fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.zip
- SHA256 50c688a160d6afe75023ebbf79be0238b94f4e9d88213ebbb0fac25d263378f4
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.zip
- Size 9.5MB
- Sample260925-ththnsfe28
- SHA256 50c688a160d6afe75023ebbf79be0238b94f4e9d88213ebbb0fac25d263378f4
- MD5 4492b25d737fe8d0187f90510efc9cbb
- SHA1 7473920edc49b2d92e8e0bff4b62898e8823736f
- SHA512 00be67adfa5cf9793cce8ee923bf7da8c56cf6923cb7baf1b31a0c408540c29da612f0d3340cb5cb1c0e48c0118c39c014ec9770633b4db22b9af8a112b9aaf9
- SSDEEP 196608:L2QMWTae2DZ6D0RbTPa9ttpC46Fi4EmYkw/FOMhL0t4qTv:yFXZ6KqFg4BmYkw/rhLuLD
- TLSH T143A633470372007AD6D5766A3F0EB272EB491B12408F701F2F190DB1D9269DAFAB5D9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4 suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4
File Explorer
-
fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.zip.zip 9.5MB
-
fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4.exe 16.8MB
fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4
- IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
- SHA256 fc013adc72c129f13624d0d894f7016f1edcaeba58dbaef777e9bba1ad1c3aa4
- MD5 4162ceedb9d8714c270eefce6b808cc0
- SHA1 73e3bc25863fb4f0c6b835319db04630e9dfb712
- SHA512 c5bf54c77f988acaee705ff8ddecae5426382742519a5c9632e8c1b9b8f2a4bfded7458099e4a2a9f7935e62d35f1210eddceb2ecaf46c30d47a50242402b1dd
- SSDEEP 196608:yNtJUiM0r9wzksdY0gQn8qY3UpfKJFqiej:y7JUm9wndsQnjY3GUFqi
- TLSH T165078C43E8B605D9C1AE9276C66796237B743C894B3163C36B60B6342F77BD0AE79700
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
6
Entry point
557984
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
GetProcAddress
LoadLibraryExW
Name
.text
Size
5.7MB
Virtual Size
5.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5.1MB
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
509KB
Virtual Size
32.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
130KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
340B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
201KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/65
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/95
Size
333KB
Virtual Size
333KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/112
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
868KB
Virtual Size
868KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ