4c071a7bb6877628bfad74551fddb0a1b6d71f72b8e785b4b88d85c9d1e921b5[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
4c071a7bb6877628bfad74551fddb0a1b6d71f72b8e785b4b88d85c9d1e921b5.zip
Size 2.7MB
Sample260824-t2xpfaeb93
SHA256 eafee3851524d82545feae7839df20b72b3b181659083930378df1073b0f6bd0
MD5 d6ba906fefb59fda22f4c77a0f6ca5f0
SHA1 b2c705661b1ce09c486c7fd12987d1862bfd41ad
SHA512 8322818e7a50f77e9dea10a571e409befa7480f00dff7138533d1dfc6c821abeeb93e59c93af07818f39e2d3c009fe462fea2b98d7e60a60e30104c7a9283d35
SSDEEP 49152:of+f3ZdcdIjS0KLlHk0Skx9wgEiwCcxadotOEvY8Dm72vGYLrFD:ogZdcSWTHN9ciwdxawvYp2/
TLSH
T167D533ECD52CD75575973F38F19F663A3E83A3386AB0B851A7149920B7B2CD218285CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/4c071a7bb6877628bfad74551fddb0a1b6d71f72b8e785b4b88d85c9d1e921b5	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4c071a7bb6877628bfad74551fddb0a1b6d71f72b8e785b4b88d85c9d1e921b5

File Explorer

4c071a7bb6877628bfad74551fddb0a1b6d71f72b8e785b4b88d85c9d1e921b5.zip

.zip 2.7MB
4c071a7bb6877628bfad74551fddb0a1b6d71f72b8e785b4b88d85c9d1e921b5

.exe 6.5MB

4c071a7bb6877628bfad74551fddb0a1b6d71f72b8e785b4b88d85c9d1e921b5.zip

SHA256 eafee3851524d82545feae7839df20b72b3b181659083930378df1073b0f6bd0
MD5 d6ba906fefb59fda22f4c77a0f6ca5f0
SHA1 b2c705661b1ce09c486c7fd12987d1862bfd41ad
SHA512 8322818e7a50f77e9dea10a571e409befa7480f00dff7138533d1dfc6c821abeeb93e59c93af07818f39e2d3c009fe462fea2b98d7e60a60e30104c7a9283d35
SSDEEP 49152:of+f3ZdcdIjS0KLlHk0Skx9wgEiwCcxadotOEvY8Dm72vGYLrFD:ogZdcSWTHN9ciwdxawvYp2/
TLSH
T167D533ECD52CD75575973F38F19F663A3E83A3386AB0B851A7149920B7B2CD218285CC
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

4c071a7bb6877628bfad74551fddb0a1b6d71f72b8e785b4b88d85c9d1e921b5

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 4c071a7bb6877628bfad74551fddb0a1b6d71f72b8e785b4b88d85c9d1e921b5
MD5 49566c38b5b8d96b93b042461484dc16
SHA1 da32161bfa5d7e325cbadcb61f864f1e34c5f025
SHA512 a948b074148579f99893b3b5b9ccae9ec9942526f9b96b7f2565ab7a7960accc11d5bd97a1fa3cd7830afe52d0b46547a5de58b9b2cdb688581ffd67d2a428b3
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8v:T6BJUoROZfIA8Xf8xumvBh8huTEEmY
TLSH
T1AC665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

4c071a7bb6877628bfad74551fddb0a1b6d71f72b8e785b4b88d85c9d1e921b5.zip

4c071a7bb6877628bfad74551fddb0a1b6d71f72b8e785b4b88d85c9d1e921b5

kernel32

generic