MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63ba84423a4d3c8728b3fab4588eed5145889b98c3d070a5dbfcbbed0be29e9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	63ba84423a4d3c8728b3fab4588eed5145889b98c3d070a5dbfcbbed0be29e9f
SHA3-384 hash:	cafacd2ad13d5b29d711f453ba4887bd127baba980a28c4d37e557acf37d9ac2cf3dfb22b5fe5d4c87aeab4323d43578
SHA1 hash:	c52d54245552e6df1572e3b64abcafa8c133df10
MD5 hash:	a47eff79ada6f8e8e14c9f0ace1e0f69
humanhash:	stairway-salami-arizona-network
File name:	zeus 1_1.2.7.12.vir
Download:	download sample
Signature	ZeuS
File size:	122'880 bytes
First seen:	2020-07-19 19:37:38 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b560932229665bf9c0f6365b064b49cd
ssdeep	3072:hbawgcCY9smNVlfIoTtcDTmmHRRlh649V/19dV:hbawHCOsklGDKmRlh649ldV
TLSH	20C39F6BB75000F3C9B71334DA263727B369F9141234A992E3A07FCA19645D2632FB87
Reporter	@tildedennis
Tags:	zeus 1

@tildedennis

zeus 1 version 1.2.7.12

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

18

Origin country :

FR

Mail intelligence

No data

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/28296/

ClamAV Detected

Detection(s):

PUA.Win.Packer.Pequake-4
SecuriteInfo.com.Win32.Heri.1903.3519.UNOFFICIAL

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Sending an HTTP GET request

Creating a file in the %temp% subdirectories

Reading critical registry keys

Creating a file

Deleting a recently created file

Reading Telegram data

Running batch commands

Creating a process with a hidden window

Launching a process

Sending a TCP request to an infection source

Stealing user critical data

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/390444

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/63ba84423a4d3c8728b3fab4588eed5145889b98c3d070a5dbfcbbed0be29e9f/

ReversingLabs TitaniumCloud Malicious

Threat name:

Win32.Trojan.Zbot

Status:

Malicious

First seen:

2015-03-24 05:04:00 UTC

AV detection:

28 of 31 (90.32%)

Threat level

  2/5

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/200719-g5bpp9tvva/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Program crash

Program crash

Drops file in System32 directory

Suspicious use of NtCreateProcessExOtherParentProcess

VirusTotal 78.57%

AV coverage:

78.57%

AV detections:

55 / 70

Link:

https://www.virustotal.com/gui/file/63ba84423a4d3c8728b3fab4588eed5145889b98c3d070a5dbfcbbed0be29e9f/detection/f-63ba84423a4d3c8728b3fab4588eed5145889b98c3d070a5dbfcbbed0be29e9f-1578642722

YOROI YOMI Unknown

Threat name:

Unknown

Score:

1.00

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

  

Link

https://zeusmuseum.com/zeus 1/

Cape

https://www.capesandbox.com/analysis/28296/