f0a767128e1f808b78ff499a502fb86455e5d99d373fbc3bd4b170c950f28baa[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
f0a767128e1f808b78ff499a502fb86455e5d99d373fbc3bd4b170c950f28baa.zip
Size 2.7MB
Sample260825-wfxtesac52
SHA256 c92deba47edb79f7d77bf1475fdd3221dfda9355d92b72d7ec24201f2351c947
MD5 52d1dfabe88d91d61e4b9b74fc376b4d
SHA1 30e65decae7fa23776688222134dd56dcee0741e
SHA512 67b08ec11caacc76c0f3dbca6cf0785f2e0c9d3b5b2d0fdc930160e679d2be2920f4fd7175cf0b75a4ceb293151068c53f13a794cf9913a5cd0f1363360299ed
SSDEEP 49152:rUnT5CV/081plDVwxvhV19oTHiGZ/Pb9zV2h227jkTuM1W0BBMp:rI5k/081pV2xvhVroTHvNPtVMtYE
TLSH
T191D533D96C14497DF00F2B71E950FCA3628598DF6370E9C279D48A1CC98BDCA2725E8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/f0a767128e1f808b78ff499a502fb86455e5d99d373fbc3bd4b170c950f28baa	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f0a767128e1f808b78ff499a502fb86455e5d99d373fbc3bd4b170c950f28baa

File Explorer

f0a767128e1f808b78ff499a502fb86455e5d99d373fbc3bd4b170c950f28baa.zip

.zip 2.7MB
f0a767128e1f808b78ff499a502fb86455e5d99d373fbc3bd4b170c950f28baa

.exe 6.5MB

f0a767128e1f808b78ff499a502fb86455e5d99d373fbc3bd4b170c950f28baa.zip

SHA256 c92deba47edb79f7d77bf1475fdd3221dfda9355d92b72d7ec24201f2351c947
MD5 52d1dfabe88d91d61e4b9b74fc376b4d
SHA1 30e65decae7fa23776688222134dd56dcee0741e
SHA512 67b08ec11caacc76c0f3dbca6cf0785f2e0c9d3b5b2d0fdc930160e679d2be2920f4fd7175cf0b75a4ceb293151068c53f13a794cf9913a5cd0f1363360299ed
SSDEEP 49152:rUnT5CV/081plDVwxvhV19oTHiGZ/Pb9zV2h227jkTuM1W0BBMp:rI5k/081pV2xvhVroTHvNPtVMtYE
TLSH
T191D533D96C14497DF00F2B71E950FCA3628598DF6370E9C279D48A1CC98BDCA2725E8D
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

f0a767128e1f808b78ff499a502fb86455e5d99d373fbc3bd4b170c950f28baa

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 f0a767128e1f808b78ff499a502fb86455e5d99d373fbc3bd4b170c950f28baa
MD5 382c93b6ea5198767084f36817492384
SHA1 a071f5a8221f5b3e1a8379c4780b7ad8e8311755
SHA512 8b457eed7acf34247d26f398e85063bc5c04a9f622f21e37fed61266df4f909ef570028ee2ffcf8e53bca84654ad4b4e09947def47aa551372d961d3637b0924
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8H:T6BJUoROZfIA8Xf8xumvBh8huTEEmM
TLSH
T170665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

f0a767128e1f808b78ff499a502fb86455e5d99d373fbc3bd4b170c950f28baa.zip

f0a767128e1f808b78ff499a502fb86455e5d99d373fbc3bd4b170c950f28baa

kernel32

generic