09a897aefb3e9e5c929bbe2ba911907a9ad99ea4cd5597f592d21a2951969e5c.zip
- SHA256 24c2f25b3d44de6e9b3f8215d34b9fa7c1c8b70b274bf926b1784d1fe7ada633
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
09a897aefb3e9e5c929bbe2ba911907a9ad99ea4cd5597f592d21a2951969e5c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
09a897aefb3e9e5c929bbe2ba911907a9ad99ea4cd5597f592d21a2951969e5c.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 09a897aefb3e9e5c929bbe2ba911907a9ad99ea4cd5597f592d21a2951969e5c.zip
- Size 862KB
- Sample261110-p26vwsfe53
- SHA256 24c2f25b3d44de6e9b3f8215d34b9fa7c1c8b70b274bf926b1784d1fe7ada633
- MD5 7dad626d4dcc27ce6284235410981528
- SHA1 d0d800d87a8bfaab8a5884062e720d4b638b0b3b
- SHA512 7bf1238f133108dc76099ed5169d4fb9ab2fd8f33b3ec4178e09ebf98da8a636c3fdc45aa89c93556409479927be373b9a386a3a746546a19aeb80307d66a6b1
- SSDEEP 24576:+pInYKLMJwQtdPD5/wdjqI6jyCYY9784K:+ynYQMJPdQjqTyP
- TLSH T12015336A787B54040D09A22153DFB4AC37B9E287A8AB1C67CF1724E54F7458CC93E29F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Custom signatureDetect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/09a897aefb3e9e5c929bbe2ba911907a9ad99ea4cd5597f592d21a2951969e5c suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/09a897aefb3e9e5c929bbe2ba911907a9ad99ea4cd5597f592d21a2951969e5c
File Explorer
-
09a897aefb3e9e5c929bbe2ba911907a9ad99ea4cd5597f592d21a2951969e5c.zip.zip 862KB
-
09a897aefb3e9e5c929bbe2ba911907a9ad99ea4cd5597f592d21a2951969e5c.exe 1.6MB
09a897aefb3e9e5c929bbe2ba911907a9ad99ea4cd5597f592d21a2951969e5c
- IMPHASH 52692f9c9263af6bee89590cee0d1bc0
- SHA256 09a897aefb3e9e5c929bbe2ba911907a9ad99ea4cd5597f592d21a2951969e5c
- MD5 db3d1a0f7860957401b91c907efb7327
- SHA1 13f5e0262971f5aa808e9c56cd94ec62f9db0e25
- SHA512 27b774254721ad6d6494e95c2889689195e53b2a4c419c1098d4f2c09a5c880b9c952ce8376304600445d31b8519ee8d395407aa572593c6a07073915aa01a09
- SSDEEP 49152:X86T25iw47LnAa7hZStaQSOky9y9Wi0h2b:P25iw4NtFQLyO
- TLSH T1A0755C47E2A360ECC16BC174461BA773F931B8584134BEBF9590CB712E22E506B6EB35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
5184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
GetUserNameA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
bcrypt
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptDestroyKey
BCryptGenerateSymmetricKey
BCryptOpenAlgorithmProvider
BCryptSetProperty
crypt32
CryptStringToBinaryA
CryptUnprotectData
kernel32
AreFileApisANSI
CloseHandle
CopyFileA
CreateDirectoryA
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexA
CreateMutexW
CreateProcessA
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileA
DeleteFileW
EnterCriticalSection
ExpandEnvironmentStringsA
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeLibrary
GetCPInfo
GetComputerNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetNativeSystemInfo
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetTimeZoneInformation
GetVersionExA
GetVersionExW
GetVolumeInformationA
GlobalMemoryStatusEx
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
IsDBCSLeadByte
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
Process32First
Process32Next
QueryPerformanceCounter
ReadFile
RemoveDirectoryA
SetEndOfFile
SetFileAttributesA
SetFilePointer
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsGetValue
TryEnterCriticalSection
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile
msvcrt
_XcptFilter
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_exit
_fmode
_initterm
_localtime64
_msize
_stricmp
_write
abort
acos
asin
atan
atexit
calloc
cosh
exit
fflush
fprintf
fputc
free
ldexp
localeconv
log10
malloc
memchr
memcmp
memcpy
memmove
memset
qsort
realloc
setvbuf
sinh
strchr
strcmp
strcspn
strerror
strlen
strncat
strncmp
strncpy
strrchr
strspn
strstr
tan
tanh
vfprintf
wcslen
shell32
SHGetFolderPathA
user32
GetSystemMetrics
wininet
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetOpenUrlA
InternetReadFile
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
116KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ