MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3f8265bfcc61ef328a8f776318d74e588873047f51e0dc8e445c1f6d4334f30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZeuS


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3f8265bfcc61ef328a8f776318d74e588873047f51e0dc8e445c1f6d4334f30
SHA3-384 hash: 2b1f623b874cf166e44a9126054c983336d9537db7fbdcc095a34ad07454451dca0302f30fbb9fc9f502e50e58115fd8
SHA1 hash: c884ba2f073a775a69d03f6342804c3c4f6abb5d
MD5 hash: 36269d4e8402c65c5f46aef0313db9c3
humanhash: monkey-connecticut-green-autumn
File name:sphinx_1.0.1.0.vir
Download: download sample
Signature ZeuS
Create hunting rule
File size:1'578'496 bytes
First seen:2020-07-19 19:34:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 073b635f96d34dbfc010cbb9ab2d156d (1 x ZeuS)
ssdeep 24576:FKNTb9KPXl+Rpxy4E1sImcB6KLH0cO9yYW1ZKMD/BUleKhZUWpKm1fD2lU35I0:IF9olCi4KszLaH0CYWh6rUWd1C67
Threatray 111 similar samples on MalwareBazaar
TLSH 9A7502B7B9819CFBD9521235C8B2E3337279D9B04723CF87D35448356E226A16EC9386
Reporter tildedennis
Tags:sphinx ZeuS


Avatar
tildedennis
sphinx version 1.0.1.0

Intelligence

File Origin
# of uploads :
1
# of downloads :
403
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zeus
Create hunting rule
Link:
https://www.capesandbox.com/analysis/28260/
Detection(s):
Win.Trojan.Zeus-6412294-0
Create hunting rule

PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

Win.Trojan.Zbot-64382
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Threat name:
ZeusVM
Create hunting rule
Detection:
malicious
Classification:
phis.bank.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/390382
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247383 Sample: sphinx_1.0.1.0.vir Startdate: 20/07/2020 Architecture: WINDOWS Score: 100 46 Antivirus / Scanner detection for submitted sample 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Detected ZeusVM e-Banking Trojan 2->50 52 5 other signatures 2->52 7 sphinx_1.0.1.0.exe 4 2->7         started        process3 dnsIp4 34 1.0.1.0 CLOUDFLARENETUS China 7->34 32 C:\Users\user\AppData\Roaming\...\dyho.exe, MS-DOS 7->32 dropped 64 Detected ZeusVM e-Banking Trojan 7->64 66 Injects code into the Windows Explorer (explorer.exe) 7->66 68 Contains functionality to inject code into remote processes 7->68 70 3 other signatures 7->70 12 dyho.exe 7->12         started        15 explorer.exe 9 7->15         started        18 explorer.exe 7->18         started        file5 signatures6 process7 dnsIp8 72 Antivirus detection for dropped file 12->72 74 Detected ZeusVM e-Banking Trojan 12->74 76 Machine Learning detection for dropped file 12->76 80 5 other signatures 12->80 20 HLVpQDPunNbvkhFHcRHAkXPIxfUeL.exe 2 2 12->20 injected 23 HLVpQDPunNbvkhFHcRHAkXPIxfUeL.exe 12->23 injected 25 HLVpQDPunNbvkhFHcRHAkXPIxfUeL.exe 12->25 injected 29 16 other processes 12->29 40 194.109.206.212, 443, 49732 XS4ALL-NLAmsterdamNL Netherlands 15->40 42 86.59.21.38, 443, 49733 UTA-ASAT Austria 15->42 44 4 other IPs or domains 15->44 78 System process connects to network (likely due to code injection or exploit) 15->78 27 conhost.exe 15->27         started        signatures9 process10 dnsIp11 54 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 20->54 56 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 20->56 58 Tries to steal Mail credentials (via file access) 20->58 62 3 other signatures 20->62 60 Overwrites code with function prologues 23->60 36 2.17.179.193, 443, 49712 AKAMAI-ASUS European Union 29->36 38 84.53.167.113, 49711, 80 AKAMAI-ASUS European Union 29->38 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3f8265bfcc61ef328a8f776318d74e588873047f51e0dc8e445c1f6d4334f30/
Threat name:
Win32.Trojan.Zbot
Create hunting rule
Status:
Malicious
First seen:
2015-10-03 07:31:09 UTC
AV detection:
25 of 25 (100.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1f3842bc152088bc10de6e14adabf860902dee318375a6567e0b85a9faaed1f0
ZeuS
233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330
ZeuS
2fa19780fb5e238d3ac3491b18e2c795d0a4cc31d5c03c9b4a727613397c23e5
ZeuS
37259fff5937e8c92679a70cff7fc4b81043451ce705c982398865b17c7fd2a5
ZeuS
4763270a84a8a6d756eaf4b5d9ed3b6a0e9e254c682f075a5338247dca3403a3
ZeuS
5c3bde59fa48471670841beba658fc9cfe707fac64b4b7f8446dd51a7706d133
ZeuS
b05e4d408f5731b0bb0c194570a3c86a31ce291ec70b54e1e76ecd5bc9bee3f7
ZeuS
c0dfbb822dea47692a8ed0d266c518495f1a3efd3a4208fb5251bcdf08f18d42
ZeuS
e4cd3a3bbf851aea2645ff32eeb8fbe177b79bf8149737c52acb413b2ff13eb6
ZeuS
f06047b09abc77529969c5949deda36ff154539d1b9ed8942c22fbb307d8aac9
ZeuS
+ 101 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx persistence
Link:
https://tria.ge/reports/200719-evn9c26zzx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
NTFS ADS
Modifies Internet Explorer settings
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Adds Run key to start application
Adds Run key to start application
Deletes itself
Loads dropped DLL
Executes dropped EXE
UPX packed file
Executes dropped EXE
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c3f8265bfcc61ef328a8f776318d74e588873047f51e0dc8e445c1f6d4334f30

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://zeusmuseum.com/sphinx/
Cape
Cape
https://www.capesandbox.com/analysis/28260/

Comments