c7082fb5e7cb3f2b3855a28824f80a92b45d6a1be7df7b20f010e288dfffaeca[.]zip

General

Target
c7082fb5e7cb3f2b3855a28824f80a92b45d6a1be7df7b20f010e288dfffaeca.zip
Size 8.3MB
Sample261014-va9qcsvz3k
SHA256 dc9eb39baf246bb3ac111e0b79ebb5d175d35d6083980eeb4dacc8fcf51adf16
MD5 90c6d1eabb9d0fbda4d91495a7b024f8
SHA1 e688a9d2c755de8f3251fe0ebc8136ab8e4fe585
SHA512 9f49eb2e6b5fc4c5620d5c80dd89fe6d83c5dd396e498a1a40f332139da45dd121bb7a5fed1fb7c4acfe297b2ae7cc3c926fb16d811f01334df5fa5c01cc7395
SSDEEP 196608:sF7M8+1KOnK8Ynj1R7SgtPtIS3ZH3/RVznFkmITIhqAyaxQJ:sFE1JobhTIIZHvRhnwJa2J
TLSH
T13C9633131203D856DE4635B827FDE122141FB559286888BF839C4EAE8F0BE9FD1AB45C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/c7082fb5e7cb3f2b3855a28824f80a92b45d6a1be7df7b20f010e288dfffaeca	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/c7082fb5e7cb3f2b3855a28824f80a92b45d6a1be7df7b20f010e288dfffaeca

File Explorer

c7082fb5e7cb3f2b3855a28824f80a92b45d6a1be7df7b20f010e288dfffaeca.zip

.zip 8.3MB
c7082fb5e7cb3f2b3855a28824f80a92b45d6a1be7df7b20f010e288dfffaeca

.exe 14.1MB

c7082fb5e7cb3f2b3855a28824f80a92b45d6a1be7df7b20f010e288dfffaeca.zip

SHA256 dc9eb39baf246bb3ac111e0b79ebb5d175d35d6083980eeb4dacc8fcf51adf16
MD5 90c6d1eabb9d0fbda4d91495a7b024f8
SHA1 e688a9d2c755de8f3251fe0ebc8136ab8e4fe585
SHA512 9f49eb2e6b5fc4c5620d5c80dd89fe6d83c5dd396e498a1a40f332139da45dd121bb7a5fed1fb7c4acfe297b2ae7cc3c926fb16d811f01334df5fa5c01cc7395
SSDEEP 196608:sF7M8+1KOnK8Ynj1R7SgtPtIS3ZH3/RVznFkmITIhqAyaxQJ:sFE1JobhTIIZHvRhnwJa2J
TLSH
T13C9633131203D856DE4635B827FDE122141FB559286888BF839C4EAE8F0BE9FD1AB45C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

c7082fb5e7cb3f2b3855a28824f80a92b45d6a1be7df7b20f010e288dfffaeca

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c7082fb5e7cb3f2b3855a28824f80a92b45d6a1be7df7b20f010e288dfffaeca
MD5 0450b043011c98ac0b396bfd7857c408
SHA1 d604033dd084660efa05c5bca119843229935ef6
SHA512 d063a0773bbc772ca44002fc151c651ac481d48f6eaac845dd5050df132a881fbadef2f33c26ff85116541aa35f9e9045347447287142213b8ea2f4e4c528faa
SSDEEP 196608:8nkjSZJqvBAzhXZWWBJI2sP4+s83s7tiQLCXkkehn4i:8ISZJqvGz3nsPtsDvokka4i
TLSH
T186E6AE12B391C813C8B814B045168FE464B47E8D1E69E9A9B8C8B73C67FA1CDB157BF1
MD5 SHA1 SHA512 SSDEEP TLSH

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

14804446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c7082fb5e7cb3f2b3855a28824f80a92b45d6a1be7df7b20f010e288dfffaeca.zip

c7082fb5e7cb3f2b3855a28824f80a92b45d6a1be7df7b20f010e288dfffaeca

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

c7082fb5e7cb3f2b3855a28824f80a92b45d6a1be7df7b20f010e288dfffaeca.zip

c7082fb5e7cb3f2b3855a28824f80a92b45d6a1be7df7b20f010e288dfffaeca

mscoree

dotnet