MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3f8265bfcc61ef328a8f776318d74e588873047f51e0dc8e445c1f6d4334f30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: c3f8265bfcc61ef328a8f776318d74e588873047f51e0dc8e445c1f6d4334f30
SHA3-384 hash: 2b1f623b874cf166e44a9126054c983336d9537db7fbdcc095a34ad07454451dca0302f30fbb9fc9f502e50e58115fd8
SHA1 hash: c884ba2f073a775a69d03f6342804c3c4f6abb5d
MD5 hash: 36269d4e8402c65c5f46aef0313db9c3
humanhash: monkey-connecticut-green-autumn
File name:sphinx_1.0.1.0.vir
Download: download sample
Signature ZeuS
File size:1'578'496 bytes
First seen:2020-07-19 19:34:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 073b635f96d34dbfc010cbb9ab2d156d
ssdeep 24576:FKNTb9KPXl+Rpxy4E1sImcB6KLH0cO9yYW1ZKMD/BUleKhZUWpKm1fD2lU35I0:IF9olCi4KszLaH0CYWh6rUWd1C67
TLSH 9A7502B7B9819CFBD9521235C8B2E3337279D9B04723CF87D35448356E226A16EC9386
Reporter @tildedennis
Tags:sphinx ZeuS


Twitter
@tildedennis
sphinx version 1.0.1.0

Intelligence


File Origin
# of uploads :
1
# of downloads :
23
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Threat name:
ZeusVM
Detection:
malicious
Classification:
phis.bank.troj.spyw.evad
Score:
100 / 100
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247383 Sample: sphinx_1.0.1.0.vir Startdate: 20/07/2020 Architecture: WINDOWS Score: 100 46 Antivirus / Scanner detection for submitted sample 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Detected ZeusVM e-Banking Trojan 2->50 52 5 other signatures 2->52 7 sphinx_1.0.1.0.exe 4 2->7         started        process3 dnsIp4 34 1.0.1.0 CLOUDFLARENETUS China 7->34 32 C:\Users\user\AppData\Roaming\...\dyho.exe, MS-DOS 7->32 dropped 64 Detected ZeusVM e-Banking Trojan 7->64 66 Injects code into the Windows Explorer (explorer.exe) 7->66 68 Contains functionality to inject code into remote processes 7->68 70 3 other signatures 7->70 12 dyho.exe 7->12         started        15 explorer.exe 9 7->15         started        18 explorer.exe 7->18         started        file5 signatures6 process7 dnsIp8 72 Antivirus detection for dropped file 12->72 74 Detected ZeusVM e-Banking Trojan 12->74 76 Machine Learning detection for dropped file 12->76 80 5 other signatures 12->80 20 HLVpQDPunNbvkhFHcRHAkXPIxfUeL.exe 2 2 12->20 injected 23 HLVpQDPunNbvkhFHcRHAkXPIxfUeL.exe 12->23 injected 25 HLVpQDPunNbvkhFHcRHAkXPIxfUeL.exe 12->25 injected 29 16 other processes 12->29 40 194.109.206.212, 443, 49732 XS4ALL-NLAmsterdamNL Netherlands 15->40 42 86.59.21.38, 443, 49733 UTA-ASAT Austria 15->42 44 4 other IPs or domains 15->44 78 System process connects to network (likely due to code injection or exploit) 15->78 27 conhost.exe 15->27         started        signatures9 process10 dnsIp11 54 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 20->54 56 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 20->56 58 Tries to steal Mail credentials (via file access) 20->58 62 3 other signatures 20->62 60 Overwrites code with function prologues 23->60 36 2.17.179.193, 443, 49712 AKAMAI-ASUS European Union 29->36 38 84.53.167.113, 49711, 80 AKAMAI-ASUS European Union 29->38 signatures12
Threat name:
Win32.Trojan.Zbot
Status:
Malicious
First seen:
2015-10-03 07:31:09 UTC
AV detection:
25 of 25 (100.00%)
Threat level
  5/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
NTFS ADS
Modifies Internet Explorer settings
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Adds Run key to start application
Adds Run key to start application
Deletes itself
Loads dropped DLL
Executes dropped EXE
UPX packed file
Executes dropped EXE
UPX packed file
Threat name:
Unknown
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments