b9342242d963ba683637a942c9d898b29f28507238356ffaf7d0d1e88b78d98b[.]zip

General

Target
b9342242d963ba683637a942c9d898b29f28507238356ffaf7d0d1e88b78d98b.zip
Size 16.8MB
Sample260922-yca7cs1dng
SHA256 83a3a25905ae260142e1e53e99f0f9b109a435b942a96bcbfc5d3b8f693685c2
MD5 e3bd7e4c05adb0c28793e8d6aac6e303
SHA1 5237e3a53af6c370e0b6dfe134d9d7ef70335362
SHA512 4f653690e449d424fde74ec63ba437c94b4c41a9516a5d8c0cd547e905606f1bbccfd0414575e02c823d5b9ef6b09e62b6534d00b62681bb4d2ce58a1d1e1bfb
SSDEEP 393216:5pvZ+dvg+h1O0gtqJ1dt3JBT/n/ACYzTLpmZacQooF:5VsdvgEO/tq/bjn/v0Lkk1F
TLSH
T14A0733D1DBA788507B4B7C41612DCEB57808DF23AA676D4A332DA721F2012F93ED85B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/b9342242d963ba683637a942c9d898b29f28507238356ffaf7d0d1e88b78d98b	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b9342242d963ba683637a942c9d898b29f28507238356ffaf7d0d1e88b78d98b

File Explorer

b9342242d963ba683637a942c9d898b29f28507238356ffaf7d0d1e88b78d98b.zip

.zip 16.8MB
b9342242d963ba683637a942c9d898b29f28507238356ffaf7d0d1e88b78d98b

.dll 39.8MB

b9342242d963ba683637a942c9d898b29f28507238356ffaf7d0d1e88b78d98b.zip

SHA256 83a3a25905ae260142e1e53e99f0f9b109a435b942a96bcbfc5d3b8f693685c2
MD5 e3bd7e4c05adb0c28793e8d6aac6e303
SHA1 5237e3a53af6c370e0b6dfe134d9d7ef70335362
SHA512 4f653690e449d424fde74ec63ba437c94b4c41a9516a5d8c0cd547e905606f1bbccfd0414575e02c823d5b9ef6b09e62b6534d00b62681bb4d2ce58a1d1e1bfb
SSDEEP 393216:5pvZ+dvg+h1O0gtqJ1dt3JBT/n/ACYzTLpmZacQooF:5VsdvgEO/tq/bjn/v0Lkk1F
TLSH
T14A0733D1DBA788507B4B7C41612DCEB57808DF23AA676D4A332DA721F2012F93ED85B1
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

b9342242d963ba683637a942c9d898b29f28507238356ffaf7d0d1e88b78d98b

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b9342242d963ba683637a942c9d898b29f28507238356ffaf7d0d1e88b78d98b
MD5 bb6768ccc791774f884bdaafeb718826
SHA1 b1beba558cbd7e1f136cbf5888a89a489dfd0611
SHA512 03b6e7d59b6c84142e9677f5d4eb164f8c90e89257179d22a430353145af2f0d143370d727a5df1457e68d7e50ddaf7812c2121342655d91da375a26fd9c07ab
SSDEEP 786432:WmJgWN1oeAKGoZJgWN1oeAImJgWN1oeAK:RJ3CeAWZJ3CeArJ3CeA
TLSH
T10E97BD173362E428CA3402F46A55CFB525A25E6E58304AFA35C83FAF7BF25C9B5543C8
MD5 SHA1 SHA512 SSDEEP TLSH

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

11959086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

b9342242d963ba683637a942c9d898b29f28507238356ffaf7d0d1e88b78d98b.zip

b9342242d963ba683637a942c9d898b29f28507238356ffaf7d0d1e88b78d98b

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

b9342242d963ba683637a942c9d898b29f28507238356ffaf7d0d1e88b78d98b.zip

b9342242d963ba683637a942c9d898b29f28507238356ffaf7d0d1e88b78d98b

mscoree

dotnet