MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e870ae38822a23ec2dbc955c7d749b44ffad06338feccf6b6427cc1d4ee228a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Citadel


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e870ae38822a23ec2dbc955c7d749b44ffad06338feccf6b6427cc1d4ee228a
SHA3-384 hash: 793f15973be06d5ad85b7ab903b8a39ba103cde79838c3da338b99d1313b2e4ef55cc2525892c34b80d6e338a67a5f9a
SHA1 hash: 4db91d69bee19f76014b20ae928d225a97cf65bf
MD5 hash: 7b7aaef71b160bd8399a537fe9d5d801
humanhash: green-item-wyoming-tennessee
File name:0e870ae38822a23ec2dbc955c7d749b44ffad06338feccf6b6427cc1d4ee228a
Download: download sample
Signature Citadel
Create hunting rule
File size:286'720 bytes
First seen:2020-06-10 12:29:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 095593ad7a75b8588311f81868dd97eb (1 x Citadel)
ssdeep 6144:74qqDLHUGy3kDqCjwzyWQNz+bGAG0ed4ekoBKJsd8q:7dqnmrHQNz+bnGR1GXq
Threatray 101 similar samples on MalwareBazaar
TLSH C054C061B080A0B2C5EA3671BE29732B66FFDA3450348CD7E3644D552A69D86F72DF03
Reporter JAMESWT_WT
Tags:Citadel

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Spyware.Zbot-1275
Create hunting rule

Win.Trojan.Zeus-6412294-0
Create hunting rule

Win.Malware.Zbot-6978992-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2015-04-16 02:47:15 UTC
File Type:
PE (Exe)
AV detection:
38 of 48 (79.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b2dqvy4iekrd5qw3zfk4pv2jwrh7vuddhd7mz5vwij6mdvhoekfa._file
Verdict:
malicious
Similar samples:
1ec347934db2ded3a012479882732bfb3cdc85b0d4b2911e3402c1fa693a2235
Citadel
27b86c92d6a04f4074462098e1ea9c0142816b66667effecb36ccde317458166
Citadel
2b123fa8f08714a93a01db03bdf4ecd31d268d5d279900b9c67fec861c2bc11c
Citadel
2d9788648b02d198623fcd299ff6b1853759f1bf026e5d47a5ee83b7e5a7791d
Citadel
371b9214f60a70c81ec1756d284e8028ff7603498341ecb7fa5cc09f3b10043e
Citadel
76494ca680d605eca75201ecf6c87bf1c6070c640e95bf3acfd633ac529a8487
Citadel
b1e971ba689623d9fbc5befb741a9d9e046515a0c05d0adc27a165471bc6303d
Citadel
b68844095af181c139ed272cb04e830f803770518ad9dd78cb789e8f4571b4c3
Citadel
d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19
Citadel
fcce249643f7fe240695fdbc393b54a543fa4a49942b56ad8aad6f219c4f896d
Citadel
+ 91 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-v82l5sgv4j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:citadel13xy
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Citadel 1.5.x.y trojan banker
Rule name:win_citadel_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments