MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0fd23c542d2a0ad3b6c049f8938a196b3835613686eeb79688c6379d3fe102e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZeuS


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0fd23c542d2a0ad3b6c049f8938a196b3835613686eeb79688c6379d3fe102e
SHA3-384 hash: 09da0a37b30de8fe9d898e4ff5724283a91ed8ba674fa3e14a32cffcef0d93fbf9f355cd3db8b1f33f34ef361c0269e2
SHA1 hash: 92af47a758950378c70eaaaa313c72c3148b5c76
MD5 hash: 794383d01cd676f3954cc509a00edf26
humanhash: lamp-florida-triple-victor
File name:f0fd23c542d2a0ad3b6c049f8938a196b3835613686eeb79688c6379d3fe102e
Download: download sample
Signature ZeuS
Create hunting rule
File size:174'592 bytes
First seen:2020-08-30 13:19:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6ce6e7eb74fc364c63eaf54ff8b1b84d (1 x ZeuS)
ssdeep 3072:BMRLLiWBwsa+CvhRJCXkXRV9y+jec715wf216UMzAZB8t4atE3jxDrzJ6rLgC:B6LAsaLvMXkXxxic7e2rMTTE3jx96rL
Threatray 7 similar samples on MalwareBazaar
TLSH D2041201EDD17C18EA5A817204B32D1286C4FC717155CE6F73A99B5CEF3A667A480A3F
Reporter tildedennis
Tags:unnamed 3 ZeuS


Avatar
tildedennis
unnamed 3 version 3.0.2.3

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'700
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/53131/
Detection(s):
PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

Win.Trojan.Zbot-14649
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/454640
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0fd23c542d2a0ad3b6c049f8938a196b3835613686eeb79688c6379d3fe102e/
Threat name:
Win32.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2011-11-13 09:35:00 UTC
AV detection:
24 of 25 (96.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6d6shrkc2kqk2o3maspysofbs2zygvqtnbxow6lirrrxtu76caxa._file
Verdict:
unknown
Similar samples:
03de249179aca1995c6d814312d5c9085f3d8fe668f7601f6320afb2f8f98d18
ZeuS
4c850cfff31192c9f8439e0b9e4127d0b419c9909d2c85e7e99a5bb0115db3c9
ZeuS
4e49f5147939257640ba4990f520c9dbe355c83b73d9deadfc8505c4a09f931d
ZeuS
4fdaee1072210091799af73f630e0eb993a1d2d42005dc096d1422d9924f1ad5
ZeuS
7023401afba5b814cf592d063996f83c00903667bcf4aaf905fefcd79354fc2e
ZeuS
70e1d2fba60a7d20e531b09ff328fef21b82bb7e87d78a48f964d82c7dd2680f
ZeuS
94c9336a6e056520105481a9082e7e84c8a98a794a06b037c573bd9efc9df809
ZeuS
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/200830-j1wvr52efj/
Behaviour
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Zbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f0fd23c542d2a0ad3b6c049f8938a196b3835613686eeb79688c6379d3fe102e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://zeusmuseum.com/unnamed 3/
Cape
Cape
https://www.capesandbox.com/analysis/53131/

Comments