dcb53454395730257537d0991dad577d21222419c9125a723d754279c3e59ffd[.]zip

General

Target
dcb53454395730257537d0991dad577d21222419c9125a723d754279c3e59ffd.zip
Size 3.6MB
Sample261001-txlrdassds
SHA256 f0fe08c6e4ee63881d9a7f87b0e8beb55b1c7f93a3222d4f7f331083599902d6
MD5 49c5b25aeef0d0e24fb0f57f1dab4f6d
SHA1 73dd491f861c7cf0accff4bc08cd1a74c41c3975
SHA512 903ad5ce77afd46d400ace10146f99042a0963956f69d59af486412e2fb5315299a7713ca050e2adf4ee1355edd376aed67e954dabc5209f286c992cf02c1e52
SSDEEP 98304:5sT7ROx9LOm+SQcU8OoEvEYkvjhfIV70zmlgKzMLpS:ST7u9LbMhfQIV+SgKzz
TLSH
T1DF0633C3A5EC54928BDF6C060F19B9F5AA7ACA92104934E9814DFCDD439A3FAD3580DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/dcb53454395730257537d0991dad577d21222419c9125a723d754279c3e59ffd	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/dcb53454395730257537d0991dad577d21222419c9125a723d754279c3e59ffd

File Explorer

dcb53454395730257537d0991dad577d21222419c9125a723d754279c3e59ffd.zip

.zip 3.6MB
dcb53454395730257537d0991dad577d21222419c9125a723d754279c3e59ffd

.exe 9.4MB

dcb53454395730257537d0991dad577d21222419c9125a723d754279c3e59ffd.zip

SHA256 f0fe08c6e4ee63881d9a7f87b0e8beb55b1c7f93a3222d4f7f331083599902d6
MD5 49c5b25aeef0d0e24fb0f57f1dab4f6d
SHA1 73dd491f861c7cf0accff4bc08cd1a74c41c3975
SHA512 903ad5ce77afd46d400ace10146f99042a0963956f69d59af486412e2fb5315299a7713ca050e2adf4ee1355edd376aed67e954dabc5209f286c992cf02c1e52
SSDEEP 98304:5sT7ROx9LOm+SQcU8OoEvEYkvjhfIV70zmlgKzMLpS:ST7u9LbMhfQIV+SgKzz
TLSH
T1DF0633C3A5EC54928BDF6C060F19B9F5AA7ACA92104934E9814DFCDD439A3FAD3580DC
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

dcb53454395730257537d0991dad577d21222419c9125a723d754279c3e59ffd

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 dcb53454395730257537d0991dad577d21222419c9125a723d754279c3e59ffd
MD5 04299847ac2a56cfe666d4a9851eddf2
SHA1 72075ad6ed43dc7a4f8b8e9964055b609f59b926
SHA512 007d945958932f826d1c98f101c94caf3d68ba03f31f4ec3891b7e0f575d1f234b72e4903dbc3a24a4440935cfd996f8a5547e1859fe472c38e950742aac4dab
SSDEEP 196608:4c+AL7Y0S3po2L9oiRzOtuRwZYrL1kehn4i:4cJLk0co2L9oilOtutRka4i
TLSH
T166A64B16B291C803C8B814B0481A4FE564B47E4D5EA8D9B5B8C8773C6BFA1CDB1677F2
MD5 SHA1 SHA512 SSDEEP TLSH

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

9753310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dcb53454395730257537d0991dad577d21222419c9125a723d754279c3e59ffd.zip

dcb53454395730257537d0991dad577d21222419c9125a723d754279c3e59ffd

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

dcb53454395730257537d0991dad577d21222419c9125a723d754279c3e59ffd.zip

dcb53454395730257537d0991dad577d21222419c9125a723d754279c3e59ffd

mscoree

dotnet