1a2aff1725534cc3115da7d1e9096b4868fd51b3d59e6a4466df419efb114aee[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
1a2aff1725534cc3115da7d1e9096b4868fd51b3d59e6a4466df419efb114aee.zip
Size 482KB
Sample261107-2vlycsfz6w
SHA256 e8927ee5a9b166bfc4ba46f7f9aba421a9cea9d1248e6139865b1335f9fb72bf
MD5 21df3f549a0ba54c133049eeb077ef7c
SHA1 b48a1190abe743614bcee1124357842d7f9952c0
SHA512 4f84db6bab9aff1635b44d5a0aaa3a046ab2689271b57bdf88098f6b644b96041b332e1c1f467c5d9c8066c412880327448f13546756924fd70e9e6ee1eb6131
SSDEEP 12288:Yue1E+DlocH5FV5dslrq1PgrbF+ymkL86IusHbU57:Yuel5FXdUrbkymkLrsHbi7
TLSH
T11BB423248F6CCA656B373F72AF1C801F4B89D04E38BA244D7AE5F377406F99856A1139
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Custom signature

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/1a2aff1725534cc3115da7d1e9096b4868fd51b3d59e6a4466df419efb114aee	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1a2aff1725534cc3115da7d1e9096b4868fd51b3d59e6a4466df419efb114aee

File Explorer

1a2aff1725534cc3115da7d1e9096b4868fd51b3d59e6a4466df419efb114aee.zip

.zip 482KB
1a2aff1725534cc3115da7d1e9096b4868fd51b3d59e6a4466df419efb114aee

.exe 836KB

1a2aff1725534cc3115da7d1e9096b4868fd51b3d59e6a4466df419efb114aee.zip

SHA256 e8927ee5a9b166bfc4ba46f7f9aba421a9cea9d1248e6139865b1335f9fb72bf
MD5 21df3f549a0ba54c133049eeb077ef7c
SHA1 b48a1190abe743614bcee1124357842d7f9952c0
SHA512 4f84db6bab9aff1635b44d5a0aaa3a046ab2689271b57bdf88098f6b644b96041b332e1c1f467c5d9c8066c412880327448f13546756924fd70e9e6ee1eb6131
SSDEEP 12288:Yue1E+DlocH5FV5dslrq1PgrbF+ymkL86IusHbU57:Yuel5FXdUrbkymkLrsHbi7
TLSH
T11BB423248F6CCA656B373F72AF1C801F4B89D04E38BA244D7AE5F377406F99856A1139
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

1a2aff1725534cc3115da7d1e9096b4868fd51b3d59e6a4466df419efb114aee

SHA256 1a2aff1725534cc3115da7d1e9096b4868fd51b3d59e6a4466df419efb114aee
MD5 1ba01bbf0c750b97a979fb050700d934
SHA1 19b33d168f431458ee98117576288d237ec8a7d0
SHA512 4dfe4d0fbdb79c54080190be491584f307121be827ab791f4f074cc4f564726c2dce5c4aef7d41d342d106b4ab461099dd5bea07933f1cfc6f6243c5ae13c581
SSDEEP 12288:BnrePWUGpJzhk+goKITpz/bSePLQiEBltsVy6Wy4S3:BrCWUG2+gITpj2E7s0VyxyJ
TLSH
T1C705AEE5795E76BAC00A1CBA8E568E6274EC57B2C7501C93FFD53EBA4910CC31623932
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

4290772992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vm_sec

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vlizer

Size

584KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1a2aff1725534cc3115da7d1e9096b4868fd51b3d59e6a4466df419efb114aee.zip

1a2aff1725534cc3115da7d1e9096b4868fd51b3d59e6a4466df419efb114aee

generic