teleshim | 35ce75aba6e91b79419e73e5d41b6e69c1df606c9365eb760f8fdbb5e2ab1bf6

General

Target
35ce75aba6e91b79419e73e5d41b6e69c1df606c9365eb760f8fdbb5e2ab1bf6
Size 766KB
Sample260910-len5saan3x
SHA256 35ce75aba6e91b79419e73e5d41b6e69c1df606c9365eb760f8fdbb5e2ab1bf6
MD5 c8ef0d6f0a6bf4ebc916376dfc637c90
SHA1 3a770ab78589a75643a3f9eee61c98c00dbdd18a
SHA512 5a9baa91a3998373ed7a1d0b9414500897d4c53533493dad97cff09c3b10c776b2b39201543fbff7bdb4ca7ce1fb70e8df204ebc1a6c219ede74445467cf1189
SSDEEP 12288:CamTirf7Dqh6+ysJ2C3Uk7GJU+9h02Qx+/PRheKuyalZUclbNPgcq0dzok9p2:C3i7SjeJU+vXQxianJPtq0SI2
TLSH
T1CDF42378952DAADA638DCB864C1E7F8C2F293446FBE3E1165286783407E95648CCCD73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor teleshim

Malware Config

Extracted

Family

teleshim

Attributes

chat_id
8269292188
telegram
https://api.telegram.org/bot8731536541:AAFYBCyZRph55NYb6By4_qM2BI2oYchULMg/getUpdates
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_8) AppleWebKit/534.31 (KHTML, like Gecko) Chrome/13.0.748.0 Safari/534.31

Signatures

Family: TELESHIM
TELESHIM is a Windows backdoor written in C++.
backdoor teleshim

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5c2fe953da53da66fbcbb3be0fd6b63907c10714c337f287b2fc258857bbff6d

File Explorer

35ce75aba6e91b79419e73e5d41b6e69c1df606c9365eb760f8fdbb5e2ab1bf6

.zip 766KB
5c2fe953da53da66fbcbb3be0fd6b63907c10714c337f287b2fc258857bbff6d

.dll 1.2MB

35ce75aba6e91b79419e73e5d41b6e69c1df606c9365eb760f8fdbb5e2ab1bf6

SHA256 35ce75aba6e91b79419e73e5d41b6e69c1df606c9365eb760f8fdbb5e2ab1bf6
MD5 c8ef0d6f0a6bf4ebc916376dfc637c90
SHA1 3a770ab78589a75643a3f9eee61c98c00dbdd18a
SHA512 5a9baa91a3998373ed7a1d0b9414500897d4c53533493dad97cff09c3b10c776b2b39201543fbff7bdb4ca7ce1fb70e8df204ebc1a6c219ede74445467cf1189
SSDEEP 12288:CamTirf7Dqh6+ysJ2C3Uk7GJU+9h02Qx+/PRheKuyalZUclbNPgcq0dzok9p2:C3i7SjeJU+vXQxianJPtq0SI2
TLSH
T1CDF42378952DAADA638DCB864C1E7F8C2F293446FBE3E1165286783407E95648CCCD73
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

5c2fe953da53da66fbcbb3be0fd6b63907c10714c337f287b2fc258857bbff6d

IMPHASH f79c522b594cb9a2d2a61d5e5de3174f
SHA256 5c2fe953da53da66fbcbb3be0fd6b63907c10714c337f287b2fc258857bbff6d
MD5 7cbc51ada1a4aec88660ec32c408114b
SHA1 f46c01a5be2e08e36d4ec3302a8650a6ed25ec14
SHA512 af92b8ce20500c3b7dc0c2fdb45f64c9d68b2166fa8c80a6511845d9cfc39dd163b336461750b79b943b8b82b11c0990199a146b733a40c60138477e9a9f1ec3
SSDEEP 24576:cDCrWRrt5c6ixvZMaiAx0I95k05z/WGSl7fhim1h8sPX8AdHn4KPn:cDiWv5cSaSI95p/WG3m+sf8AdHpPn
TLSH
T1BB45DF867B02D0BEDE8F0271662C97399E3553349C819D7BDBC4DE745FB1AA01A1232E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1029316

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CreateDirectoryA CreateDirectoryW CreateFileA CreateFileW CreateMutexA DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTempPathA GetTickCount64 GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar PeekNamedPipe QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlUnwind SetEndOfFile SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

user32

GetWindowLongW IsDialogMessageW MessageBoxW RegisterClassW SendMessageW

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

iphlpapi

GetAdaptersInfo

Sharing