhnb
TLSH
T12AD533F36D88BBD347FB68FC99310148F43CA505988A5918EBB9DF80BC12C96D89957C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

2a330f2b0e28af98ec03de378db5ff350264dff47d97b1902b0ff541aab853a1

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 2a330f2b0e28af98ec03de378db5ff350264dff47d97b1902b0ff541aab853a1
MD5 1909476d03ffb63950469e3de2737cd4
SHA1 ba89225978e801106a07e08f453d8c6798d373ec
SHA512 748652d2406ea054fedeac3660bcadda4b875c57b398bad3fa58d2be04edc131d41fe8dd43985025cd712c226e0cbb3248870f398e7aa53303302353de1022dc
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8y:T6BJUoROZfIA8Xf8xumvBh8huTEEmV
TLSH
T161665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2a330f2b0e28af98ec03de378db5ff350264dff47d97b1902b0ff541aab853a1.zip

2a330f2b0e28af98ec03de378db5ff350264dff47d97b1902b0ff541aab853a1

kernel32

generic