TelegramSessionKill[.]exe

Resubmissions

12/09/2026, 13:32

260912-qs6n7shr4t10

10/09/2026, 14:53

260910-r9hjdayybw10

10/09/2026, 14:51

260910-r8bdnsdn9z10

Sharing

Copy URL Twitter E-mail

General

Target
TelegramSessionKill.exe
Size 8.7MB
Sample260910-r8bdnsdn9z
SHA256 b9b91b6efc2f0541403c6ed2fa0c515a9e6d1b723d283028dee6159ef45f6a67
MD5 1b9f39bb0fc28e44b9fe4ddb9bb51fc7
SHA1 97de88328abe1322c7778fcf0b719760ca6af780
SHA512 2f0455224249940b8d325ea3e2e46369839dd5348ac658ddbb9bf4a11a8936a30112d6b4c5f4971f449fe0710f1f5ea2385d3460ed21911ea54a1edbd3309810
SSDEEP 196608:/erLSGLIm5fOMPphoHitdTFSvzj1RUMBFcs7ZHJ2REJ1j9ug2ttI/:2X5Im5fVP7iit2/BaIZHQEXgg2rG
TLSH
T176963300FCD06999D0BB01F088BC13A6A5BE9CC8136792CFEFA54E3A0E7D2915578677
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
TelegramSessionKill.exe

File Explorer

TelegramSessionKill.exe

.exe 8.7MB

TelegramSessionKill.exe

IMPHASH 0289a43a2bac6ac75dfdc9db19af5eda
SHA256 b9b91b6efc2f0541403c6ed2fa0c515a9e6d1b723d283028dee6159ef45f6a67
MD5 1b9f39bb0fc28e44b9fe4ddb9bb51fc7
SHA1 97de88328abe1322c7778fcf0b719760ca6af780
SHA512 2f0455224249940b8d325ea3e2e46369839dd5348ac658ddbb9bf4a11a8936a30112d6b4c5f4971f449fe0710f1f5ea2385d3460ed21911ea54a1edbd3309810
SSDEEP 196608:/erLSGLIm5fOMPphoHitdTFSvzj1RUMBFcs7ZHJ2REJ1j9ug2ttI/:2X5Im5fVP7iit2/BaIZHQEXgg2rG
TLSH
T176963300FCD06999D0BB01F088BC13A6A5BE9CC8136792CFEFA54E3A0E7D2915578677
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

aa:f3:bb:8b:ce:a5:12:1d:81:73:22:29:f4:47:61:c9:98:87:29:7c:b3:a2:cc:01:5b:aa:87:ad:c8:f7:13:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Anysphere Inc.,OU=Cursor Editor,O=Anysphere Inc.,L=San Francisco,ST=California,C=US

Chains

Sep 9, 2026

CN=Anysphere Inc.,OU=Cursor Editor,O=Anysphere Inc.,L=San Francisco,ST=California,C=US

Minor OS version

Major OS version

Entry point

127056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

TaskHost_6665fb3e.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

advapi32

OpenProcessToken RegOpenKeyExA GetTokenInformation RegCloseKey

iphlpapi

GetAdaptersInfo

kernel32

GetTempPathW SetFilePointerEx GetComputerNameW GetACP GetSystemDirectoryW GetUserDefaultLCID GetTickCount GetWindowsDirectoryW GetSystemInfo GetDiskFreeSpaceExA GetComputerNameExW GetTickCount64 IsDebuggerPresent GetCurrentProcess CheckRemoteDebuggerPresent GlobalMemoryStatusEx CreateToolhelp32Snapshot Process32First Process32Next GetLastError CloseHandle GetModuleFileNameA CreateEventA WaitForSingleObject DeleteFileA CreateProcessA GetExitCodeProcess SetFileAttributesA AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext GetProcAddress ReleaseMutex WaitForSingleObjectEx LoadLibraryA lstrlenW GetCurrentProcessId CreateMutexA WideCharToMultiByte GetEnvironmentVariableW HeapAlloc GetFullPathNameW FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx CreateFileW SetFileInformationByHandle FlushFileBuffers GetModuleHandleA GetModuleHandleW FormatMessageW DecodePointer CreateWaitableTimerExW SetWaitableTimer Sleep ExitProcess HeapSize LCMapStringW CompareStringW VirtualProtect QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwind EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException WriteFile GetModuleFileNameW GetModuleHandleExW GetCommandLineA GetCommandLineW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx

shell32

ShellExecuteA

user32

GetSystemMetrics

ntdll

RtlNtStatusToDosError NtWriteFile

Name

.text

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8.5MB

Virtual Size

8.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

TelegramSessionKill.exe

PE Signature issue

api-ms-win-core-synch-l1-2-0

advapi32

iphlpapi

kernel32

shell32

user32

ntdll

generic