33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5.zip
Size 120KB
Sample260925-sdjbgafa38
SHA256 d7e7f3305e6de323ed5d9f9fe0d129704e035cb611ae70422e427fbd72748b2b
MD5 9cd91004a585babe670e2e24a19907c1
SHA1 190c12603421fd8bcd9db68acfa0d971bb4075e0
SHA512 774b978eff12db71b531e9e64330eca6c6ad18d7bc50acdc6c5c7162a179e02cb5f0788f6580113c137c2ec86cd959896a3784a742146f98ae2323e830a937c8
SSDEEP 3072:MnFoWIC77tN7O4/g1mDV19LYI40AmHnAOe66mFs:eFoWNn7h/ge9Uj0AmHAOetmW
TLSH
T197C312978A4D399FC38C9B2461B656940751FB3225A0C6B2B3DF957C2908CF84CCDAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5

File Explorer

33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5.zip

.zip 120KB
33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5

.exe 254KB

33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5.zip

SHA256 d7e7f3305e6de323ed5d9f9fe0d129704e035cb611ae70422e427fbd72748b2b
MD5 9cd91004a585babe670e2e24a19907c1
SHA1 190c12603421fd8bcd9db68acfa0d971bb4075e0
SHA512 774b978eff12db71b531e9e64330eca6c6ad18d7bc50acdc6c5c7162a179e02cb5f0788f6580113c137c2ec86cd959896a3784a742146f98ae2323e830a937c8
SSDEEP 3072:MnFoWIC77tN7O4/g1mDV19LYI40AmHnAOe66mFs:eFoWNn7h/ge9Uj0AmHAOetmW
TLSH
T197C312978A4D399FC38C9B2461B656940751FB3225A0C6B2B3DF957C2908CF84CCDAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5

IMPHASH 88db6d96936a68e87a9acf9d3b585a1f
SHA256 33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5
MD5 207141457c65edad346e7ada23017146
SHA1 e0bb4da787527bc42eb27a75fd8cf2ca211cf150
SHA512 1a9ad48b6c765fc3d195c73779b71ec19af70b29da2e76d94c08e003981ec76d5a6cd21f05fce693f4a4f6106662447531bd048d99fdd4829df624fc8024af15
SSDEEP 6144:Dx0Ejgx9brA7iW95zQbg1C4ImaJ+yPun:+yiudkg1LaJ+yY
TLSH
T1C2447C1AA6940CFCFD77C57DCE524945EB72BC4A47A1EACF07A009960F236909E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

58692

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

LoadCursorA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetWindowThreadProcessId GetClassNameA EnumWindows FindWindowA PtInRect FillRect GetClientRect GetWindowTextA InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow UpdateWindow DrawTextA RemoveMenu GetSystemMenu GetSystemMetrics KillTimer SetTimer GetAsyncKeyState EmptyClipboard SetClipboardData CloseClipboard OpenClipboard BringWindowToTop IsWindowVisible SetWindowPos ShowWindow IsWindow CreateWindowExA RegisterClassExA PostQuitMessage DefWindowProcA PostMessageA UnregisterHotKey RegisterHotKey DispatchMessageA TranslateMessage GetMessageA wsprintfA

gdi32

SetTextColor SetBkMode SelectObject GetDIBits DeleteObject DeleteDC CreateSolidBrush CreateFontA CreateCompatibleDC CreateCompatibleBitmap BitBlt

kernel32

SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW ReadConsoleW HeapAlloc HeapFree GetModuleHandleExW ExitProcess GetModuleFileNameW WriteFile GetStdHandle LoadLibraryExW GetProcAddress FreeLibrary GetEnvironmentStringsW TlsSetValue TlsGetValue SetEndOfFile HeapReAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW ExpandEnvironmentStringsA CreateDirectoryA DeleteFileA FindClose FindFirstFileA FindNextFileA RemoveDirectoryA GetTempPathA CloseHandle WaitForSingleObject Sleep GetCurrentProcessId CreateThread CreateProcessA GetTickCount GetModuleFileNameA GetModuleHandleA GlobalAlloc GlobalUnlock GlobalLock CopyFileA MultiByteToWideChar TlsAlloc FreeEnvironmentStringsW SetStdHandle TlsFree RtlUnwind InitializeCriticalSectionAndSpinCount GetProcessHeap WriteConsoleW HeapSize SetLastError CreateFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError

advapi32

RegOpenKeyExA RegCreateKeyExA RegCloseKey RegSetValueExA

shell32

SHGetFolderPathA

ole32

CoUninitialize CoCreateInstance CoInitialize