70f8a476b7e19583edebcf17f2eb2c1c96b31adc91c40d65fef63ad1f65959e5[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
70f8a476b7e19583edebcf17f2eb2c1c96b31adc91c40d65fef63ad1f65959e5.zip
Size 4.9MB
Sample260930-at64csxyet
SHA256 5b30f1d44c18bfeae8586a5c26d2e9623697851cd726b54407dc87f8d55579a3
MD5 c2a96df5053d9e810a6d09065c8387e3
SHA1 82b5c70a663c4c8d40bb424e3e6ad7828200eec3
SHA512 767c2241ba649cf8c6835f3de83c235457beeff35c50c54b5d5d5d3ae00ed2db016428d691a6b6b1ff82befd4a5f2bd5071a8a7bf269c972e47c72dbd711130d
SSDEEP 98304:RCoUfLYtVIgkXJ7KSntKw4d1DDQXgpcvxjiIgC5pqt154iIDIYoIKJ3zOyu:RCoUfLYXw4bEwpQxu3C5wr54tDToIKp6
TLSH
T12A3633FA49DB57BBFE21660A4934D8DDC901EEFF0A07C9E763E84CB0098DB791A90544
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/70f8a476b7e19583edebcf17f2eb2c1c96b31adc91c40d65fef63ad1f65959e5	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/70f8a476b7e19583edebcf17f2eb2c1c96b31adc91c40d65fef63ad1f65959e5

File Explorer

70f8a476b7e19583edebcf17f2eb2c1c96b31adc91c40d65fef63ad1f65959e5.zip

.zip 4.9MB
70f8a476b7e19583edebcf17f2eb2c1c96b31adc91c40d65fef63ad1f65959e5

.exe 43.9MB

70f8a476b7e19583edebcf17f2eb2c1c96b31adc91c40d65fef63ad1f65959e5.zip

SHA256 5b30f1d44c18bfeae8586a5c26d2e9623697851cd726b54407dc87f8d55579a3
MD5 c2a96df5053d9e810a6d09065c8387e3
SHA1 82b5c70a663c4c8d40bb424e3e6ad7828200eec3
SHA512 767c2241ba649cf8c6835f3de83c235457beeff35c50c54b5d5d5d3ae00ed2db016428d691a6b6b1ff82befd4a5f2bd5071a8a7bf269c972e47c72dbd711130d
SSDEEP 98304:RCoUfLYtVIgkXJ7KSntKw4d1DDQXgpcvxjiIgC5pqt154iIDIYoIKJ3zOyu:RCoUfLYXw4bEwpQxu3C5wr54tDToIKp6
TLSH
T12A3633FA49DB57BBFE21660A4934D8DDC901EEFF0A07C9E763E84CB0098DB791A90544
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

70f8a476b7e19583edebcf17f2eb2c1c96b31adc91c40d65fef63ad1f65959e5

IMPHASH 79009c9cc235140f3a41d8cd8977174f
SHA256 70f8a476b7e19583edebcf17f2eb2c1c96b31adc91c40d65fef63ad1f65959e5
MD5 5e546d6ad963f5f410d065b3fbd45399
SHA1 7a917d7bbcf2e49d8e1abbe492fbaa5f781a61a1
SHA512 8339e2b6fe720be13b7b85d4949798b9020f93da132bf293e4cc3716ab152656ee9b78e28b262d0bea5589fa38589d9c7912b097155813968efaa3af642c7634
SSDEEP 49152:LKUmPG6HPtlUq1EdhSLMtFlaEFdUir7M8KWyOQMS17Z6uiVLTPFtf5VHXcuc5B6f:LKFdvkdA7117YvHEkg1nEeOPNe4Ed
TLSH
T182A74847E8B511E9C0AEC575CA369623BB713C895B3063D75B60FA242F36BD0ADB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

557856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32.9MB

Virtual Size

32.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

70f8a476b7e19583edebcf17f2eb2c1c96b31adc91c40d65fef63ad1f65959e5.zip

70f8a476b7e19583edebcf17f2eb2c1c96b31adc91c40d65fef63ad1f65959e5

kernel32

generic