MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aadccab126517a622697730983aaee1b8475bd0f16e09b296649ea0740e5ab3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZeuS


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aadccab126517a622697730983aaee1b8475bd0f16e09b296649ea0740e5ab3c
SHA3-384 hash: 0f700239f6fcf43a12c188c5d0f8af81ef56908a84aa7e701166b96182fcaa0ba19bb5878e2ac4986b0744b8696970d6
SHA1 hash: 5ad492be9cb4b1b474d17bb449943d623a9edc64
MD5 hash: a58da4416e17d1f8cb5f7f0e822db9e0
humanhash: illinois-blossom-april-virginia
File name:aadccab126517a622697730983aaee1b8475bd0f16e09b296649ea0740e5ab3c
Download: download sample
Signature ZeuS
Create hunting rule
File size:359'936 bytes
First seen:2020-10-25 02:35:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e854de4982330f09e44a786099b68051 (1 x ZeuS)
ssdeep 3072:VY0nPQ6Urv1+mO0neRSUNEyKmLL7GHwEJn/nkAD0LzumGMNamKsYgZHtftzZBaw:VY046CqWeRPNEyKmDCJ/kdGnMN0sY61
Threatray 105 similar samples on MalwareBazaar
TLSH 3B746CA92FB43E08C6169934DD751E3DF1A47F6E0CADF0225395E78E102DAE8E4707A1
Reporter tildedennis
Tags:zeus 2


Avatar
tildedennis
zeus 2 version 2.0.7.5

Intelligence

File Origin
# of uploads :
1
# of downloads :
144
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75321/
Detection(s):
Win.Spyware.Zbot-1282
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
ZeusVM
Create hunting rule
Detection:
malicious
Classification:
bank.troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/508865
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to detect sleep reduction / modifications
Contains VNC / remote desktop functionality (version string found)
Detected ZeusVM e-Banking Trojan
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aadccab126517a622697730983aaee1b8475bd0f16e09b296649ea0740e5ab3c/
Threat name:
Win32.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2011-05-24 10:44:00 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vlomvmjgkf5gejuxomeyhkxodochlpipc3qjwklgjhvaoqhfvm6a._file
Verdict:
malicious
Similar samples:
0d812586b239b0ce1c4f3f9347386c75e70ab098659c019e100160078b821aa5
ZeuS
0d96c8a11fe748d1258fc20378d3e354fd468dd7ba9d07670497024b6fb03406
ZeuS
1f3842bc152088bc10de6e14adabf860902dee318375a6567e0b85a9faaed1f0
ZeuS
24a1e4d82d8a6b9594aa9bc4d26df0f212c6b2cf48964fdd46cdad6c03782a1f
ZeuS
37259fff5937e8c92679a70cff7fc4b81043451ce705c982398865b17c7fd2a5
ZeuS
3ee04e378f6430e85f5756093e80b243c2ebbcb9f2ee77cc32acd1cd9e333301
ZeuS
5c3bde59fa48471670841beba658fc9cfe707fac64b4b7f8446dd51a7706d133
ZeuS
73acff9ea3647f699cd645b09e652ca498eea7c5cee9f3cb573afda67a0ceeb2
ZeuS
88303bec606c271a2db6fe1bb0945c7e79835203ff2d9ee629c1d9e3987ccaac
ZeuS
f473938086334f7e6877e53b350339f11cfcc87ba10ec04a17bccfdf4d47a301
ZeuS
+ 95 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201025-kmxfadymws/
Unpacked files
SH256 hash:
aadccab126517a622697730983aaee1b8475bd0f16e09b296649ea0740e5ab3c
MD5 hash:
a58da4416e17d1f8cb5f7f0e822db9e0
SHA1 hash:
5ad492be9cb4b1b474d17bb449943d623a9edc64
Link:
https://www.unpac.me/results/f70f0afd-8da7-4fd2-ad30-43c93fa82f61/
SH256 hash:
32ff1089b4f6d0fda180285943c4e571a2f4d1b16089408b9dbc16bc80903c5c
MD5 hash:
d6b3e417550709b13473bbdb74d5d0c9
SHA1 hash:
21039f0df2be04c0dccaf058bb01ae65c475f76e
Link:
https://www.unpac.me/results/f70f0afd-8da7-4fd2-ad30-43c93fa82f61/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.32
Link:
https://yomi.yoroi.company/submissions/aadccab126517a622697730983aaee1b8475bd0f16e09b296649ea0740e5ab3c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://zeusmuseum.com/zeus 2/
Cape
Cape
https://www.capesandbox.com/analysis/75321/

Comments