b0605d4880b876b1e1047a6633f09c2a8f6381b88309aee7fc41c38aece11c0a[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
b0605d4880b876b1e1047a6633f09c2a8f6381b88309aee7fc41c38aece11c0a.zip
Size 10.9MB
Sample260930-ns2n5sssbt
SHA256 8222822446b407e4c4af05f790ba25ee680b94db1b3326973b1f0c4d70fdb214
MD5 65e2c7b3ba1a614261e329280dff905d
SHA1 ff0dbecdc06591f4d2725f901aaa0c5019a52241
SHA512 6028fbfb62d859aad95ad5e89265ac81dd92fd79e7d317136fa89981d07c20c9d65ae36a714487e4fa83f0adde52c336f1de81e67d2aa00984a3b02660e26b1b
SSDEEP 196608:+1kNRVwQ7WxJ7p6x7zZFE9cLoQgBiclyhGFfDlzPygSxMDA09AtBvN:IkTOQ7e7pspeSUHyMF7dyPMDArvN
TLSH
T1B0B633C28579085A783F30936618CC99643DA6550C1F313E2B7E22D5C2DF69DFDFA28A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/b0605d4880b876b1e1047a6633f09c2a8f6381b88309aee7fc41c38aece11c0a	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b0605d4880b876b1e1047a6633f09c2a8f6381b88309aee7fc41c38aece11c0a

File Explorer

b0605d4880b876b1e1047a6633f09c2a8f6381b88309aee7fc41c38aece11c0a.zip

.zip 10.9MB
b0605d4880b876b1e1047a6633f09c2a8f6381b88309aee7fc41c38aece11c0a

.dll 29.9MB

b0605d4880b876b1e1047a6633f09c2a8f6381b88309aee7fc41c38aece11c0a.zip

SHA256 8222822446b407e4c4af05f790ba25ee680b94db1b3326973b1f0c4d70fdb214
MD5 65e2c7b3ba1a614261e329280dff905d
SHA1 ff0dbecdc06591f4d2725f901aaa0c5019a52241
SHA512 6028fbfb62d859aad95ad5e89265ac81dd92fd79e7d317136fa89981d07c20c9d65ae36a714487e4fa83f0adde52c336f1de81e67d2aa00984a3b02660e26b1b
SSDEEP 196608:+1kNRVwQ7WxJ7p6x7zZFE9cLoQgBiclyhGFfDlzPygSxMDA09AtBvN:IkTOQ7e7pspeSUHyMF7dyPMDArvN
TLSH
T1B0B633C28579085A783F30936618CC99643DA6550C1F313E2B7E22D5C2DF69DFDFA28A
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

b0605d4880b876b1e1047a6633f09c2a8f6381b88309aee7fc41c38aece11c0a

IMPHASH 0cb3c385ea633451ae3ab56f08bd00ff
SHA256 b0605d4880b876b1e1047a6633f09c2a8f6381b88309aee7fc41c38aece11c0a
MD5 b7c874054ace8ead5d28f7b92e9b0f6d
SHA1 33a007ca347381c8e4a1b4391411945cbb248efa
SHA512 ab878d96f030392f2dac0226214ead5df783a2397a3d9ec83bdb9b8d5c88175cf4c98f66920f411df974bdce691aaa6f633998980d9394ab3be09017a68c24cc
SSDEEP 196608:ttsMnG9FljjdflB4ukosn7h3Yx/kPjKpp4kDu2PE48i:FeYukxE8PjKfM2PE48i
TLSH
T126672B1333740002FBB5D0B64CA98763DFB2B9DE572172A3246CDA692BC7ED596EC244
MD5 SHA1 SHA512 SSDEEP TLSH

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

19858864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

python313

PyRange_Type PyClassMethod_Type PyByteArray_FromObject PyExc_UnicodeEncodeError PyExc_IOError PyExc_FileNotFoundError PyExc_ModuleNotFoundError PyExc_SyntaxError PyComplex_Type PySlice_Type PyExc_UnboundLocalError PyExc_TimeoutError PyExc_OverflowError PyObject_GetAttr PyExc_ConnectionError PyModule_GetFilenameObject PySequence_List PyNumber_InPlaceOr PyExc_ImportWarning PyObject_SetAttr PyOS_snprintf PyThreadState_Get PyMem_GetAllocator PyErr_GivenExceptionMatches PyDictItems_Type PyErr_WarnEx PyFunction_Type _PyArg_NoKeywords PyLong_AsSsize_t PyDictKeys_Type PyImport_ImportModule PyObject_SelfIter PyEval_GetFuncName PyImport_ExecCodeModuleEx PyUnicode_RichCompare PyUnicode_DecodeUTF8 PyList_Sort PyObject_SetAttrString PyNumber_FloorDivide PyUnicode_Concat Py_BuildValue PyExc_MemoryError PyComplex_FromDoubles PyModule_GetName PyUnicode_FromOrdinal PyExc_RecursionError PyBytes_FromString PyModule_GetDef _PyObject_GC_Resize PyTuple_New PyLong_FromString PyDict_SetItemString PyFrame_Type PyFloat_FromDouble PyDictValues_Type PyUnicode_New PyObject_LengthHint PyUnicode_FromWideChar PyMarshal_ReadObjectFromString PyExc_ZeroDivisionError PyIter_Next PyObject_GetIter PyNumber_Add PyEval_EvalCodeEx PyIter_Send PyNumber_InPlaceLshift PyObject_RichCompare PyCoro_Type PyNumber_InPlaceAdd PyModule_NewObject PyMethod_Type PyNumber_Subtract _Py_Dealloc PyImport_GetModuleDict PyObject_Free PyImport_ImportFrozenModule PyErr_ExceptionMatches _PyUnicode_InternImmortal PyEnum_Type _PyErr_FormatFromCause PyObject_Dir PyObject_GC_Del PyObject_CallFunctionObjArgs PyLong_AsLong PyLong_FromUnicodeObject _PyBytes_Resize PyObject_ClearWeakRefs PyObject_Init PyCode_Type PyUnicode_AsUTF8 PyUnicode_AsWideCharString PyObject_GetBuffer PyErr_BadArgument PyType_Ready PyModule_FromDefAndSpec2 Py_CompileStringExFlags PyState_AddModule PyObject_RichCompareBool PyMapping_Check _PyLong_New PyObject_GenericSetAttr PyDict_New PyNumber_ToBase PyByteArray_FromStringAndSize PyModule_ExecDef _PyEval_EvalFrameDefault PyLong_AsLongAndOverflow PyCMethod_New _PySet_NextEntry PyErr_NoMemory PyObject_Realloc _PyRuntime PyDict_GetItemString PyEllipsis_Type PyDict_GetItem PyImport_FrozenModules PyUnstable_Code_NewWithPosOnlyArgs PyCode_Addr2Line PyArg_ParseTupleAndKeywords PyImport_ExecCodeModule PyUnicode_FromEncodedObject _PyObject_New PyObject_IsTrue PyObject_Str PyExc_NameError _PyByteArray_empty_string PyMem_Malloc PyModuleDef_Type _PyIntrinsics_UnaryFunctions PyGen_Type PyState_FindModule PyObject_CallMethodObjArgs PyArg_UnpackTuple PyModule_GetState _PyErr_SetString PyAsyncGen_Type PyErr_Print PyTraceBack_Type PyUnicode_GetLength _Py_FatalErrorFunc Py_GenericAliasType _PyLong_Copy PyUnicode_Format PyBuffer_Release PyObject_Call PyNumber_Float PyArg_ParseTuple PyUnicode_Substring PyEval_RestoreThread PyUnicode_FromStringAndSize PyFloat_FromString PyWideStringList_Append PyList_SetSlice Py_ExitStatusException PyConfig_SetArgv Py_NoSiteFlag PyList_Size Py_NoUserSiteDirectory Py_SetProgramName PyStatus_Exception Py_DontWriteBytecodeFlag Py_DebugFlag PyConfig_SetString Py_BytesWarningFlag _PyConfig_InitCompatConfig Py_VerboseFlag PySys_SetArgv Py_InitializeFromConfig Py_OptimizeFlag PyDict_DelItemString Py_UTF8Mode Py_InteractiveFlag Py_InspectFlag Py_IgnoreEnvironmentFlag Py_FrozenFlag PyStructSequence_InitType PyMemoryView_Type PyExc_UnicodeError PyFloat_Type PyDict_MergeFromSeq2 PyDict_Merge PyExc_NotImplementedError PyZip_Type PyStaticMethod_Type PyMap_Type PyExc_BrokenPipeError PyObject_GetItem PyExc_EOFError PyBool_Type PyProperty_Type PyLong_Type PyByteArray_Type _Py_NotImplementedStruct PyFrozenSet_New PyFilter_Type PyExc_LookupError PyExc_UnicodeDecodeError PyObject_Repr PyObject_SetItem PyExc_AssertionError _Py_EllipsisObject PyLong_FromVoidPtr PyCell_New PyExc_KeyError PyObject_DelAttr PyObject_DelItem PyExc_ImportError PyExc_StopAsyncIteration PyDict_DelItem _PySet_Update PyExc_OSError PyList_Type PyNumber_Negative PyReversed_Type PySet_Type PyBytes_Type PySet_New PyTuple_Type PyDict_Type PyExc_SystemExit PySet_Add PySequence_Contains PyExc_KeyboardInterrupt PySet_Contains PyExc_RuntimeError PyLong_FromSsize_t PyDict_Update Py_Exit _PyObject_FunctionStr PySequence_Tuple PyEval_AcquireThread _PyThreadState_GetCurrent PyExc_GeneratorExit PyExc_IndexError PyModule_Type PyObject_IsSubclass PyNumber_AsSsize_t PyNumber_Long PyExc_StopIteration PyUnicode_Type PySequence_Check PyObject_GetAttrString PyUnicode_FromFormat PyModule_GetDict PyUnicode_Join PyType_IsSubtype PySeqIter_Type PyExc_BaseException PyExc_ValueError PyErr_WriteUnraisable PyEval_SaveThread PyErr_PrintEx PyExc_Exception Py_MakePendingCalls Py_GenericAlias PyType_Type _PyType_Lookup PyExc_SystemError PyExc_TypeError PyDict_SetItem PyErr_Format PyExc_AttributeError PyFrozenSet_Type PyCFunction_Type _PyDict_NewPresized PyBaseObject_Type PyUnicode_FromString PyStructSequence_SetItem _Py_TrueStruct PyCapsule_New PySys_SetObject _Py_FalseStruct PyStructSequence_New _Py_NoneStruct PySys_GetObject PyUnicode_FindChar

kernel32

InitializeSListHead DisableThreadLibraryCalls GetCurrentThreadId SetDllDirectoryW LoadLibraryExW QueryPerformanceCounter FormatMessageA GetSystemTimeAsFileTime GetCurrentProcessId GetProcAddress GetShortPathNameW GetModuleFileNameW SetEnvironmentVariableW SetErrorMode GetEnvironmentVariableW CreateFileW GetModuleHandleA GetModuleHandleExA GetLastError CloseHandle

vcruntime140

memcmp strrchr strchr __std_type_info_destroy_list __C_specific_handler memset memcpy

api-ms-win-crt-runtime-l1-1-0

raise signal abort exit _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _execute_onexit_table _cexit _initterm

api-ms-win-crt-convert-l1-1-0

_wtoi mbstowcs

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __stdio_common_vswscanf puts __acrt_iob_func fflush __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

_wcsdup strcmp strcpy strlen strncmp strncpy wcscmp wcsncmp

api-ms-win-crt-math-l1-1-0

copysign

api-ms-win-crt-heap-l1-1-0

malloc free

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char