667e5d0db61fca68bbbd5d2a4029b0e6e3185844fab467ad6229e2c7db969ea4[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
667e5d0db61fca68bbbd5d2a4029b0e6e3185844fab467ad6229e2c7db969ea4.zip
Size 2.7MB
Sample260826-xtdhdavdmc
SHA256 154b2f07bc3b2ae2817a204e07b659dc5d811f09117a03c880258a23d29cc4e3
MD5 ec8ed40717e7e5fbfa99a521ba5f8b67
SHA1 f52eff3334a608a061b3926cbbdbf055b8de6a15
SHA512 5b25e73598ca02da0a624f1847d6462fbf442c790842c15520df443adff5e3dd5d3345225bc79137185c78d9c5fa4ba93d96a1cedef72432c9c02597730085dd
SSDEEP 49152:gZYyJMiZkMj4MqCzq4405nidWnLHJ42uXGAEwXVYbTUeEtdrngLJ/u4NaLrNUwgL:gdJ0MlV405iwLH62ZqIUeEtdcLJ24sLi
TLSH
T103D53326235A7C70067B5276BE2B09C4E63DC20A556C7AB7858361880E7DC6E0FC76FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/667e5d0db61fca68bbbd5d2a4029b0e6e3185844fab467ad6229e2c7db969ea4	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/667e5d0db61fca68bbbd5d2a4029b0e6e3185844fab467ad6229e2c7db969ea4

File Explorer

667e5d0db61fca68bbbd5d2a4029b0e6e3185844fab467ad6229e2c7db969ea4.zip

.zip 2.7MB
667e5d0db61fca68bbbd5d2a4029b0e6e3185844fab467ad6229e2c7db969ea4

.exe 6.5MB

667e5d0db61fca68bbbd5d2a4029b0e6e3185844fab467ad6229e2c7db969ea4.zip

SHA256 154b2f07bc3b2ae2817a204e07b659dc5d811f09117a03c880258a23d29cc4e3
MD5 ec8ed40717e7e5fbfa99a521ba5f8b67
SHA1 f52eff3334a608a061b3926cbbdbf055b8de6a15
SHA512 5b25e73598ca02da0a624f1847d6462fbf442c790842c15520df443adff5e3dd5d3345225bc79137185c78d9c5fa4ba93d96a1cedef72432c9c02597730085dd
SSDEEP 49152:gZYyJMiZkMj4MqCzq4405nidWnLHJ42uXGAEwXVYbTUeEtdrngLJ/u4NaLrNUwgL:gdJ0MlV405iwLH62ZqIUeEtdcLJ24sLi
TLSH
T103D53326235A7C70067B5276BE2B09C4E63DC20A556C7AB7858361880E7DC6E0FC76FD
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

667e5d0db61fca68bbbd5d2a4029b0e6e3185844fab467ad6229e2c7db969ea4

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 667e5d0db61fca68bbbd5d2a4029b0e6e3185844fab467ad6229e2c7db969ea4
MD5 25d5112cb1f545faa1be3d58441caa03
SHA1 f05ef5cd8af16a9bd812a477bb6de5b0d3ac433a
SHA512 cccca521687edacfe9a80cabcb924383e3698fe2411a9b9db133e069f9ade59bc8aac625e03440518287b5deaeea0e1f6c81fd0f2178acabdf0b85db785550c5
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8P:T6BJUoROZfIA8Xf8xumvBh8huTEEmkT
TLSH
T16F665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

667e5d0db61fca68bbbd5d2a4029b0e6e3185844fab467ad6229e2c7db969ea4.zip

667e5d0db61fca68bbbd5d2a4029b0e6e3185844fab467ad6229e2c7db969ea4

kernel32

generic