e823bf79355ad7f92100bbd784457fbededbe55e335d60f1f6f527a25ce2178f[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
e823bf79355ad7f92100bbd784457fbededbe55e335d60f1f6f527a25ce2178f.zip
Size 10.8MB
Sample260930-nsv7csvalb
SHA256 03d5cf2fdcbe01e5c8255d4bbc0049d04e72d0eb5e12f422b9b6dcf787fe7961
MD5 e909b418fcaa2f5abe141b0102caa68e
SHA1 98584402367df43f28cab0a9792d49c413812c00
SHA512 ec60088cfb78032201bcc3520316b59069a863b134b979acf55a9d4a51b94ae0fe8020b8de63e125563b9319229a8a707b5f2c67e2c577c1077060cbf6fa44fc
SSDEEP 196608:eG360ejH/LepM1UlcIZAmI0GIVYmR0/6LxmSBs9CU+qw:eG5erD1G1C6Vk6Lxr/bqw
TLSH
T10BB6338BA29EEEB7BCE450E464FBCA177ECC555254DDBF32C9C45422B46E02CC90498E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/e823bf79355ad7f92100bbd784457fbededbe55e335d60f1f6f527a25ce2178f	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e823bf79355ad7f92100bbd784457fbededbe55e335d60f1f6f527a25ce2178f

File Explorer

e823bf79355ad7f92100bbd784457fbededbe55e335d60f1f6f527a25ce2178f.zip

.zip 10.8MB
e823bf79355ad7f92100bbd784457fbededbe55e335d60f1f6f527a25ce2178f

.dll 29.9MB

e823bf79355ad7f92100bbd784457fbededbe55e335d60f1f6f527a25ce2178f.zip

SHA256 03d5cf2fdcbe01e5c8255d4bbc0049d04e72d0eb5e12f422b9b6dcf787fe7961
MD5 e909b418fcaa2f5abe141b0102caa68e
SHA1 98584402367df43f28cab0a9792d49c413812c00
SHA512 ec60088cfb78032201bcc3520316b59069a863b134b979acf55a9d4a51b94ae0fe8020b8de63e125563b9319229a8a707b5f2c67e2c577c1077060cbf6fa44fc
SSDEEP 196608:eG360ejH/LepM1UlcIZAmI0GIVYmR0/6LxmSBs9CU+qw:eG5erD1G1C6Vk6Lxr/bqw
TLSH
T10BB6338BA29EEEB7BCE450E464FBCA177ECC555254DDBF32C9C45422B46E02CC90498E
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

e823bf79355ad7f92100bbd784457fbededbe55e335d60f1f6f527a25ce2178f

IMPHASH 0cb3c385ea633451ae3ab56f08bd00ff
SHA256 e823bf79355ad7f92100bbd784457fbededbe55e335d60f1f6f527a25ce2178f
MD5 16dc6c07cea4ac58dd3b582b4c131f8a
SHA1 d322d27c9607b8f66f3bb9e881638b2a225f358c
SHA512 8756ea61a27c95e4d471fda96b13c752124c6f629d3344034e9aa5fe195090b6bdcd9b55f8a2ff7045a931c23237d0a3220a35fb689b65097c936331f76ab379
SSDEEP 196608:JrHVIhQ/LrDHFUAoberPW7h3Yx/kPjKpkLkDu2PE4:11ffmfSmE8PjKaH2PE4
TLSH
T1AC673B1333740042FBB5D0B64CA98763DFB2B9DE572172A3246CCA692BC7ED596EC244
MD5 SHA1 SHA512 SSDEEP TLSH

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

19849568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

python313

PyRange_Type PyClassMethod_Type PyByteArray_FromObject PyExc_UnicodeEncodeError PyExc_IOError PyExc_FileNotFoundError PyExc_ModuleNotFoundError PyExc_SyntaxError PyComplex_Type PySlice_Type PyExc_UnboundLocalError PyExc_TimeoutError PyExc_OverflowError PyObject_GetAttr PyExc_ConnectionError PyModule_GetFilenameObject PySequence_List PyNumber_InPlaceOr PyExc_ImportWarning PyObject_SetAttr PyOS_snprintf PyThreadState_Get PyMem_GetAllocator PyErr_GivenExceptionMatches PyDictItems_Type PyErr_WarnEx PyFunction_Type _PyArg_NoKeywords PyLong_AsSsize_t PyDictKeys_Type PyImport_ImportModule PyObject_SelfIter PyEval_GetFuncName PyImport_ExecCodeModuleEx PyUnicode_RichCompare PyUnicode_DecodeUTF8 PyList_Sort PyObject_SetAttrString PyNumber_FloorDivide PyUnicode_Concat Py_BuildValue PyExc_MemoryError PyComplex_FromDoubles PyModule_GetName PyUnicode_FromOrdinal PyExc_RecursionError PyBytes_FromString PyModule_GetDef _PyObject_GC_Resize PyTuple_New PyLong_FromString PyDict_SetItemString PyFrame_Type PyFloat_FromDouble PyDictValues_Type PyUnicode_New PyObject_LengthHint PyUnicode_FromWideChar PyMarshal_ReadObjectFromString PyExc_ZeroDivisionError PyIter_Next PyObject_GetIter PyNumber_Add PyEval_EvalCodeEx PyIter_Send PyNumber_InPlaceLshift PyObject_RichCompare PyCoro_Type PyNumber_InPlaceAdd PyModule_NewObject PyMethod_Type PyNumber_Subtract _Py_Dealloc PyImport_GetModuleDict PyObject_Free PyImport_ImportFrozenModule PyErr_ExceptionMatches _PyUnicode_InternImmortal PyEnum_Type _PyErr_FormatFromCause PyObject_Dir PyObject_GC_Del PyObject_CallFunctionObjArgs PyLong_AsLong PyLong_FromUnicodeObject _PyBytes_Resize PyObject_ClearWeakRefs PyObject_Init PyCode_Type PyUnicode_AsUTF8 PyUnicode_AsWideCharString PyObject_GetBuffer PyErr_BadArgument PyType_Ready PyModule_FromDefAndSpec2 Py_CompileStringExFlags PyState_AddModule PyObject_RichCompareBool PyMapping_Check _PyLong_New PyObject_GenericSetAttr PyDict_New PyNumber_ToBase PyByteArray_FromStringAndSize PyModule_ExecDef _PyEval_EvalFrameDefault PyLong_AsLongAndOverflow PyCMethod_New _PySet_NextEntry PyErr_NoMemory PyObject_Realloc _PyRuntime PyDict_GetItemString PyEllipsis_Type PyDict_GetItem PyImport_FrozenModules PyUnstable_Code_NewWithPosOnlyArgs PyCode_Addr2Line PyArg_ParseTupleAndKeywords PyImport_ExecCodeModule PyUnicode_FromEncodedObject _PyObject_New PyObject_IsTrue PyObject_Str PyExc_NameError _PyByteArray_empty_string PyMem_Malloc PyModuleDef_Type _PyIntrinsics_UnaryFunctions PyGen_Type PyState_FindModule PyObject_CallMethodObjArgs PyArg_UnpackTuple PyModule_GetState _PyErr_SetString PyAsyncGen_Type PyErr_Print PyTraceBack_Type PyUnicode_GetLength _Py_FatalErrorFunc Py_GenericAliasType _PyLong_Copy PyUnicode_Format PyBuffer_Release PyObject_Call PyNumber_Float PyArg_ParseTuple PyUnicode_Substring PyEval_RestoreThread PyUnicode_FromStringAndSize PyFloat_FromString PyWideStringList_Append PyList_SetSlice Py_ExitStatusException PyConfig_SetArgv Py_NoSiteFlag PyList_Size Py_NoUserSiteDirectory Py_SetProgramName PyStatus_Exception Py_DontWriteBytecodeFlag Py_DebugFlag PyConfig_SetString Py_BytesWarningFlag _PyConfig_InitCompatConfig Py_VerboseFlag PySys_SetArgv Py_InitializeFromConfig Py_OptimizeFlag PyDict_DelItemString Py_UTF8Mode Py_InteractiveFlag Py_InspectFlag Py_IgnoreEnvironmentFlag Py_FrozenFlag PyStructSequence_InitType PyMemoryView_Type PyExc_UnicodeError PyFloat_Type PyDict_MergeFromSeq2 PyDict_Merge PyExc_NotImplementedError PyZip_Type PyStaticMethod_Type PyMap_Type PyExc_BrokenPipeError PyObject_GetItem PyExc_EOFError PyBool_Type PyProperty_Type PyLong_Type PyByteArray_Type _Py_NotImplementedStruct PyFrozenSet_New PyFilter_Type PyExc_LookupError PyExc_UnicodeDecodeError PyObject_Repr PyObject_SetItem PyExc_AssertionError _Py_EllipsisObject PyLong_FromVoidPtr PyCell_New PyExc_KeyError PyObject_DelAttr PyObject_DelItem PyExc_ImportError PyExc_StopAsyncIteration PyDict_DelItem _PySet_Update PyExc_OSError PyList_Type PyNumber_Negative PyReversed_Type PySet_Type PyBytes_Type PySet_New PyTuple_Type PyDict_Type PyExc_SystemExit PySet_Add PySequence_Contains PyExc_KeyboardInterrupt PySet_Contains PyExc_RuntimeError PyLong_FromSsize_t PyDict_Update Py_Exit _PyObject_FunctionStr PySequence_Tuple PyEval_AcquireThread _PyThreadState_GetCurrent PyExc_GeneratorExit PyExc_IndexError PyModule_Type PyObject_IsSubclass PyNumber_AsSsize_t PyNumber_Long PyExc_StopIteration PyUnicode_Type PySequence_Check PyObject_GetAttrString PyUnicode_FromFormat PyModule_GetDict PyUnicode_Join PyType_IsSubtype PySeqIter_Type PyExc_BaseException PyExc_ValueError PyErr_WriteUnraisable PyEval_SaveThread PyErr_PrintEx PyExc_Exception Py_MakePendingCalls Py_GenericAlias PyType_Type _PyType_Lookup PyExc_SystemError PyExc_TypeError PyDict_SetItem PyErr_Format PyExc_AttributeError PyFrozenSet_Type PyCFunction_Type _PyDict_NewPresized PyBaseObject_Type PyUnicode_FromString PyStructSequence_SetItem _Py_TrueStruct PyCapsule_New PySys_SetObject _Py_FalseStruct PyStructSequence_New _Py_NoneStruct PySys_GetObject PyUnicode_FindChar

kernel32

InitializeSListHead DisableThreadLibraryCalls GetCurrentThreadId SetDllDirectoryW LoadLibraryExW QueryPerformanceCounter FormatMessageA GetSystemTimeAsFileTime GetCurrentProcessId GetProcAddress GetShortPathNameW GetModuleFileNameW SetEnvironmentVariableW SetErrorMode GetEnvironmentVariableW CreateFileW GetModuleHandleA GetModuleHandleExA GetLastError CloseHandle

vcruntime140

memcmp strrchr strchr __std_type_info_destroy_list __C_specific_handler memset memcpy

api-ms-win-crt-runtime-l1-1-0

raise signal abort exit _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _execute_onexit_table _cexit _initterm

api-ms-win-crt-convert-l1-1-0

_wtoi mbstowcs

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __stdio_common_vswscanf puts __acrt_iob_func fflush __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

_wcsdup strcmp strcpy strlen strncmp strncpy wcscmp wcsncmp

api-ms-win-crt-math-l1-1-0

copysign

api-ms-win-crt-heap-l1-1-0

malloc free

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char