MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1c21947e1a6d21286c6aabf649edaf9796789885fbaba5b62a91f7b5e581091. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c1c21947e1a6d21286c6aabf649edaf9796789885fbaba5b62a91f7b5e581091
SHA3-384 hash:	39886e5544397e9a016410b9d72a3ee18a15b9a5cec7e44f933f67cf85d59e9110576dd2971ca9a0f808cc69e91f6c00
SHA1 hash:	25903fc6a76bccc1fc3582cdea14a4d282ef5076
MD5 hash:	e71c08a1ff2b9528980b064dad367106
humanhash:	ten-mirror-bulldog-cola
File name:	zeus 1_1.3.3.1.vir
Download:	download sample
Signature	ZeuS
File size:	144'896 bytes
First seen:	2020-07-19 19:28:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d1acc60e71761b2c6a1f99b04dc30ae7
ssdeep	3072:jEsnTJKG4H+zRRwA8PPmc03FM/McUiLXnDdeH5A9++wIpwjf4bwNnN:jJGeoA8GbxcXXx9GIpWUwNN
TLSH	63E3028CD9A254C5E8410CB405BB95A22E3ED76937BC93396B4CE9A51FC30298CD33F5
Reporter	@tildedennis
Tags:	ZeuS zeus 1

@tildedennis

zeus 1 version 1.3.3.1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

22

Origin country :

FR

Mail intelligence

No data

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/28200/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Cryptic.G.2567.30645.19630.UNOFFICIAL

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Connection attempt to an infection source

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/390284

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c1c21947e1a6d21286c6aabf649edaf9796789885fbaba5b62a91f7b5e581091/

ReversingLabs TitaniumCloud Malicious

Threat name:

Win32.Trojan.Zbot

Status:

Malicious

First seen:

2011-06-03 03:02:00 UTC

AV detection:

23 of 25 (92.00%)

Threat level

  5/5

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/200719-d4g7es2q9a/

Behaviour

Suspicious behavior: EnumeratesProcesses

Drops file in System32 directory

Modifies WinLogon for persistence

VirusTotal 79.45%

AV coverage:

79.45%

AV detections:

58 / 73

Link:

https://www.virustotal.com/gui/file/c1c21947e1a6d21286c6aabf649edaf9796789885fbaba5b62a91f7b5e581091/detection/f-c1c21947e1a6d21286c6aabf649edaf9796789885fbaba5b62a91f7b5e581091-1585565620

YOROI YOMI Unknown

Threat name:

Unknown

Score:

1.00

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

  

Link

https://zeusmuseum.com/zeus 1/

Cape

https://www.capesandbox.com/analysis/28200/