MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0dfbb822dea47692a8ed0d266c518495f1a3efd3a4208fb5251bcdf08f18d42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: c0dfbb822dea47692a8ed0d266c518495f1a3efd3a4208fb5251bcdf08f18d42
SHA3-384 hash: 6b5d78f01be866133971cf69a9d25e864d0e69f7ed77144e61e87afbb378e98db6730d9c6d2f11449a904a6c1a11c686
SHA1 hash: 8625c393222f587074feee1af1c6e4807faea43f
MD5 hash: 03daacbdcdd8b7a202fd3d4c56ca3bf4
humanhash: south-glucose-august-green
File name:sphinx_1.0.2.0.vir
Download: download sample
Signature ZeusSphinx
File size:1'597'952 bytes
First seen:2020-07-19 19:47:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 407b629c79bcfbc2415378d63463ab0a
ssdeep 24576:GxhZeN7hZoD1bTpEJaPFoajgyjsS0U7lU29mBYKUikrbp8pCiLAc6jS:GxhZeiJbT2stTYrUa2DKei0NS
TLSH 5775233526E56338E16BC6305BA895B9946DF5F12C334C82FC076E015B32F48CAB6E63
Reporter @tildedennis
Tags:sphinx ZeusSphinx


Twitter
@tildedennis
sphinx version 1.0.2.0

Intelligence


File Origin
# of uploads :
1
# of downloads :
30
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Launching a process
Connection attempt
Moving a file to the %AppData% subdirectory
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Forced shutdown of a system process
Connection attempt to an infection source
Unauthorized injection to a browser process
Unauthorized injection to a system process
Result
Threat name:
ZeusVM
Detection:
malicious
Classification:
rans.phis.bank.troj.spyw.evad
Score:
100 / 100
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247638 Sample: sphinx_1.0.2.0.vir Startdate: 20/07/2020 Architecture: WINDOWS Score: 100 54 Potential malicious icon found 2->54 56 Antivirus / Scanner detection for submitted sample 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 5 other signatures 2->60 9 sphinx_1.0.2.0.exe 2->9         started        process3 dnsIp4 44 1.0.2.0 CLOUDFLARENETUS China 9->44 70 Detected unpacking (changes PE section rights) 9->70 72 Detected unpacking (overwrites its own PE header) 9->72 74 Detected ZeusVM e-Banking Trojan 9->74 76 3 other signatures 9->76 13 sphinx_1.0.2.0.exe 5 9->13         started        signatures5 process6 file7 36 C:\Users\user\AppData\Roaming\...\onceu.exe, PE32 13->36 dropped 38 C:\Users\user\AppData\...\tmp4f37a9fe.bat, DOS 13->38 dropped 16 onceu.exe 13->16         started        19 cmd.exe 1 13->19         started        process8 signatures9 46 Antivirus detection for dropped file 16->46 48 Detected unpacking (changes PE section rights) 16->48 50 Detected unpacking (overwrites its own PE header) 16->50 52 3 other signatures 16->52 21 onceu.exe 16->21         started        24 conhost.exe 19->24         started        process10 signatures11 62 Injects code into the Windows Explorer (explorer.exe) 21->62 64 Writes to foreign memory regions 21->64 66 Allocates memory in foreign processes 21->66 68 2 other signatures 21->68 26 XgZTxRVknrXNNrBa.exe 2 2 21->26 injected 29 XgZTxRVknrXNNrBa.exe 21->29 injected 31 XgZTxRVknrXNNrBa.exe 21->31 injected 33 17 other processes 21->33 process12 dnsIp13 78 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 26->78 80 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 26->80 82 Tries to steal Mail credentials (via file access) 26->82 86 3 other signatures 26->86 84 Overwrites code with function prologues 29->84 40 104.108.35.215, 49717, 80 AKAMAI-ASUS United States 33->40 42 104.108.49.57, 443, 49709, 49718 AKAMAI-ASUS United States 33->42 signatures14
Threat name:
Win32.Trojan.Zeus
Status:
Malicious
First seen:
2016-04-15 10:55:00 UTC
AV detection:
25 of 31 (80.65%)
Threat level
  5/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx persistence
Behaviour
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Modifies Internet Explorer settings
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Adds Run key to start application
Adds Run key to start application
Loads dropped DLL
Deletes itself
Executes dropped EXE
UPX packed file
Executes dropped EXE
UPX packed file
Threat name:
Unknown
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments