20bd53f1d29e0ce8a7aea008887dd5182ec962c8d897eb7073c2b36632902e70.zip
- SHA256 69591d3caf0c94931daff7fe5f2b790ed9a65ff217bc0d500c672c2950909f14
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
20bd53f1d29e0ce8a7aea008887dd5182ec962c8d897eb7073c2b36632902e70.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
20bd53f1d29e0ce8a7aea008887dd5182ec962c8d897eb7073c2b36632902e70.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 20bd53f1d29e0ce8a7aea008887dd5182ec962c8d897eb7073c2b36632902e70.zip
- Size 2.5MB
- Sample260922-pgdzdaea48
- SHA256 69591d3caf0c94931daff7fe5f2b790ed9a65ff217bc0d500c672c2950909f14
- MD5 5581618f6b65d75dd1089b376cbeab63
- SHA1 2e605925de4202f1fc8aa61848a33efc29e106f2
- SHA512 bdb2536e7325a5f7bfefbeeca6eccdaab3faa625b214fa96a3336f2ad230395b4cb9f0076841a97dca07f6f5282b0df1a0e33db708ddfaf9150e34649b299a79
- SSDEEP 49152:7pDL4NDDiRE7F6m7VCiGPytFIF88lEl7gRBwGS7GWfX5hfGrwwzTn3OD:714NniRgFh0iG0Ft+RBm7FfX5hfGrvTi
- TLSH T157C53396F4250CEF86DDD5719AA6C6183572ED8122E91EC834EAC88F1DE5E08DDD2C3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/20bd53f1d29e0ce8a7aea008887dd5182ec962c8d897eb7073c2b36632902e70 suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/20bd53f1d29e0ce8a7aea008887dd5182ec962c8d897eb7073c2b36632902e70
File Explorer
-
20bd53f1d29e0ce8a7aea008887dd5182ec962c8d897eb7073c2b36632902e70.zip.zip 2.5MB
-
20bd53f1d29e0ce8a7aea008887dd5182ec962c8d897eb7073c2b36632902e70.exe 4.9MB
20bd53f1d29e0ce8a7aea008887dd5182ec962c8d897eb7073c2b36632902e70
- IMPHASH 08c04aeedc64c75310d17507e4366995
- SHA256 20bd53f1d29e0ce8a7aea008887dd5182ec962c8d897eb7073c2b36632902e70
- MD5 8ac26f6b64af7d4515929973b3f9a2a2
- SHA1 a90e84d34065f38d958ff95eea1f099b09ef98a0
- SHA512 3e532997f9203445df493cfb629b4d2356ac0e06daaac332dedb31517223d09dfa2cc7a7467ba6a9ac6af82de51feb1f61710273410ca4780d035784cfa4fb2c
- SSDEEP 49152:eA5Xs/GuaWgtMBGjxqC+4M7UcBZ2NNSPClnIem4CyPtQwqIdZvX411mLd2:ewWetHqC+4M7Uc+I6AF5I3f41+d2
- TLSH T1A836BE54EB8B40F0D52B55B44A4BE73B933076110621DFFBEB8DDE45F933E9129AA202
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
5136
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
GetUserNameA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
bcrypt
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptDestroyKey
BCryptGenerateSymmetricKey
BCryptOpenAlgorithmProvider
BCryptSetProperty
crypt32
CryptUnprotectData
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
SelectObject
gdiplus
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipFree
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdiplusShutdown
GdiplusStartup
kernel32
AreFileApisANSI
CloseHandle
CopyFileA
CreateDirectoryA
CreateFileA
CreateFileMappingW
CreateFileW
CreateMutexW
CreatePipe
CreateProcessA
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileA
DeleteFileW
EnterCriticalSection
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeLibrary
GetComputerNameA
GetConsoleWindow
GetCurrentProcessId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GlobalLock
GlobalUnlock
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadResource
LocalFree
LockFile
LockFileEx
LockResource
MapViewOfFile
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
Process32First
Process32Next
QueryPerformanceCounter
ReadFile
ReadProcessMemory
SetEndOfFile
SetFilePointer
SetHandleInformation
SetUnhandledExceptionFilter
SizeofResource
Sleep
SystemTimeToFileTime
TlsGetValue
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
VirtualQueryEx
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WinExec
WriteFile
libmcfgthread-2
_MCF_mutex_lock_slow
_MCF_mutex_unlock_slow
_MCF_once_wait_slow
_MCF_thread_self
_MCF_tls_key_new
__MCF__Exit
__MCF_cxa_at_quick_exit
__MCF_cxa_atexit
__MCF_cxa_guard_abort
__MCF_cxa_guard_acquire
__MCF_cxa_guard_release
__MCF_cxa_thread_atexit
__MCF_exit
__MCF_gthr_call_once_seh_take_over
__MCF_tls_table_get
__MCF_tls_table_xset
api-ms-win-crt-convert-l1-1-0
atoi
btowc
mbrtowc
strtoul
wcrtomb
wctob
api-ms-win-crt-environment-l1-1-0
__p__environ
_dupenv_s
getenv
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
localeconv
setlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
_fdopen
api-ms-win-crt-private-l1-1-0
memchr
memcmp
memcpy
memmove
strchr
strrchr
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_cexit
_configure_narrow_argv
_errno
_exit
_initialize_narrow_environment
_initterm
_initterm_e
_set_app_type
_set_invalid_parameter_handler
abort
signal
strerror
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsprintf_s
_fileno
_get_osfhandle
_lseeki64
_read
_wfopen
_write
fclose
fflush
fopen
fputc
fputs
fwrite
setvbuf
api-ms-win-crt-string-l1-1-0
iswctype
memset
strcmp
strcoll
strcspn
strlen
strncmp
strnlen
strspn
strxfrm
towlower
towupper
wcscmp
wcscoll
wcslen
wcsnlen
wcsxfrm
wctype
api-ms-win-crt-time-l1-1-0
_localtime64
_time64
strftime
wcsftime
api-ms-win-crt-utility-l1-1-0
rand
rand_s
srand
shell32
ShellExecuteA
user32
CloseClipboard
GetClipboardData
GetDC
GetSystemMetrics
OpenClipboard
ReleaseDC
ShowWindow
winhttp
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
114KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
350KB
Virtual Size
350KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ