219b6e9db2bdc69a8ae75c25630c45a25df4956b9865d7805100c5a61d799cd3[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
219b6e9db2bdc69a8ae75c25630c45a25df4956b9865d7805100c5a61d799cd3.zip
Size 15.3MB
Sample261110-fdt2ray1az
SHA256 d0cd08dcceb9d29d4722185023c59085a9e161dbfa13799bc266a4afa0cc8ca7
MD5 3acca824ef38dde8bbeca2cd16f6540b
SHA1 cf79526e55f8d65fa4c159ce82a8e187edce618e
SHA512 069ef9e278950a5d33982404107e1824275c68a2dfaad1dc4647fdf1bd15bdb105c11b1554f70be26df60e04aedf49c25c96bb63ae5af44a494280f4de7cb31c
SSDEEP 393216:k2KVNAJdSNH6M/lr9Ege8VcoN7hBmP4+6FtVVUlq8DOC5/QK3cZ:kJU/Sl6MTe8Vcot7J/U/DRVcZ
TLSH
T10BF633DE898B248EC9DEC58F0527FC59D7643328AF212234579E2712607E35EBF52E12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Custom signature

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/219b6e9db2bdc69a8ae75c25630c45a25df4956b9865d7805100c5a61d799cd3	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/219b6e9db2bdc69a8ae75c25630c45a25df4956b9865d7805100c5a61d799cd3

File Explorer

219b6e9db2bdc69a8ae75c25630c45a25df4956b9865d7805100c5a61d799cd3.zip

.zip 15.3MB
219b6e9db2bdc69a8ae75c25630c45a25df4956b9865d7805100c5a61d799cd3

.exe .ps1 20.7MB

219b6e9db2bdc69a8ae75c25630c45a25df4956b9865d7805100c5a61d799cd3.zip

SHA256 d0cd08dcceb9d29d4722185023c59085a9e161dbfa13799bc266a4afa0cc8ca7
MD5 3acca824ef38dde8bbeca2cd16f6540b
SHA1 cf79526e55f8d65fa4c159ce82a8e187edce618e
SHA512 069ef9e278950a5d33982404107e1824275c68a2dfaad1dc4647fdf1bd15bdb105c11b1554f70be26df60e04aedf49c25c96bb63ae5af44a494280f4de7cb31c
SSDEEP 393216:k2KVNAJdSNH6M/lr9Ege8VcoN7hBmP4+6FtVVUlq8DOC5/QK3cZ:kJU/Sl6MTe8Vcot7J/U/DRVcZ
TLSH
T10BF633DE898B248EC9DEC58F0527FC59D7643328AF212234579E2712607E35EBF52E12
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

219b6e9db2bdc69a8ae75c25630c45a25df4956b9865d7805100c5a61d799cd3

IMPHASH 7db2d54ca01ba36711a5cdd365f15145
SHA256 219b6e9db2bdc69a8ae75c25630c45a25df4956b9865d7805100c5a61d799cd3
MD5 a2b3d524668cdd46f804f1c0acd84864
SHA1 c737d3e3463f4a6bbf93525c78d37effa3e044fd
SHA512 4d3e6bfe6d250820ef3175a50aff46c0ff4aa2a79cf830d026ff8ebbaa51663c7756fc9a0df6ad52812fc09cf7b6d9814c99562f9e15efde9f786bd408e53ed4
SSDEEP 393216:d5hhMT+QkCwnv7825Fm5foe1Mh0/T2R9gqZ:d3hMT+zLWoe1MKC+u
TLSH
T1E62701DA38D5507DC092C735D28A5AFDF08A79894D799C1BBFC359002E32C96C8B6B36
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64 polyglot

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

21086030

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.~m5

Size

10.7MB

Virtual Size

10.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.eTJ

Size

512B

Virtual Size

136B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xr&

Size

10.0MB

Virtual Size

10.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

796B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

219b6e9db2bdc69a8ae75c25630c45a25df4956b9865d7805100c5a61d799cd3.zip

219b6e9db2bdc69a8ae75c25630c45a25df4956b9865d7805100c5a61d799cd3

advapi32

kernel32

ole32

user32

wininet

generic