eae6bc4297be3ff2d8e63a99570fcb11be98b1ba02b79324f9f1f7fbe4938fbf[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
eae6bc4297be3ff2d8e63a99570fcb11be98b1ba02b79324f9f1f7fbe4938fbf.zip
Size 165KB
Sample260924-w9nslstyew
SHA256 dcd3fd68199e7403036f281a76f00489ef0948cb006698ec9f43ac4b5cfc6016
MD5 df88d9e10d97956193ec677f6a1ba5fc
SHA1 81e1aff437359382390deaea30d066d8756fb91f
SHA512 552c609b4ecf3a86317faed718e6cf0f25c17f279db5cb508d5a505c97a0fa49aa0926239c65b71900fef69d595a02203ca80c1159fff329babdb939943d73f2
SSDEEP 3072:Dl8rnmQkk0wh2u0sxkBRDMcHqQDW1UkH3uGZAt9fRoP+Tp5LZkB6Lx7tNPIQCCPU:D6nmHk0u2u0sxkscHqKM+UADRoPqlDPg
TLSH
T17EF3126D923C9E869D867262B689BE86EC45376128C1770D281E77F3FA7DC3800DB153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/eae6bc4297be3ff2d8e63a99570fcb11be98b1ba02b79324f9f1f7fbe4938fbf	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/eae6bc4297be3ff2d8e63a99570fcb11be98b1ba02b79324f9f1f7fbe4938fbf

File Explorer

eae6bc4297be3ff2d8e63a99570fcb11be98b1ba02b79324f9f1f7fbe4938fbf.zip

.zip 165KB
eae6bc4297be3ff2d8e63a99570fcb11be98b1ba02b79324f9f1f7fbe4938fbf

.exe 348KB

eae6bc4297be3ff2d8e63a99570fcb11be98b1ba02b79324f9f1f7fbe4938fbf.zip

SHA256 dcd3fd68199e7403036f281a76f00489ef0948cb006698ec9f43ac4b5cfc6016
MD5 df88d9e10d97956193ec677f6a1ba5fc
SHA1 81e1aff437359382390deaea30d066d8756fb91f
SHA512 552c609b4ecf3a86317faed718e6cf0f25c17f279db5cb508d5a505c97a0fa49aa0926239c65b71900fef69d595a02203ca80c1159fff329babdb939943d73f2
SSDEEP 3072:Dl8rnmQkk0wh2u0sxkBRDMcHqQDW1UkH3uGZAt9fRoP+Tp5LZkB6Lx7tNPIQCCPU:D6nmHk0u2u0sxkscHqKM+UADRoPqlDPg
TLSH
T17EF3126D923C9E869D867262B689BE86EC45376128C1770D281E77F3FA7DC3800DB153
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

eae6bc4297be3ff2d8e63a99570fcb11be98b1ba02b79324f9f1f7fbe4938fbf

IMPHASH 33ee9076753cc9b95603288bdbc5316f
SHA256 eae6bc4297be3ff2d8e63a99570fcb11be98b1ba02b79324f9f1f7fbe4938fbf
MD5 a15e974b118c2ed53ade826c3a335d19
SHA1 d806ffbbc6146e3063463b8cfa3ebd9159456d6a
SHA512 4ab9530204feb423ac9912a4ac909ff65ebee3e1fe69c968e9974b1e5f407e9cbec151874d1eb4cce87833359f3e5151d340fe69971802590e9eebc7bba7be89
SSDEEP 6144:uuJZSVFHZqoioTeDLHLT/DbMnRX4DU9tvbn9dP0BmuI0FWEGSzMMJHrr4+ax1ySX:uuQL72kZvvz7yI0FWEGSzMMJLr4+ax1N
TLSH
T17C745C12FE4459BAE455C03983859673693278CA0B32B5FF17D912343F2AAF56B3C709
MD5 SHA1 SHA512 SSDEEP TLSH

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

230128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetOverlappedResult ReadFile GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CancelIo GetExitCodeProcess GetTempPathW CreateWaitableTimerExW SetWaitableTimer Sleep SetFileTime GetFullPathNameW CreateThread QueryPerformanceCounter QueryPerformanceFrequency WaitForMultipleObjects GetFileInformationByHandleEx ExitProcess GetModuleHandleW WriteFileEx SleepEx ReadFileEx GetEnvironmentVariableW HeapAlloc ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentDirectoryW GetCurrentThreadId HeapReAlloc HeapFree GetProcessHeap GetCurrentThread SetThreadStackGuarantee OpenProcess CopyFileExW Beep SetFileInformationByHandle WaitForSingleObject CreateEventW IsDebuggerPresent FormatMessageW FindClose GetSystemTimePreciseAsFileTime GetSystemTimeAsFileTime SetFileAttributesW TerminateProcess WriteFile CreateFileW GetProcAddress GetCurrentProcess GetModuleHandleA FindFirstFileExW GetCurrentProcessId GetLastError SetLastError GetFileInformationByHandle CloseHandle SetUnhandledExceptionFilter GetStdHandle GetConsoleMode SetConsoleMode GetConsoleWindow InitializeSListHead SetConsoleCtrlHandler WideCharToMultiByte CompareStringOrdinal ReadConsoleW WriteConsoleW MultiByteToWideChar GetConsoleOutputCP RtlVirtualUnwind lstrlenW CreateToolhelp32Snapshot RtlCaptureContext Process32NextW Process32FirstW AddVectoredExceptionHandler

user32

DeleteMenu GetSystemMenu SetForegroundWindow GetCursorPos GetSystemMetrics SetWindowPos GetForegroundWindow ReleaseDC GetDC GetDesktopWindow MsgWaitForMultipleObjects

advapi32

OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

winhttp

WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpOpen WinHttpCloseHandle WinHttpReadData

gdi32

GetDeviceCaps

shell32

IsUserAnAdmin

ole32

CoInitializeEx

ntdll

NtReadFile NtCreateNamedPipeFile RtlNtStatusToDosError NtWriteFile NtOpenFile

vcruntime140

memset __CxxFrameHandler3 memcpy __C_specific_handler memcmp __current_exception __current_exception_context memmove

api-ms-win-crt-math-l1-1-0

cos sin tan __setusermatherr

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

terminate _c_exit _initterm _initterm_e _register_thread_local_exe_atexit_callback _initialize_narrow_environment _crt_atexit _register_onexit_function _seh_filter_exe _set_app_type _initialize_onexit_table exit _exit __p___argc _get_initial_narrow_environment __p___argv _cexit _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode