e70034c7427c2f86b49f082547cf2699fd1e8b80d49fb1a1a38960514aef87ac[.]zip

General

Target
e70034c7427c2f86b49f082547cf2699fd1e8b80d49fb1a1a38960514aef87ac.zip
Size 16.4MB
Sample260930-c2x7jawsbs
SHA256 d7c8874c6855036a342f876018dbb8d97189d518f6fb64914080c4cb88b45a40
MD5 643eae3bf4b21b43be305ac47c175869
SHA1 bbf63d9cda476709273955d227c987df22fc1d93
SHA512 6be46c0abcfcd1fcc450f613b54887da20766d78df92a81ce9d2f37521e9e6504fe1a9ce3bf357f1455a070d04b45d4f1f2cbfaaad95b408466e58145cf93e5c
SSDEEP 393216:kLgzcxY0Buxs1H9n8oy0Jyrv9oDm9bCEliFXCJUIWYoGbEO:k4bxsQoVyqE3UpYRbD
TLSH
T1D20733CB7F3BD7E3EBDF0131AE234F1805289A035A71928C5542578D7F1B92BA8D1929
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/e70034c7427c2f86b49f082547cf2699fd1e8b80d49fb1a1a38960514aef87ac	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e70034c7427c2f86b49f082547cf2699fd1e8b80d49fb1a1a38960514aef87ac

File Explorer

e70034c7427c2f86b49f082547cf2699fd1e8b80d49fb1a1a38960514aef87ac.zip

.zip 16.4MB
e70034c7427c2f86b49f082547cf2699fd1e8b80d49fb1a1a38960514aef87ac

.dll 39.8MB

e70034c7427c2f86b49f082547cf2699fd1e8b80d49fb1a1a38960514aef87ac.zip

SHA256 d7c8874c6855036a342f876018dbb8d97189d518f6fb64914080c4cb88b45a40
MD5 643eae3bf4b21b43be305ac47c175869
SHA1 bbf63d9cda476709273955d227c987df22fc1d93
SHA512 6be46c0abcfcd1fcc450f613b54887da20766d78df92a81ce9d2f37521e9e6504fe1a9ce3bf357f1455a070d04b45d4f1f2cbfaaad95b408466e58145cf93e5c
SSDEEP 393216:kLgzcxY0Buxs1H9n8oy0Jyrv9oDm9bCEliFXCJUIWYoGbEO:k4bxsQoVyqE3UpYRbD
TLSH
T1D20733CB7F3BD7E3EBDF0131AE234F1805289A035A71928C5542578D7F1B92BA8D1929
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

e70034c7427c2f86b49f082547cf2699fd1e8b80d49fb1a1a38960514aef87ac

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e70034c7427c2f86b49f082547cf2699fd1e8b80d49fb1a1a38960514aef87ac
MD5 8e637f0edd6666b54598c5e97a8f26e6
SHA1 2faa5a919ea6bd374079b8c8f4cad67cef580d26
SHA512 987ffd26ce29e271b28134414230aec3207f59ae716283d6f8ab41856fbf4bca0e105f67f56c9a29d5b80e12bf116a64c5472cd36ee0dd1458fe7b866dce18a8
SSDEEP 786432:kma6Wj1oxAB+o4a6Wj1oxAfma6Wj1oxAB:tabCxA54abCxAeabCxA
TLSH
T1EB97BC173762E428CA3402F46A55CFB165A25E6E58304AFA35C83FAF7BF25C9B1543C8
MD5 SHA1 SHA512 SSDEEP TLSH

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

11613582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e70034c7427c2f86b49f082547cf2699fd1e8b80d49fb1a1a38960514aef87ac.zip

e70034c7427c2f86b49f082547cf2699fd1e8b80d49fb1a1a38960514aef87ac

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

e70034c7427c2f86b49f082547cf2699fd1e8b80d49fb1a1a38960514aef87ac.zip

e70034c7427c2f86b49f082547cf2699fd1e8b80d49fb1a1a38960514aef87ac

mscoree

dotnet