54999f441a5bd10266c6fd5cf183b02132b8bdffa5a5a930223f8a39b3d7f6f6.zip
- SHA256 a977ca2689fd959e030cee7acf665e149080e0d8ffa6a1d9a39a6746a7bd8a58
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
54999f441a5bd10266c6fd5cf183b02132b8bdffa5a5a930223f8a39b3d7f6f6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
54999f441a5bd10266c6fd5cf183b02132b8bdffa5a5a930223f8a39b3d7f6f6.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 54999f441a5bd10266c6fd5cf183b02132b8bdffa5a5a930223f8a39b3d7f6f6.zip
- Size 76KB
- Sample261014-ryznhset5x
- SHA256 a977ca2689fd959e030cee7acf665e149080e0d8ffa6a1d9a39a6746a7bd8a58
- MD5 7abe038d164d451242d0593b2864f525
- SHA1 8484b5ac29ed4224cb23b69627ca635e298f4f04
- SHA512 e0adb4d0db082c16db959be63c00e7bcf3517eceef42ac3504b9982bb7cd96437e8977b29356f38e058b8799536a992083a20165e28d6bfaac850316d980fabd
- SSDEEP 1536:A/FDgFnP3HiodOBq42xik/HI8zqozt0BIj/C272FyWG95RbvzATNF:Al3zoJxXHIkqoGBIj/78yWqTzATv
- TLSH T1F073022864728C2B85D01CFE7165E84ED52DA4E730DB763FC1B8C4A9C2DB392B989947
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/54999f441a5bd10266c6fd5cf183b02132b8bdffa5a5a930223f8a39b3d7f6f6 suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/54999f441a5bd10266c6fd5cf183b02132b8bdffa5a5a930223f8a39b3d7f6f6
File Explorer
-
54999f441a5bd10266c6fd5cf183b02132b8bdffa5a5a930223f8a39b3d7f6f6.zip.zip 76KB
-
54999f441a5bd10266c6fd5cf183b02132b8bdffa5a5a930223f8a39b3d7f6f6.exe 160KB
54999f441a5bd10266c6fd5cf183b02132b8bdffa5a5a930223f8a39b3d7f6f6
- IMPHASH 0e73da4f7285d2c7ef456747806102e8
- SHA256 54999f441a5bd10266c6fd5cf183b02132b8bdffa5a5a930223f8a39b3d7f6f6
- MD5 33056b04e2ab3a9bb961a3ac0567f218
- SHA1 32293f368ef3a028bc497599e7ea919c1eb0ab55
- SHA512 ed02fd2b52cb9224605b6739dbc1e1e765c80fbfa0fc1fe99d7cad4eef35c963860359d26de3ed64845dceb086775d188428b3ca4a9273eab1256ff8ac300aca
- SSDEEP 3072:Unv33IoJfWoiORQx32PBHb4RP95k5EBHAupaIZT:UnP9fpisQx3oMfZ
- TLSH T1AAF34B17B76570FEE16B8535C9520905FB727C764BA0AADF07600AB70E236E09E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
27076
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
SetFileAttributesA
LocalFree
GetFileSize
ExitProcess
GlobalMemoryStatusEx
CreateDirectoryA
IsDebuggerPresent
WriteConsoleW
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetStringTypeW
GetSystemInfo
CloseHandle
Process32FirstW
LoadLibraryA
CreateFileA
Process32NextW
CreateThread
GetLastError
CopyFileA
Sleep
CreateToolhelp32Snapshot
VirtualAlloc
WriteFile
GetCurrentProcess
VirtualProtect
SetStdHandle
GetFileType
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapFree
HeapAlloc
WideCharToMultiByte
LCMapStringW
InitializeCriticalSectionEx
GetModuleFileNameA
ReadFile
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
user32
GetMessageW
GetDC
ReleaseDC
CallNextHookEx
SetWindowsHookExW
TranslateMessage
DispatchMessageW
GetKeyNameTextA
GetSystemMetrics
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
DeleteObject
shell32
SHGetFolderPathA
ShellExecuteA
ole32
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CLSIDFromString
CoUninitialize
oleaut32
VariantClear
SysAllocString
SysFreeString
wininet
InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetCloseHandle
gdiplus
GdipDisposeImage
GdipFree
GdiplusStartup
GdipSaveImageToFile
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdiplusShutdown
crypt32
CryptUnprotectData
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=148, id=261, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=13, id=260, version=33145,
count=51, id=261, version=35207,
count=21, id=257, version=33145,
count=170, id=1, productName=Unmarked objects,
count=1, id=265, version=35221,
count=1, id=255, version=35221,
count=1, id=258, version=35221,