MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d99339360b38f6fd181678111f8a1b1ce54ca1c027c3fcf3ddb6ea28148e0088. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZeuS


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d99339360b38f6fd181678111f8a1b1ce54ca1c027c3fcf3ddb6ea28148e0088
SHA3-384 hash: 2981e8381a9cdc1a33c6fc5a566fbeb4096ce1412e953e42beeba919e81d4f8f6b28ce21b449b8cf5a1abb25a650484a
SHA1 hash: b7df80901ee7422b2c4538bd4fbf610d2a6fca4f
MD5 hash: 0845fc6f8bffbf25af613df1b6af5c1c
humanhash: louisiana-william-cat-robin
File name:d99339360b38f6fd181678111f8a1b1ce54ca1c027c3fcf3ddb6ea28148e0088
Download: download sample
Signature ZeuS
Create hunting rule
File size:67'072 bytes
First seen:2020-08-16 15:15:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 12e8e5a06b97ff3a3cfaf07cf5a2a514 (1 x ZeuS)
ssdeep 1536:19dNhY/hMn9urJV0SfPYAKcJ64SpBOvQGOq0H:19djY/h2uVVNER4SpBOmdH
Threatray 63 similar samples on MalwareBazaar
TLSH A563F1C7EF93AEA6C300D37082A1D52ACCE29F511DA6476DE82014AB244535F3FF6697
Reporter tildedennis
Tags:ZeuS zeus 1


Avatar
tildedennis
zeus 1 version 1.3.1.8

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'724
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46534/
Detection(s):
Win.Trojan.Zbot-5776
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Enabling the 'hidden' option for recently created files
Sending a UDP request
Unauthorized injection to a system process
Enabling autorun
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/432337
Signature
Allocates memory in foreign processes
Changes memory attributes in foreign processes to executable or writable
Contains functionality to change the desktop window for a process (likely to hide graphical interactions)
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d99339360b38f6fd181678111f8a1b1ce54ca1c027c3fcf3ddb6ea28148e0088/
Threat name:
Win32.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2011-06-16 07:46:00 UTC
File Type:
PE (Exe)
AV detection:
28 of 30 (93.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3gjtsnqlhd3p2gawpair7cq3dtsuzioae7b7z465w3vcqfeoacea._file
Verdict:
malicious
Similar samples:
1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973
ZeuS
2f2d9760aa86fa4b197c2dcbb361c85cbb63a40a8c7049a561fa720f67a9bb87
ZeuS
43b6dc747c6623e7dd015d1af51aadfb357815712960781342855291941ae0da
ZeuS
4549a428260ba0c60e1f59e1b30e5198df946baf93ecd037cf657c11d2d62dfd
ZeuS
89e35356978b8320736b890db74c9f70f4ab89dc7343bbdfb9cd80530dd4df32
ZeuS
93e7f4109711d62264dd5c292840556786b308a5014b9ef1691bbbabf4ed9aef
ZeuS
9c01cf666c922c17867f4d2a85d090376c6f82e2c77b16de330d116f147fca59
ZeuS
a32036a66a060f3592f621d1181683d2d07682815f43dbeffef771bb50776ee4
ZeuS
ef82875918958a6a376fe6bf6562b136ebd61b816b34d4318b6aa4e150fa510c
ZeuS
f46d61129fce27a1da5e4c47d3b7e515cb101878722f57f515df14b061e13af1
ZeuS
+ 53 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/200816-hzvvnyhefe/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Wsnpoem
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d99339360b38f6fd181678111f8a1b1ce54ca1c027c3fcf3ddb6ea28148e0088

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_zeus_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://zeusmuseum.com/zeus 1/
Cape
Cape
https://www.capesandbox.com/analysis/46534/

Comments