950a7e11ddf5fe47a0ca4f0b88decb58ff3cf8f5ffc108d2c85890e13a5ccd5f[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
950a7e11ddf5fe47a0ca4f0b88decb58ff3cf8f5ffc108d2c85890e13a5ccd5f.zip
Size 2.7MB
Sample260824-t11ppsan21
SHA256 b77fda27cf3e5c7d2077144f8f9d7ab1cbb415013a95d733b12389ab19490a59
MD5 9dcf795f43a6ba7409ed85ca25c63b11
SHA1 4a4c9f041261319be41a3002f969780188ec8607
SHA512 f6afed9758f350fae9d98eb2ec404a2777891da5e7e6a6248281e0a810f7f397f0d49d08e99ed08e79a79cca262036ca3826275d047e27e2f4de8b302fcb233b
SSDEEP 49152:HzEFGMX9R3AsC6weQm3PKNCM+5mdIRwfvRxynFsdVcMWpbC5xpfdTBh8m9:HAjBt4Rm3SN4lR8ZksdM9C5xp1L8m9
TLSH
T12CD533E71FAE36614125DF82059338AF9E630316C5F0DE43B986B6631A04CA4E29BF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/950a7e11ddf5fe47a0ca4f0b88decb58ff3cf8f5ffc108d2c85890e13a5ccd5f	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/950a7e11ddf5fe47a0ca4f0b88decb58ff3cf8f5ffc108d2c85890e13a5ccd5f

File Explorer

950a7e11ddf5fe47a0ca4f0b88decb58ff3cf8f5ffc108d2c85890e13a5ccd5f.zip

.zip 2.7MB
950a7e11ddf5fe47a0ca4f0b88decb58ff3cf8f5ffc108d2c85890e13a5ccd5f

.exe 6.5MB

950a7e11ddf5fe47a0ca4f0b88decb58ff3cf8f5ffc108d2c85890e13a5ccd5f.zip

SHA256 b77fda27cf3e5c7d2077144f8f9d7ab1cbb415013a95d733b12389ab19490a59
MD5 9dcf795f43a6ba7409ed85ca25c63b11
SHA1 4a4c9f041261319be41a3002f969780188ec8607
SHA512 f6afed9758f350fae9d98eb2ec404a2777891da5e7e6a6248281e0a810f7f397f0d49d08e99ed08e79a79cca262036ca3826275d047e27e2f4de8b302fcb233b
SSDEEP 49152:HzEFGMX9R3AsC6weQm3PKNCM+5mdIRwfvRxynFsdVcMWpbC5xpfdTBh8m9:HAjBt4Rm3SN4lR8ZksdM9C5xp1L8m9
TLSH
T12CD533E71FAE36614125DF82059338AF9E630316C5F0DE43B986B6631A04CA4E29BF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

950a7e11ddf5fe47a0ca4f0b88decb58ff3cf8f5ffc108d2c85890e13a5ccd5f

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 950a7e11ddf5fe47a0ca4f0b88decb58ff3cf8f5ffc108d2c85890e13a5ccd5f
MD5 00dd82a7c3fe5f03985e34f0d39001bf
SHA1 04f6d3bc727701946091e422298008fd865c6e54
SHA512 9d3855202a81ac302c1c3fb044b2bac8b5a72da47cff4d3138f8c2451136dcaa0d2fa4496663a70081654af86c80a82d7b72fbfe0ce8cd60b67b83c077c9c7ce
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f89:T6BJUoROZfIA8Xf8xumvBh8huTEEmk
TLSH
T10B665C13EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

950a7e11ddf5fe47a0ca4f0b88decb58ff3cf8f5ffc108d2c85890e13a5ccd5f.zip

950a7e11ddf5fe47a0ca4f0b88decb58ff3cf8f5ffc108d2c85890e13a5ccd5f

kernel32

generic