3c1e964b64e34027781dd1c0beab3f189812b42f6fc1774583183670d8de5609[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
3c1e964b64e34027781dd1c0beab3f189812b42f6fc1774583183670d8de5609.zip
Size 9.5MB
Sample261012-sdggwaxvaz
SHA256 f0f7bf00d395450d29cecaee9f94c2f5a0936204c6bb412934eeaa72ec211556
MD5 4ff1405ef3784a7956320d6a27114a3f
SHA1 9ee9fdabd2fa19c0460d240e9777cdd9c178a17f
SHA512 9d5bbf72a9a4f393335d16a275ff93516cd1b91f5eb26b44ff8019f65771861c80d27ac782a97c84f1e19ad91f28c067706a727b9241903c11dd50730cbd3594
SSDEEP 196608:VtBYh01FenYHfe/4O892XR2S7YTv51mQKWGSwgEmGTfp+ru/ju:ay/enYWwOwW2S78vPmQQgEm9r
TLSH
T1F0A633BA952D427113840C9D6A0DE3D9C21B602878CB53BADD357F231B39E45EB86BC7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/3c1e964b64e34027781dd1c0beab3f189812b42f6fc1774583183670d8de5609	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3c1e964b64e34027781dd1c0beab3f189812b42f6fc1774583183670d8de5609

File Explorer

3c1e964b64e34027781dd1c0beab3f189812b42f6fc1774583183670d8de5609.zip

.zip 9.5MB
3c1e964b64e34027781dd1c0beab3f189812b42f6fc1774583183670d8de5609

.exe 30.5MB

3c1e964b64e34027781dd1c0beab3f189812b42f6fc1774583183670d8de5609.zip

SHA256 f0f7bf00d395450d29cecaee9f94c2f5a0936204c6bb412934eeaa72ec211556
MD5 4ff1405ef3784a7956320d6a27114a3f
SHA1 9ee9fdabd2fa19c0460d240e9777cdd9c178a17f
SHA512 9d5bbf72a9a4f393335d16a275ff93516cd1b91f5eb26b44ff8019f65771861c80d27ac782a97c84f1e19ad91f28c067706a727b9241903c11dd50730cbd3594
SSDEEP 196608:VtBYh01FenYHfe/4O892XR2S7YTv51mQKWGSwgEmGTfp+ru/ju:ay/enYWwOwW2S78vPmQQgEm9r
TLSH
T1F0A633BA952D427113840C9D6A0DE3D9C21B602878CB53BADD357F231B39E45EB86BC7
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

3c1e964b64e34027781dd1c0beab3f189812b42f6fc1774583183670d8de5609

IMPHASH 478472a97bc7c96358a8ee53052e15c1
SHA256 3c1e964b64e34027781dd1c0beab3f189812b42f6fc1774583183670d8de5609
MD5 22965ad5c97f494b4b326774be6a3d2d
SHA1 dd914008acaefd3733b15d427e3d2afc2db473d9
SHA512 7fae340f27177aca4208cc3ec11bca81e60a3614c7292ff034b4f46b09054c7e2b91d2ca4dcef25668f0d72e1e32dbde2346f679a22eb91b3689ccd7b426e694
SSDEEP 196608:yz2dhenmZavqUzOH/LGj918hMAcPoCxpkO6:yzmhemFUzOiuhfcPoC8O
TLSH
T15167D726767964D9D1BBC0B892838F22AE2174E907392BF745D182762F34EF86D3C354
MD5 SHA1 SHA512 SSDEEP TLSH

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

23505264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

recorder_engine-afeb9a35f3cfe127.pdb

bcryptprimitives

ProcessPrng

kernel32

GetFileInformationByHandle SetNamedPipeHandleState CreateFileW GetSystemInfo GetConsoleScreenBufferInfo GetLastError GetStdHandle CloseHandle FlushFileBuffers GetTickCount GetSystemTime GetConsoleMode GetModuleHandleA GetProcAddress CancelIoEx GetSystemTimeAsFileTime FreeLibrary GetCurrentProcessId GetFileSize LockFileEx LocalFree UnlockFile DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA Sleep GetFileAttributesW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW WriteFile GetFullPathNameW ReadFile AreFileApisANSI GetCurrentThreadId GetCurrentProcess DuplicateHandle RegisterWaitForSingleObject UnregisterWaitEx SetFileCompletionNotificationModes GetOverlappedResult GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateIoCompletionPort SetHandleInformation SetConsoleTextAttribute InitializeSListHead RtlCaptureContext FindNextFileW QueryPerformanceFrequency WaitForMultipleObjects GetFileType IsThreadAFiber FlsSetValue GetModuleHandleW GetModuleHandleExW FlsAlloc FlsFree SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA SwitchToThread ExitProcess FindClose FindFirstFileExW RemoveDirectoryW lstrlenW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW GetExitCodeProcess GetEnvironmentStringsW TerminateProcess GetProcessId CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx SetFileTime CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry SetUnhandledExceptionFilter WriteFileEx SleepEx ReadFileEx CreateEventW CreateThread CreateHardLinkW CopyFileExW SetFileInformationByHandle MoveFileExW SetLastError FreeEnvironmentStringsW CompareStringOrdinal DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException HeapCreate HeapFree OutputDebugStringA UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar FormatMessageW OutputDebugStringW FlushViewOfFile LoadLibraryA HeapReAlloc LoadLibraryW HeapAlloc HeapCompact HeapDestroy GetProcessHeap SystemTimeToFileTime WideCharToMultiByte FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter RtlVirtualUnwind

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

WSASocketW connect shutdown send getsockname getpeername setsockopt getsockopt recv bind WSAIoctl closesocket WSASend WSAGetLastError listen ioctlsocket accept freeaddrinfo WSACleanup WSAStartup getaddrinfo select

ntdll

NtOpenFile NtWriteFile NtCreateNamedPipeFile NtCreateFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtReadFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

userenv

GetUserProfileDirectoryW

vcruntime140

__current_exception_context __CxxFrameHandler3 __current_exception _CxxThrowException __C_specific_handler strrchr strchr memchr memcpy memset memmove memcmp

api-ms-win-crt-math-l1-1-0

pow fmod floor __setusermatherr log fabs ceil _dclass round

api-ms-win-crt-string-l1-1-0

strcspn strlen strspn strcmp strncmp

api-ms-win-crt-heap-l1-1-0

malloc realloc free _set_new_mode _msize

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _initterm_e _initterm exit _exit _beginthreadex terminate _endthreadex _seh_filter_exe _set_app_type _configure_narrow_argv __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _get_initial_narrow_environment _register_onexit_function _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale