Hackers Turn Telegram Into a Command Center for HEAVYGRAM Surveillance Malware

Heavygram is a Windows surveillance backdoor that leverages Telegram as a command and control center for attackers.

Indicators of compromise (IoCs): - Type Indicator Description - SHA-256 8219453084f370cee43aafe27b9def6b9d3d75fb31bacd7e2fa1d82d617f26dd First-stage file - SHA-1 0190940243f6535f51d43edafac943d493159e14 First-stage file - MD5 b3c1a3eebefafe1346c6a864b5423182 First-stage file - SHA-256 47fa634b13b8ba35bd5669da3059a0c7577911c16584a2ff173368f848825de4 RAR archive artifact - SHA-1 88a8d118ee190ac36cf684c2992f6ddd2dda517b RAR archive artifact - MD5 b2f6f40570ac9085b5463fdb623560de RAR archive artifact - SHA-256 d2d19c7f2e4a5fdcfb34b26f048077d2c4fe26637ed2c90e9e9bdf32307c377e HEAVYGRAM implant or backdoor - SHA-1 9108466c98df01033371483a789a0c23372c52f2 HEAVYGRAM implant or backdoor - MD5 16602375fc2dae1eb54580ab7eda6567 HEAVYGRAM implant or backdoor - SHA-256 3befcca381deb6b492aa0c4eba222c29a25192aeacbf2315798c4754a4b74e81 Encrypted text artifact - SHA-1 53d41445e176bf53c5acd2dad533eda612b05855 Encrypted text artifact - MD5 7d3cce1f9dbaed585b61e6e903d69b9b Encrypted text artifact - SHA-256 6ddd145622cde2d2f91dace7e1f7edef22f4d49d3645fa9ad4bdb772829c30bf ZIP archive artifact - SHA-1 3549f6df9c14b70d2308b7b12033218e77fe1dc7 ZIP archive artifact - MD5 d6756063230136f8c55ae27f1a4b0112 ZIP archive artifact - SHA-256 4a3aa8f4f0eb37be9778fbdf0b7dd282fc407557da61735d2ae9cfc73ee2aa81 First-stage file - SHA-1 9391928e5163ff791c1b4bc535f4ac92510810a6 First-stage file - MD5 5507a3e71aade582dd226b63b1930c56 First-stage file - SHA-256 844108a626c15395059efa355a66c8462af0c822d8219b35b6038d9d42dcf61d ZIP archive artifact - SHA-1 ef3f7292cb2f91f9a34953b875eb018b3ef889d2 ZIP archive artifact

• MD5 ca65cc67247d0702ca34eb7b06873bec ZIP archive artifact - SHA-256 65359388b49ae2a982111ebe8ac837d0f3294ceab7a712df20d0f6c19bf3029e First-stage file - SHA-1 4a2658c66f3aeabdb05f56ba88d587683319ce6d First-stage file - MD5 4dcfa4317f2111109cd41f457541ed2b First-stage file - SHA-256 ec9d3e32a4e78f8cc9581f5cf030f0594debee1ce67d2d0759aff3ec1c720b35 ZIP archive artifact - SHA-1 5d3cde9f6971ec35431cbb113b6b4bc292ea5db0 ZIP archive artifact - MD5 a1ca53f09b0c6fe3b3b57b5202192d60 ZIP archive artifact - SHA-256 5380ffda12f97cf4d8e0fe02e0580aa1a48b4b6da95e7f8a30029ad125c51b3f First-stage file - SHA-1 2b11bccdea89d428610c15bea1fba417ab8681a6 First-stage file - MD5 b66bd18de204d405500dc079876b7cbf First-stage file - SHA-256 e9d2e4e8fac6420ca3b3a3a63a3d313dcfb236a24a11889d6923dd9b42a777d4 First-stage file - SHA-1 6d9817f5066be757f5f09b067a80fed3cfe280f6 First-stage file - MD5 14698d3a03216daa2cf6f39e4f1c4031 First-stage file - SHA-256 8ad63d4d30cd28391318e26f4e9464f302b0a12675a721967d4f2173ed6cfe8a First-stage file - SHA-1 af9d13e27c8eedc30dd78f237013b239cf23f35d First-stage file - MD5 0a656287defcbd8a9c47385b805993df First-stage file - SHA-256 3f1313c813e51edf5734d9fb99eb93d6c3aa6c309e3f0a6a4878291c5b2ec73b ZIP archive artifact - SHA-1 f269488e2128128f234ee2e996489317bfa4720b ZIP archive artifact - MD5 d9418fb432631021a15fb896b365d608 ZIP archive artifact - SHA-256 138a4c9cd617912c2269fae64b6b12d57e926a36c2c62f25ee05a32cdf102212 First-stage file - SHA-1 8c6b6236420c876989af36e3a9e648a00f3000c9 First-stage file - MD5 fefaefbf09841cef739d090305edc7a4 First-stage file - SHA-256 bb56792212abe160fff643631fb69b2081601e6310fc6669fd9d52d690ec1903 First-stage file - SHA-1 6fcf829720f425f81a6b35ac5f05fa94775429eb

First-stage file - MD5 c8aeca21d10f6bbb78e1f2a67d78fcad First-stage file - SHA-256 7477f4f25d1cfc3dfb1267e35ab4bcf0b30b8c7ec9677a8d1849ee7d17bc15aa ZIP archive artifact - SHA-1 168caccbe59473091aa4fbbebba6257aed17985e ZIP archive artifact - MD5 87f7d0b30f7905d282fb464f5ad6c6cf ZIP archive artifact - SHA-256 2deeeda412c40ad515dca940916a376d187219ed09ed697b4be4879b7091ec53 CRUDEEXCLUDE executable - SHA-1 5dd86e22b882d52c67d274e3297694009d13fb96 CRUDEEXCLUDE executable - MD5 6cae314ddcd821dd2a60dff1fa02460a CRUDEEXCLUDE executable - SHA-256 b0308c91a56209222b178e7099ee03a7b0d06a0e473f042fb2d3c144a07484fa ZIP archive artifact - SHA-1 88816b1262eaf819edebb93dc883b3082cc64c34 ZIP archive artifact -...