MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27fe9d4d96f3a9d7061662925a21077a0a8652b0c5c1263c1f9d9558680686d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZeuS


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27fe9d4d96f3a9d7061662925a21077a0a8652b0c5c1263c1f9d9558680686d8
SHA3-384 hash: 1faf5a27fda16317a324bbb3954913565eb2823f0837644b519a094ce7901cec0ff9be9dfe6e61c916da458f0ae536b0
SHA1 hash: b1c6140c4a39efc2035361c991f242233f4539e0
MD5 hash: 6d5670550cd90ba26456898ba5db59eb
humanhash: batman-undress-kentucky-magazine
File name:27fe9d4d96f3a9d7061662925a21077a0a8652b0c5c1263c1f9d9558680686d8
Download: download sample
Signature ZeuS
Create hunting rule
File size:66'048 bytes
First seen:2020-08-30 13:26:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1ac75e51221a717a5deab2c82d919aa0 (1 x ZeuS)
ssdeep 1536:KNevnxLfDPjvhu68aicPFoN5KdUDYiLGSYo:KNUxrTjo6OY6eAGSYo
Threatray 54 similar samples on MalwareBazaar
TLSH 2C5302DABAD652A4CFCC88721C6D797DEF81B44607054D1C0A2749EFD18DA34AA02FF8
Reporter tildedennis
Tags:ZeuS zeus 1


Avatar
tildedennis
zeus 1 version 1.2.1.3

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'702
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/53133/
Detection(s):
Win.Trojan.Zbot-9502
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Enabling the 'hidden' option for recently created files
Sending a UDP request
Unauthorized injection to a system process
Enabling autorun
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/454644
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes memory attributes in foreign processes to executable or writable
Contains functionality to change the desktop window for a process (likely to hide graphical interactions)
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27fe9d4d96f3a9d7061662925a21077a0a8652b0c5c1263c1f9d9558680686d8/
Threat name:
Win32.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2011-05-29 13:15:00 UTC
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e77j2tmw6ou5obqwmkjfuiihpifimuvqyxasmpa7twkvq2agq3ma._file
Verdict:
malicious
Similar samples:
0784858faba61fdacdad3f9dce2a0803147be628aab9eeb2c8de0663010cd263
ZeuS
122de89a565be1341bcba562c9c99909185fc565491ff90ca5ddc0aa7dcd5f8a
ZeuS
2d30ed2b7cef34f949333c193626d07d47940869f07cb4ad5f068a8dcd2b9f38
ZeuS
3752c65cb7b5a3eba879dd5cc2c6d24eeaf14ca1674d05b76b2ec3e7354ed5f6
ZeuS
448730f2d4964a944073ec33556b6ee092034ad9c2bfc4d1c9ccb2ea5f2fa445
ZeuS
51a5b26ec3238ab826baf519565e861b67e7db782dd3ee5e2058fc4931a52c40
ZeuS
84cd847f2f244fc4f45d9ea1615018fd478f601e455236b6c662aeb94064004a
ZeuS
aa9d72c3f235f17048a1149b4f17df5a7ed4713097359ba5c4135fb0c922bdd2
ZeuS
d74d317525370d236775019f2ae386c688f7200500eead8553ef0d23116d75c0
ZeuS
f10634d37d3220faafddb7f5078cac8f2b6ed2a472ad68ff4b66e73908eb0706
ZeuS
+ 44 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/200830-lm4afdwb36/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Zbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/27fe9d4d96f3a9d7061662925a21077a0a8652b0c5c1263c1f9d9558680686d8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zeus_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://zeusmuseum.com/zeus 1/
Cape
Cape
https://www.capesandbox.com/analysis/53133/

Comments