MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d44bcd92b146cc8565b8b615b4f4447dba73677a7b7df9897736e8d84ff14b6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d44bcd92b146cc8565b8b615b4f4447dba73677a7b7df9897736e8d84ff14b6e
SHA3-384 hash:	95ef0e95d4cc87379ac55f46fe0718248e6224f534dfc64167ae10f4405a92bf65e821f70206e62854e41ecc31eac47f
SHA1 hash:	cce574c7ec8b7137480e9540d364e43a26374540
MD5 hash:	aaa6d44e7e6d45858e9c49a4b91bbdc2
humanhash:	low-april-ohio-vegan
File name:	zeus 1_1.3.3.5.vir
Download:	download sample
Signature	ZeuS
File size:	101'376 bytes
First seen:	2020-07-19 19:35:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	368b62730ff3f4e680dbe0d8d9b19919
ssdeep	1536:As+ri51c32c/KYsyUzNXnF9iw7wIolRWx79Ee7SjqeKMYgCnwBbZmYpgH15Gu:ZYv2dKUzNXF/0I0cx1mjpiJwdl2bGu
TLSH	1AA3F12F343D0563E8B307F9A3B16A83CBCC95426417ADA63089E58C9F4A1E5C5DFB54
Reporter	@tildedennis
Tags:	ZeuS zeus 1

@tildedennis

zeus 1 version 1.3.3.5

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

20

Origin country :

FR

Mail intelligence

No data

Vendor Threat Intelligence

CAPE Sandbox

Gathering data

ClamAV Detected

Detection(s):

Win.Trojan.Zbot-9070

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Sending an HTTP GET request

Creating a file in the %temp% subdirectories

Reading critical registry keys

Creating a file

Deleting a recently created file

Reading Telegram data

Running batch commands

Creating a process with a hidden window

Launching a process

Sending a TCP request to an infection source

Stealing user critical data

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/390430

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d44bcd92b146cc8565b8b615b4f4447dba73677a7b7df9897736e8d84ff14b6e/

ReversingLabs TitaniumCloud Malicious

Threat name:

Win32.Trojan.Zbot

Status:

Malicious

First seen:

2013-01-02 00:00:00 UTC

AV detection:

29 of 31 (93.55%)

Threat level

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://www.spamhaus.org/query/hash/2rf43evri3gikznywyk3j5cepw5hgz32pn67tclxg3unqt7rjnxa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/200719-pkwk9q1sx2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Drops file in System32 directory

Modifies WinLogon for persistence

VirusTotal 86.11%

AV coverage:

86.11%

AV detections:

62 / 72

Link:

https://www.virustotal.com/gui/file/d44bcd92b146cc8565b8b615b4f4447dba73677a7b7df9897736e8d84ff14b6e/detection/f-d44bcd92b146cc8565b8b615b4f4447dba73677a7b7df9897736e8d84ff14b6e-1578642264

YOROI YOMI Unknown

Threat name:

Unknown

Score:

1.00

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

  

Link

https://zeusmuseum.com/zeus 1/

Cape

https://www.capesandbox.com/analysis/28281/