3da62f80a69fd100559ab1a59566553f076bcc903c4e7c326f5549c807b6a383[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
3da62f80a69fd100559ab1a59566553f076bcc903c4e7c326f5549c807b6a383.zip
Size 482KB
Sample261110-tcv5bage95
SHA256 a448c15af6800f68394ae93402233bc651f0ebfc72cd11c652a0cf3a0e7297fd
MD5 0e87bf88a8c514264b81177773295ed8
SHA1 2f8750b7a64edbd52f2304379bddce41c072665e
SHA512 b5c6d90b157735d27f0d967340ec9fe60b5a9a9cd7fe1e094ca5bcb39f554df1320f69ebd3e647578e84d5f35ca7f346b1ca15909c89ab9fb98876607e2021e2
SSDEEP 12288:xSVbnVF1z6QpMR5LljKMvFmeiPKkjKLSpec8Hjcjb74/:xKDVFt6QO5g4FniisKu07HYb4/
TLSH
T1DEB4231FF4BC9D79B5C9BC9E78B494CB46A5534ADEDA2C2D61727ED80E3448E4070E40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Custom signature

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/3da62f80a69fd100559ab1a59566553f076bcc903c4e7c326f5549c807b6a383	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3da62f80a69fd100559ab1a59566553f076bcc903c4e7c326f5549c807b6a383

File Explorer

3da62f80a69fd100559ab1a59566553f076bcc903c4e7c326f5549c807b6a383.zip

.zip 482KB
3da62f80a69fd100559ab1a59566553f076bcc903c4e7c326f5549c807b6a383

.exe 836KB

3da62f80a69fd100559ab1a59566553f076bcc903c4e7c326f5549c807b6a383.zip

SHA256 a448c15af6800f68394ae93402233bc651f0ebfc72cd11c652a0cf3a0e7297fd
MD5 0e87bf88a8c514264b81177773295ed8
SHA1 2f8750b7a64edbd52f2304379bddce41c072665e
SHA512 b5c6d90b157735d27f0d967340ec9fe60b5a9a9cd7fe1e094ca5bcb39f554df1320f69ebd3e647578e84d5f35ca7f346b1ca15909c89ab9fb98876607e2021e2
SSDEEP 12288:xSVbnVF1z6QpMR5LljKMvFmeiPKkjKLSpec8Hjcjb74/:xKDVFt6QO5g4FniisKu07HYb4/
TLSH
T1DEB4231FF4BC9D79B5C9BC9E78B494CB46A5534ADEDA2C2D61727ED80E3448E4070E40
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

3da62f80a69fd100559ab1a59566553f076bcc903c4e7c326f5549c807b6a383

SHA256 3da62f80a69fd100559ab1a59566553f076bcc903c4e7c326f5549c807b6a383
MD5 015428f61383635d3fc6f0d167d439b0
SHA1 0c19b1b6996326964674919cf17fbd4056e66966
SHA512 035b834211190b216c44130946a962d675cfe48d76d9e8c2ad82bf4dcfd39267e11aa6f51150317e78070a3e5672c6a3478fe8f0917a09848d2ce535b179fbf0
SSDEEP 12288:BnrePWUG9Jzho+goKITpz/bSePLQiEBltsVy6Wy4S3:BrCWUGu+gITpj2E7s0VyxyJ
TLSH
T18105AEE5795E76BAC00A1CBA8E568E6274EC57B2C7501C93FFC53EBA4910CC31623932
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

4290772992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vm_sec

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vlizer

Size

584KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3da62f80a69fd100559ab1a59566553f076bcc903c4e7c326f5549c807b6a383.zip

3da62f80a69fd100559ab1a59566553f076bcc903c4e7c326f5549c807b6a383

generic