24f0505b75257988de2fbcc67b897aa47d6e90b4c76e1a9d846cbddba10c22b9[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
24f0505b75257988de2fbcc67b897aa47d6e90b4c76e1a9d846cbddba10c22b9.zip
Size 2.7MB
Sample260826-xtgvssfa22
SHA256 2a424a163be85187461a4f68025359dc5c9a3d983215a80cb89f6b52b98d0f6a
MD5 f46fab424591a923c689552857482652
SHA1 75c6bf205ee838bafc49e9ac9af9811cf4f37a60
SHA512 80b792f6998678ddad491fe2fc6f3a728fc515b9ee494bc374c3cc972c8468978464b836975a5e305d2a68ee3f043fbe8b52d9d63411a6d50f11610ee3f8ed0f
SSDEEP 49152:R5Jr+yoQvRHa94d/bijgb4vYJJCUlYruiHRpmlsvCBHq+Nr:RqyoQvR60Wg4vYJj2Jml5
TLSH
T160D533B897A290461F6D0056EDF3062566306BA0930FF86AE39F260DF617C48DA747FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/24f0505b75257988de2fbcc67b897aa47d6e90b4c76e1a9d846cbddba10c22b9	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/24f0505b75257988de2fbcc67b897aa47d6e90b4c76e1a9d846cbddba10c22b9

File Explorer

24f0505b75257988de2fbcc67b897aa47d6e90b4c76e1a9d846cbddba10c22b9.zip

.zip 2.7MB
24f0505b75257988de2fbcc67b897aa47d6e90b4c76e1a9d846cbddba10c22b9

.exe 6.5MB

24f0505b75257988de2fbcc67b897aa47d6e90b4c76e1a9d846cbddba10c22b9.zip

SHA256 2a424a163be85187461a4f68025359dc5c9a3d983215a80cb89f6b52b98d0f6a
MD5 f46fab424591a923c689552857482652
SHA1 75c6bf205ee838bafc49e9ac9af9811cf4f37a60
SHA512 80b792f6998678ddad491fe2fc6f3a728fc515b9ee494bc374c3cc972c8468978464b836975a5e305d2a68ee3f043fbe8b52d9d63411a6d50f11610ee3f8ed0f
SSDEEP 49152:R5Jr+yoQvRHa94d/bijgb4vYJJCUlYruiHRpmlsvCBHq+Nr:RqyoQvR60Wg4vYJj2Jml5
TLSH
T160D533B897A290461F6D0056EDF3062566306BA0930FF86AE39F260DF617C48DA747FD
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

24f0505b75257988de2fbcc67b897aa47d6e90b4c76e1a9d846cbddba10c22b9

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 24f0505b75257988de2fbcc67b897aa47d6e90b4c76e1a9d846cbddba10c22b9
MD5 012a1281a80641b429cfa9226620a950
SHA1 9d37216cc3cd87a4d5277a6607461704fa6fa339
SHA512 0d9ddab703afdbe7e39e7ae39be1a792b9904b2509a8cdf4a55a864bff03bc285f3adf9ba39fd574bcc823a86edd5cd90e97513a2fbe9b17e07383f5148829c2
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8O:T6BJUoROZfIA8Xf8xumvBh8huTEEmFx
TLSH
T11E665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

24f0505b75257988de2fbcc67b897aa47d6e90b4c76e1a9d846cbddba10c22b9.zip

24f0505b75257988de2fbcc67b897aa47d6e90b4c76e1a9d846cbddba10c22b9

kernel32

generic